ESET Threat Report: AI boosts cyber attackers’ efficiency

ESET’s H1 2026 Threat Report highlights attackers improving the efficiency of operations, with AI playing a larger role. ESET analyzed nearly 900,000 AI skills and found tens of thousands suspicious and thousands outright malicious, and it identified PromptSpy as the first known Android malware using generative AI in its execution flow. Overall, the update is more informational than market-moving, but it raises near-term cyber-risk awareness.

Analysis

AI-assisted offense increases the velocity of low-skill attacks faster than it expands enterprise security budgets, so the first beneficiaries are not the obvious breach headlines but the platforms that sit in the approval path: identity, endpoint, and policy enforcement. That favors names like CRWD, PANW, CYBR, and OKTA over narrower point products, because AI-driven abuse of credentials and agent permissions makes centralized telemetry and privilege control more valuable than more standalone filters.

The second-order effect is a shift in spend mix, not just spend level. If autonomous workflows become normal, buyers will need governance, least-privilege controls, and auditability around AI agents; that is a tailwind for security vendors with broader platform attach, while pure-play observability or generic software tools may see budget share leakage into cyber. The more interesting medium-term implication is on mobile and API surface area: a credible Android AI-malware proof point broadens the attack map to devices and machine-to-machine auth, which should help vendors exposed to mobile management, SASE, and runtime access policy.

Near term, this is more of a sentiment catalyst than a hard revenue event; the monetization lag is typically one to three quarters as CISOs reallocate after incidents or renewal cycles. The contrarian risk is that the market is already paying for the “AI makes cyber worse” narrative, and if incident frequency rises without a corresponding jump in deal scrutiny, growth acceleration may disappoint. What would falsify the thesis is a step-down in security budget commentary, weaker net retention from the major platform vendors, or evidence that AI-assisted attacks are being absorbed by existing controls without incremental spend.

Key Decisions for Investors

• Add on pullbacks to a basket long in CIBR or HACK, with CRWD/PANW/CYBR as the highest-conviction constituents; target 3-6 month hold, since the spend reallocation should show up in the next two earnings cycles rather than immediately.
• Pair long CRWD / short IGV for a 1-3 month relative-value expression: cyber should capture incremental budget while broad software remains under pressure from AI spending and cautious IT scrutiny; stop if IGV outperforms CIBR by >5% or cyber guides down.
• Use OKTA or CYBR as the cleaner “AI agents need identity controls” expression on any post-earnings weakness; the risk/reward is better if management commentary references privileged access, non-human identities, or governance attach rates.
• Avoid chasing mobile-security-adjacent names purely on this headline; wait for evidence of enterprise mobile budget reallocation or a material breach involving managed devices before underwriting a multiple expansion.
• Set a watch item on the next CRWD/PANW/OKTA billings and remaining performance obligation metrics: if AI-related platform attach lifts NRR or multi-module adoption, the theme becomes investable; if not, treat this as noise and fade strength.