Hackers Are Getting Smarter With AI. Are Companies Falling Behind?

Cyber security is back at the top of the corporate agenda and the threats are getting more sophisticated by the day. From AI-powered attacks and billions lost in crypto hacks to the future risk of quantum computing, companies are facing a new generation of security challenges. Joining us now to discuss is Fatima Boulani, Managing Director and Co-Head of U.S. Software Equity Research at Citi. Thank you so much for being here, Fatima. Thank you, Justine. I appreciate being here. Of course. We have so much to get to here. I mean, cybersecurity really just seems to be entering a whole new era. So you have companies racing to adopt AI, upgrade their technology. Why is security becoming such an even bigger priority right now? You know, fundamentally, the very simple, almost simplistic answer to that is the average organization's attack surface has metastasized to a point that we've never seen in kind of the history of computing, right? And that's not meant to be a hyperbolic statement. It's really the advent, adoption, and pace of AI innovation has unearthed so many more blind spots in terms of of how organizations have... have had to deal with cybersecurity risk, right? So more blind spots from new technology that everyone is feverishly and furiously trying to deploy in production to drive ROI. Well, you want to make sure you're doing all those things very safely and securely, right? And let's not forget the average large organization has a lot of technical debt, right? They still have to keep the lights on, on their security posture, on all the old stuff, right? And so you... Add AI to the mix, it's sort of jet fuel as it relates to cyber risk expanding materially and this notion of attack surface expanding materially. Yeah, it really does. And they're just now, as you're mentioning, so many things that have to be secure, again, from those kind of older systems to the new ones. I mean, AI is, again, talked about as this kind of threat to cybersecurity, but you've also argued that it could actually benefit companies like CrowdStrike and Palo Alto Networks. Why is that? Tell us a little bit more about AI potentially making these companies even more valuable. You mentioned something at the outset that I want to pull the thread on. It's never been easier to propagate a cyber attack in the history of, you know, the internet and, you know, when organizations move to the internet to run their businesses, right? And again, not meant to be hyperbolic. It's the marginal cost of launching an attack in multiple different ways has been diminished to zero, right? So you keep that in mind, you've got AI lowering the financial barriers of launching and propagating attacks. And then you have AI itself propagating those attacks much faster than a human adversary would, right? So fundamentally, the equation and the conversation shifts to, well, you can't have cyber defenders come to a gunfight with a plastic knife, right? So it's this notion of AI attacks meeting the need and begging the need for AI defense, and that's really a lot of what we're seeing right now. It's this concept of infusing AI into security defenses so you're able to keep up with that and respond in kind to that velocity and that threat intensity, but also the other notion of security for AI. So two parallel paths, but the AI for security. Would be directly a response to, hey, attackers have AI and they're using AI at machine speed, which is significantly faster than human and human cognition to even recognize those attacks. Yeah, it really is. And again, I mean, looking at some recent examples of this, the Binance hack is a huge wake-up call. I mean, more than $6 billion stolen in an attack linked to North Korea, reports saying that hackers even exploited an internal AI tool. I mean, what does this incident reveal about these new risks that companies are facing? You've been talking about them, but now with this really specific example that we just had that was massive, I mean, what do you think about that? You know, what I think it's important to highlight is while we're seeing absolutely headline-grabbing attacks, and by the way, we are going to see more of this, right? The number of headline-grabbing cyber attacks we've seen this year historically in the pre-AI era. These were once in a decade, once in a half decade occurrences, right? That there was pearl clutching and, you know, the most technical people in the industry were sort of gasping that, you know, this is so serious. We've seen those versions of those style and intensity and gravity of those attacks as a regular Monday or a regular Tuesday now. And that's functionally because of the power of these frontier models and their capabilities, right? And so what's very interesting, though, is in a lot of the conversations we have with Actual decision makers and procurement managers in the chief information security office domain and the CIO domain, what this is behooving is moving back to foundational basics, right? Hardening existing defenses, leaning on existing vendors and their breadth of capabilities that can be extended, right? Now, it remains to be seen if there is going to be an ingenue in the valley, an AI security company that's going to come up the ranks to, you know, give CrowdStrike and Palo Alto a run for their money. But those companies have amassed so much. Trust, incumbency, and pervasiveness in their respective customer bases. They're getting the first bite at the proverbial apple, and they're getting the first right of refusal as it relates to organizations who, you know, behind the scenes do have their hair on fire because there's so much more to do against this landscape. But just going back to harden existing defenses and by and large, doing that with existing vendors that you trust already and that are already in a good position to understand a company's posture on security. Yeah, and thinking about all of that, I mean, again, that AI security component is going to just become more and more important, again, especially seeing that finance, you know, it's one of the world's most sophisticated crypto exchanges. So