AI in Cybersecurity: Expanding Attack Surfaces Reinforce the Importance of Runti

Research evidence excerpt

AI in Cybersecurity: Expanding Attack Surfaces Reinforce the Importance of Runti

◼ The Rise of Shadow AI: Despite significant investment across the cybersecurity

ecosystem, there does not yet appear to be a clear market leader in addressing “shadow

AI,” as the gap between enterprise AI governance policies and real-world employee usage

remains substantial. Over time, the best vendors positioned to emerge as leaders in this

category will likely need to combine strong semantic understanding of AI prompts and inputs

with enterprise-scale data loss prevention capabilities and consistently low false-positive

rates, balancing security efficacy with operational usability.

◼ Early access to frontier models should help scaled vendors improve product velocity:

Our expert indicated that vendors involved in Project Glasswing could see meaningful

operational advantages from early model access, particularly around developer productivity,

vulnerability remediation throughput, and patch development speed. In our view, this

matters for PANW and CRWD given both are Glasswing launch partners. Early access

should help them move faster from vulnerability discovery to remediation and policy updates,

tightening the loop between new findings and production-level protection within workflows

they already control.

Why Runtime Security Remains Harder to Disrupt

Implications for Our Security Coverage

In our view, the framework outlined above has two direct implications for our security

coverage: 1) positive for broader cyber budgets, and 2) increasingly favorable for platform

vendors relative to point solutions.

Positive for broader cyber budgets: We expect advances in frontier models to support overall

cybersecurity spending, even if the impact varies by segment. As capabilities improve, they will