Smarter AI Is Creating a Cybersecurity Boom

Editor's note: AI models are getting more advanced... accessing more data and taking more actions on their own. But as Nick Rokke from our corporate affiliate Brownstone Research explains, that's both a positive and a negative for businesses. In today's issue, adapted from the daily e-letter The Bleeding Edge, Nick breaks down the threats sophisticated AI agents pose... and which kinds of companies stand to benefit.

Bank of America brought in 1,000 extra people to help fix software weaknesses exposed by AI.

That admission caught my attention as I was combing through bank earnings calls two weeks ago. I was looking for clues about the strength of the consumer and the credit market.

Instead, I found another sign of the spending wave building beneath the AI boom.

CEO Brian Moynihan disclosed that those contractors had joined the roughly 3,000 people already working in that area. The contractors started in the second quarter. Half a year later, they are still on the job.

And Bank of America isn't alone.

Earlier this month, JPMorgan Chase CEO Jamie Dimon told Bloomberg TV that cybersecurity risks "went up 10-fold" after Anthropic launched Mythos, an advanced AI model.

In short, two of America's largest banks are confronting the same challenge. Sophisticated AI is exposing weaknesses in the software businesses depend on. Repairing those weaknesses requires people, tools, and money.

Bank of America has 4,000 people on payroll to handle this. But what are smaller companies supposed to do?

That question points us toward another investment opportunity.

Most investors are focused on the chips and data centers needed to run AI. But businesses will also need protection as AI models become more capable and gain access to more of their operations.

To understand why, we need to look at what these models can do...

AI Is Finding the Cracks

Software vulnerabilities can let someone access information – or perform an action – that they shouldn't be able to.

These weaknesses can remain hidden for years. Businesses run software built by different teams, often using components supplied by outside companies. Even a well-protected organization can inherit a flaw from a vendor.

More advanced AI gives security teams a better way to search for those problems. Models can examine code and help determine whether a weakness can be exploited.

But discovering a problem creates another job.

Someone must confirm the flaw, develop a repair, test it, and then install it without breaking the systems people depend on. In other words, AI creates more security work even as it automates parts of the process.

And businesses are about to give AI systems much more responsibility – which creates another difficulty...

Your Next Employee Needs Guardrails

Increasingly, people and companies are using AI agents to handle tasks. These AI models can act without ongoing input from a human being.

That can be convenient – unless the agent takes unexpected measures. And the more power and access we give them, the higher the stakes rise.

Say a company wants to use a customer service agent to issue refunds, for example... or a coding agent to modify company software... or a finance agent to prepare payments.

Giving agents more permissions makes them more useful. It also increases the importance of setting effective boundaries.

Consider a hypothetical: An AI agent is allowed to issue refunds below $100. A customer requests $250, which should require a manager's approval.

But the agent gets around that restriction by issuing three smaller refunds.

There may be no broken code in this example. The weakness lies in the gap between what the company intended and what its systems allow.

Businesses therefore face two sources of risk: outsiders using AI against them, and their own agents taking unintended actions. Both require protection.

How to Build a Cybersecurity Army

This brings me back to the question in my opening.

What does a smaller business do when it needs a major software-repair effort?

It buys outside help. That can include security software, outside monitoring, and specialists who investigate threats and deploy repairs. Larger companies buy these capabilities for their vast personnel, too. Their internal teams need tools to protect increasingly complex operations.

I see three main areas worth following for investors as AI agents spread.

First is protecting the underlying systems.

Palo Alto Networks (PANW), for instance, supplies security across networks, cloud environments, and other parts of a business. Its acquisition of CyberArk also expanded its identity-security capabilities.

Second is controlling who, or what, gets access to those systems.

Okta (OKTA) offers tools to discover AI agents, manage their identities, and control access to business resources. It helps ensure that only authorized agents are inside – and that those agents only receive enough access and permissions to do their jobs.

Third is securing activity as agents work.

Zscaler (ZS) is extending its zero-trust approach to AI agents. In plain English, that means access credentials must be constantly checked rather than automatically trusted once an agent is inside the company's environment. Its offerings address how agents access data, call software tools, and interact with other agents.

These capabilities overlap. A business may purchase several through one provider. But looking at the situation this way helps us understand what customers need and where the opportunity lies.

Data Protection Is Crucial to the AI Build-Out

Bank of America hiring security contractors is the start of a longer-term trend. AI will continually find new ways to exploit software. It's too early to tell if networks and applications will ever be truly impenetrable.

Software keeps changing. Companies add suppliers, connect systems, and introduce new applications. Deploying AI agents adds another set of access decisions and security requirements.

That creates demand for continuous protection. The strongest investment candidates will be the companies that turn that demand into larger contracts and recurring revenue.

Bank of America has already shown us that more advanced AI can create a substantial repair bill. As companies give digital workers more responsibility, protecting their systems becomes part of the cost of putting AI to work.

That makes cybersecurity critical for AI adoption and gives the companies supplying it another avenue for growth.

Regards,

Nick Rokke

Editor's note: Until recently, AI could match only 1% of the human brain's capacity. But a new AI "super chip" supports 120 trillion neural connections – more than the brain and 100 times more than competing chips. Put simply, it could be the breakthrough of the AI era – and a game changer for investors...

Today, at 10 a.m. Eastern time, our own Whitney Tilson is going live in a free online event with Brownstone Research founder Jeff Brown to share all the details. Make sure you reserve your spot before the event begins.