AI can make cyberattacks faster and smarter

EY forecasts that AI will become a major driver of cybercrime in 2026, enabling faster and more convincing scams. This elevates operational and reputational risk for consumer-facing firms and increases demand for cybersecurity products and services. Portfolio action: consider modest tilts into cybersecurity vendors and monitor incident volumes and regulatory responses closely.

Analysis

AI will compress the attacker learning curve and materially lower cost-per-attempt, which implies a much higher volume of tailored phishing and social-engineering campaigns over the next 6–24 months. Enterprises that can ingest large-scale telemetry and apply real-time behavioral baselining will see win rates improve; vendors with proprietary, cross-customer signal graphs (endpoint + cloud + network) are best positioned to monetize this shift via higher ARR and attach rates.

Second-order winners include identity and zero-trust providers, cloud telemetry/observability plays, and GPU/cloud infra vendors that rent cycles for model fine-tuning; losers include single-product legacy AV vendors, cyber insurers with stale pricing models, and consumer platforms that monetize social flows without strong identity proofing. Regulatory and litigation risk rises: mandatory breach disclosure, tighter privacy controls, or carrier-driven underwriting changes could crystallize losses for exposed platforms within 12–36 months and re-rate related insurers.

Tail risks: a high-scale, AI-driven campaign that successfully mimics executive voices at dozens of large corporates could trigger large financial losses and force immediate capital/contracting disruption in targeted sectors (days–weeks). Near-term catalysts that would reverse the trend are rapid passkey adoption, wide deployment of network-level AI defenders, or insurer-imposed mandatory MFA/zero-trust clauses that materially raise attacker cost again. The market reaction will be heterogeneous; growth-tier cyber names that already trade on data moat will likely outperform commodity security vendors during the repricing cycle.

Key Decisions for Investors

• Long CrowdStrike (CRWD) — buy a 9–12 month 10–20% OTM call spread to get asymmetric upside if telemetry-led wins accelerate. R/R: limited premium for ~2–3x upside if subscription growth re-accelerates; max loss = premium.
• Pair trade: long Palo Alto Networks (PANW) stock / short NortonLifeLock (NLOK) equal notional for 6–12 months. Rationale: PANW benefits from enterprise AI-signal platforms and cloud security attach; NLOK faces consumer churn and lower ability to monetize AI-driven threats. Target: net +20–30% if thesis runs; risk: sector multiple compression could hurt both.
• Long Zscaler (ZS) 12-month calls as a play on accelerated zero-trust adoption; alternativley buy the sector ETF (HACK) for diversified exposure. R/R: expect 25–40% upside if enterprise cloud migration triggers faster security spend; downside is premium decay if adoption stalls.
• Hedge tail-risk: buy cheap protection via long-dated cyber-insurance catastrophe swaps or allocations to select reinsurers with strong balance sheets (e.g., CB/RE insurers) or buy deep OTM puts on high-exposure platform stocks for 3–9 months to protect against reputational breach shocks. R/R: small cost for high payoff in low-probability large-loss scenarios.