if a company like that can be breached, people get a little bit worried. What about those who maybe aren't even that sophisticated? So you've talked about some of the things that financial institutions can be doing to protect themselves. Do you have any outlook on where this is headed? I mean, do you think that these attacks can actually be stopped in the future? Look, I think it's meeting the moment, right? Again, in a lot of the conversations we have, a lot of this is maybe business as usual, but with a higher velocity, right? So certainly the problem hasn't been or the solution hasn't been let's throw more money at the problem. It's let's be more discerning about. Yes, we can throw more money at the problem in terms of the cyber problem and the cyber risk problem, but doing it with a lot more discernment, right? And that's, you know, functionally why I go back to my previous point around large cyber security platform companies like a CrowdStrike and Palo Alto. And by the way, let's not rule out, you know, some of the big tech players like a Google, you know, they've been on an absolute and they had been on an absolute acquisition binge. particularly around cybersecurity, because they understand that that is a very important linchpin of conversations with large enterprises, right? How they think about their cybersecurity architecture. And so this idea of. These companies with broad portfolios, with broad control point purviews, they're sitting at very distinct and very important parts of your infrastructure architecture writ large, and they're able to provide you that perspective where, listen, it's not if, it's when. So the point is how quickly you can respond, how quickly you can detect, how quickly you can respond and how quickly you can remediate. Right. So that's really the objective that is now the focal point for a lot of very large organization. It's shrinking that time to response and remediation. And that's what these multi-product, very large companies are in very strong position to offer as a value proposition. Yeah, that speed is so important as these companies look to protect themselves and looking beyond just companies and businesses. You know, we just had the midterms here and are always thinking about future elections and election security with concerns about hacking, disinformation, foreign interference. How big is the cybersecurity threat to elections? And do you think that we're actually better prepared than we were a few years ago? Or do you think that this is another area that really needs to be beefed up? You know, I think I'll broaden that question out a little bit and answer it in a slightly different way. Cyber security. Cybersecurity. has been elevated to a national security priority, right? So we need to ensure our public sector infrastructure is absolutely ironclad, right? And look, I think there was some noise in the system over the course of last year when, you know, the administration was changing hands. We had some efficiency efforts that kind of ran their course. And really now there's a reinvigorated Focus. On cyber and cyber posture for our public sector entities, right? And so we've had a lot of conversations with publicly traded companies who've talked about, hey, the government is open for business as it relates to modernizing their cybersecurity defenses, right? So I would answer that question more in totality, and cyber becoming, you know, and having been and continue to be elevated as kind of a national security priority. Yeah, I think it definitely is. And we'll definitely continue to see that being so being even more so one of those national security priorities as this risk just keeps growing. Looking back at some companies now and really the massive spending that's going on billions on AI, cloud computing, new infrastructure and all of that. Do you think that cybersecurity budgets are also now going to have to grow even if businesses start cutting costs elsewhere? Absolutely. You know, some of the data, you know, we're in the trenches on some of the stuff, right? You know, gathering and culling budgetary information, budgetary posture, right? We are starting to see the direction of travel, you know, go in the right way as it relates to, hey, my cyber budgets were growing 5%, 6% last year. And remember, cyber is a monolith, right? It doesn't sound all that attractive that only five or six percent, but the reality is these are big budgets. Right. And so any acceleration and inputs and insights into acceleration are important. And a lot of the data that we're empirically gathering in the last two quarters has been pointing towards that and supportive of that. Right. So, look, I think the the. pessimist or the glass half full person would argue that a one point acceleration in budgetary posture can't hold a candle to all the risks we just talked about, right? But I think the hurdle there too is that there is a change management concern here as well, right? So there's a little bit of an element of, hey, this is going to have a lagging adoption impact. So we are generally I'm generally pretty constructive on a stronger for longer and a higher. For longer upward pressure on budgetary postures, whereby, you know, it's not inconceivable to think that in prior eras, if you were essentially paying a four cent security tax on your enterprise spending, which basically moved up to eight cents of a security tax on every dollar of software spending, when companies move to the cloud, it is not inconceivable to think that that doubles again, right? So functionally, what I'm saying is that you've got Maybe IT budgets vacillate here and there, but cyber will, we think, become a bigger proportion of that aggregate IT budgetary conversation, just sucking a little bit more oxygen out of the broader. IT budgetary purview. Yeah, it seems like it really will have to to keep up with everything going on. But we appreciate you walking us through all of this and we have a lot to keep our eye on as we move forward. Thank you so much for being here today, Fatima Bilani, Managing Director and Co-Head of US Software Equity Research at Citi. Really appreciate it. Thank you, Justine.