Champion ethical hacker warns AI tools like Mythos could put her out of business

Chompie won $20,000 and $50,000 at Pwn2Own Berlin as the event distributed nearly $1.3m to hackers who found 47 new vulnerabilities. The article’s main message is that AI tools such as Claude Code and Anthropic’s Mythos are accelerating bug hunting now, but may soon reduce opportunities for human ethical hackers as lower-hanging vulnerabilities disappear. The piece is largely directional commentary on AI’s impact on cybersecurity rather than a company-specific market catalyst.

Analysis

The near-term winner is not the AI model vendor so much as the security incumbents that sit in the workflow between automated discovery and remediation. If large models materially increase vulnerability discovery, they expand the attack surface that needs triage, validation, patching, and continuous monitoring — a better setup for IBM’s managed security, consulting, and incident-response mix than for pure-play “break/fix” penetration testing. The second-order effect is that AI likely commoditizes lower-end bug hunting first, compressing economics for smaller ethical-hacking shops while increasing the premium on scale, proprietary telemetry, and enterprise relationships.

The bigger market implication is timing: offensive AI gains should show up as a step-function in time-to-discovery over the next 6-18 months, but monetization for defenders will lag until enterprises actually reprice security budgets. That creates a window where investors may overestimate how quickly “AI security” revenue hits but underestimate how quickly margins improve for vendors whose products reduce analyst labor. Conversely, the first-order benefit to hardware/platform names is more muted; this is not a compute-demand story as much as a workflow and risk-management story.

A contrarian angle: the market may be too focused on exotic model-driven zero-days and not focused enough on the mundane attack vectors that still dominate breaches. If phishing and identity compromise remain the main entry points, then AI’s biggest economic effect is less about replacing elite hackers and more about scaling both sides of the authentication arms race. That favors identity, endpoint, email security, and services-heavy incumbents over vendors that rely on rare vulnerability discovery as their core narrative.

Net, this is bullish for the cybersecurity budget pool, but not uniformly bullish for all security names. The companies that can convert higher threat intensity into recurring revenue and attach rates should outperform; the ones selling point-in-time testing or lightweight vuln scanning are most exposed to automation pressure.

Key Decisions for Investors

• Long IBM vs short a basket of smaller cybersecurity testing/vulnerability-discovery names over 3-6 months — thesis is that AI increases demand for remediation, managed services, and enterprise workflow, while commoditizing lower-end discovery.
• Add to premium cybersecurity platform leaders on pullbacks (e.g., CRWD, PANW) for a 6-12 month horizon — upside comes from budget expansion and higher attach rates; key risk is valuation compression if AI hype outruns near-term revenue conversion.
• Buy a small call-spread structure on IBM 6-9 months out — best expression of the article’s second-order effect is not model upside, but higher services demand and security-consulting cross-sell; cap downside by using spreads.
• Avoid chasing pure-play offensive-security or bug-bounty-adjacent exposure in the next 1-2 quarters — AI is likely to compress differentiation faster than it expands the addressable market for these niche vendors.
• Watch for confirmation in enterprise security spending commentary over the next 1-2 earnings cycles; if management teams start citing AI-driven triage and remediation workloads, rotate toward services-heavy names and away from tools that depend on manual human discovery.