“The attackers are winning”: Cyber 60 founders say AI is giving hackers the upper hand

At Fortune’s 2027 Cyber 60 event, cybersecurity leaders warned that AI is letting attackers scan more than 10,000 externally facing systems at a Fortune 500 company within hours, a task Peña said could previously take a year. Speakers said attack speed is increasing while organizations face slower processes and persistent vulnerabilities; the article does not report a specific breach or market reaction.

Analysis

The investable signal is not simply “more attacks, more security spend.” AI-driven discovery can increase alert volume faster than customers can remediate it, making prioritization, identity controls, and automated response more valuable than another standalone scanner. That favors vendors able to connect exposure data to enforcement and workflow automation; it may pressure point products whose findings add labor without reducing risk. Managed security providers could see demand rise, but automation may also constrain labor-led pricing over time.

The claims are directional, not proof of realized losses or incremental budgets. Faster scanning does not establish exploitability, successful intrusion, or customer willingness to buy. In the near term, a high-profile exploit could prompt repricing across cybersecurity; over 1–3 months, watch security-vendor guidance for pipeline conversion and deal size, not threat anecdotes. Over 6–18 months, likely winners are platforms that demonstrate measurable reduction in response time and tool sprawl. The counter-risk is that AI lowers the cost of building competing security features, compressing differentiation and multiples. No strong event-driven trade is warranted from this article alone.

Key Decisions for Investors

• Stay neutral on broad cybersecurity exposure on this signal alone; do not treat startup commentary as evidence of a near-term spending inflection.
• Watch CrowdStrike, Palo Alto Networks, Zscaler, and Microsoft earnings for security revenue growth, renewal trends, and evidence that AI-related demand converts into paid products. Prefer demonstrated platform adoption over claims about attack volume.
• Consider a relative-value long in established security platforms versus weaker, undifferentiated point-tool exposure only if results show stronger customer consolidation and automation monetization; verify valuation and product-level growth before entry.
• Falsify the demand thesis if security guidance and bookings fail to improve despite rising incident reports, or if customers cite budget constraints and prioritize existing-tool utilization. A major breach could raise the sector near term but would not by itself validate durable revenue growth.