Project Glasswing by Antropic didn't just find the bugs. It also found the real vulnerability in cybersecurity.

Anthropic’s Project Glasswing found more than 10,000 critical vulnerabilities in a month, including 271 in Firefox, 2,000 in Cloudflare systems, and a critical flaw in wolfSSL that could have enabled certificate forgery. The bigger takeaway is that only 75 of 6,200 critical open-source vulnerabilities have been patched, highlighting a severe lag between discovery and remediation. The article argues AI is commoditizing vulnerability discovery and shifting value toward automated patch generation, validation, and deployment.

Analysis

The first-order read is bullish for the cybersecurity category, but the second-order effect is a margin and mix shift away from “find” toward “fix.” That is structurally worse for incumbent threat-intelligence and endpoint vendors whose differentiation increasingly lives in detection volume, alerting, and workflow rather than closed-loop remediation. If AI materially compresses discovery costs faster than it compresses patch deployment, the economic value migrates to the layer that can automate validation, rollout, and rollback across heterogeneous fleets.

For NET and CRWD specifically, the market is likely underestimating the timing mismatch. In the next 3-12 months, the near-term beneficiary is not pure detection software; it is infrastructure that can absorb vulnerability floods, reduce patch latency, and enforce policy at scale. But if these names don’t prove they can monetize remediation, they risk becoming higher-multiple plumbing around a commoditized input: security findings generated by everyone’s frontier model. That implies lower durable pricing power even if headline budgets rise.

The more interesting commercial opportunity may emerge in adjacent tooling, managed services, and open-source support rails rather than the obvious public names. This creates a procurement bottleneck: enterprise CISOs will pay for fewer, more automated systems, but open-source maintainers and smaller vendors won’t have the budget to absorb the disclosure backlog, so incident frequency may rise before it falls. That should benefit vendors with strong deployment automation and workflow integration, while exposing pure-play dashboard businesses to slower net-new ARR conversion.

The contrarian point is that the market may be too quick to extrapolate a short-term patch surge into durable spend acceleration for incumbents. If customers perceive AI as a force multiplier for defenders, they may consolidate vendors and demand outcome-based contracts, which pressures seat-based pricing and expands churn risk. The decisive variable over 18-24 months is whether remediation becomes productized fast enough to prevent AI-speed discovery from becoming a permanent cost inflation problem for the ecosystem.

Key Decisions for Investors

• Reduce relative exposure to CRWD on 3-6 month horizon; own only if thesis is remediation-led. Risk/reward is asymmetric if the market starts re-rating detection multiples lower as AI discovery becomes commoditized.
• Hold NET only as a selective beneficiary of security/edge workflow integration, not as a pure cyber beta. Use strength to trim if the stock rerates on headline vulnerability volume rather than sustained remediation monetization.
• Pair trade: long remediation/infrastructure enablers vs short pure detection. If public-market choices are limited, implement via long NET/short CRWD only tactically; otherwise express through private-market adjacency and software workflow names with patch orchestration exposure.
• Consider a 6-12 month call spread on a remediation/platform software name with exposure to deployment automation; the setup is better than chasing cyber leaders because the spend shift should emerge gradually as patch backlog becomes visible.
• If CRWD or NET sell off 8-12% on any “AI disintermediation” headline, fade only if management explicitly guides to remediation attach and automated response metrics; without that, use rallies to reduce.