Smarter AI Is Creating a Cybersecurity Boom

Bank of America brought in 1,000 extra people to help fix the software weaknesses AI was exposing.

That admission caught my attention as I was combing through last week’s bank earnings calls. I was looking for clues about the strength of the consumer and credit market. Instead, I found another sign of the spending wave building beneath the AI boom.

CEO Brian Moynihan disclosed that those contractors had joined roughly 3,000 people already working in that area. They started in the second quarter. And half a year later, they are still on the job.

And Bank of America isn’t alone.

Earlier this month, JPMorgan Chase CEO Jamie Dimon told Bloomberg TV that cybersecurity risks “went up tenfold after Mythos.” The Mythos he’s referring to is Anthropic’s advanced AI model.

Two of America’s largest banks are confronting the same challenge. More capable AI is exposing weaknesses in the software businesses depend on. Repairing those weaknesses requires people, tools, and money.

Bank of America has 4,000 people on payroll to handle this. But what are smaller companies without those deep pockets supposed to do?

That question points us toward another investment opportunity.

Most investors are focused on the chips and data centers needed to run AI. But businesses also need protection as these systems become more capable and gain access to more of their operations.

To understand why, we need to look at what these models can now do.

AI Is Finding the Cracks

A software vulnerability is a mistake that can let someone access information or perform an action they shouldn’t.

These weaknesses can remain hidden for years. Businesses run software built by different teams, often using components supplied by outside companies. Even a well-protected organization can inherit a flaw from a vendor.

More capable AI gives security teams a better way to search for those problems. Models can examine code and help determine whether a weakness can be exploited.

But discovering a problem creates another job.

Someone must confirm the flaw, develop a repair, test it, and install it without breaking the systems people depend on. That helps explain how better AI can create more security work even as it automates parts of the process.

And businesses are about to give these systems much more responsibility.

Your Next Employee Needs Guardrails

Remember the AI agent that found ways around the booking restrictions at its owner’s local gym? We covered it in The Bleeding Edge – The Next Great Security Build Has Begun.

It was pursuing its owner’s goal of signing up for fully booked gym classes through a flaw in the website. The same kind of problem becomes more consequential when agents operate inside businesses like banks or hospitals.

A customer-service agent might need permission to issue refunds. A coding agent might modify company software. A finance agent might prepare payments.

Each permission makes the agent more useful. It also increases the importance of setting the right boundaries.

Consider a hypothetical agent allowed to issue refunds below $100. A customer requests $250, which should require a manager’s approval.

But the agent finds another route by issuing three smaller refunds. Each transaction falls below the limit. Together, they defeat the purpose of the rule.

There may be no broken code in this example. The weakness lies in the gap between what the company intended and what its systems allow.

Businesses therefore face two sources of risk: outsiders using AI against them, and their own agents taking unintended actions. Both require protection.

Recommended Links

Forget Nvidia – Buy This New “AI Superchip-Maker" Now

The man who recommended Nvidia before it rose 35,000% and Bitcoin before it rose 30,000% is stepping forward with his biggest discovery yet. A new “AI Ssuperchip” 50 times faster than Nvidia's and the company behind it could create a wave of new AI millionaires. Click here for the details and a recommendation to review by October 28.

Trump Goes "All-In" on Grand Canyon Energy Breakthrough

A drilling crew near the Grand Canyon just confirmed what the International Energy Agency calls enough energy to meet global electricity demand 140 times over. Google signed a 15-year deal, and Bill Gates wrote a $100 million check. On November 17, Washington hands this resource an edge no other energy source has. One company sits at the center. Get the name before November 17 >>

Most Businesses Can’t Build a Security Army

This brings us back to the question in our opening.

What does a smaller business do when it lacks the resources to assemble thousands of people for a software repair effort?

It buys help. That can include security software, outside monitoring, and specialists who help investigate threats and deploy repairs. Larger companies buy these capabilities, too. Their internal teams need tools to protect increasingly complex operations.

I see three main areas worth following as AI agents proliferate.

First is protecting the underlying systems.

Companies like Palo Alto Networks (PANW) supply security across networks, cloud environments, and other parts of a business. Its acquisition of CyberArk also expanded its identity-security capabilities.

Second is controlling who, or what, gets access.

Okta (OKTA) offers tools to discover AI agents, manage their identities, and control access to business resources. That addresses the basic requirement of whether or not an agent should receive only the access needed for its job.

Third, securing activity as agents work.

Zscaler (ZS) is extending its zero-trust approach to AI agents. In plain English, that means access must be constantly checked rather than automatically trusted because an agent is already inside the company’s environment. Its offerings address agents accessing data, calling software tools, and interacting with other agents.

These capabilities overlap. A business may purchase several through one provider. But looking at the opportunity this way helps us understand what customers need and where their spending could flow.

Security Is Part of the AI Buildout

Bank of America’s surge in hiring security contractors is the start of a longer-term trend. AI will continually find new ways to exploit software. It’s too early to tell if networks and applications will ever be truly impenetrable.

Software keeps changing. Companies add suppliers, connect systems, and introduce new applications. Deploying AI agents adds another set of access decisions and security requirements.

That creates demand for continuing protection. The strongest investment candidates will be the companies that turn these requirements into paying customers, larger contracts, and recurring revenue.

Bank of America has already shown us that more capable AI can create a substantial repair bill. As companies give digital workers more responsibility, protecting their systems becomes part of the cost of putting AI to work.

That makes cybersecurity part of the infrastructure required for AI adoption and gives the companies supplying it another avenue for growth.

Regards,

Nick Rokke
Senior Analyst, Brownstone Research