AI Cyberattacks Are Changing Where Companies Spend on Digital Security

Anthropic’s September 2026 threat-intelligence report described a cyber campaign in which attackers used AI agents to target roughly 30 AI companies over four days.

The operation involved automated searches for security vulnerabilities, attempts to bypass authentication systems and efforts to obtain confidential information.

Anthropic confirmed that production API keys were stolen from one vendor, while an attempt to obtain a pre-release Claude model was unsuccessful.

The attackers manipulated an automated evaluation system into disclosing credentials, which were subsequently used in further intrusion attempts.

AI agents also examined exposed web applications and tested weaknesses that could provide access to internal systems. Human operators remained responsible for directing the campaign, although some technical tasks were carried out automatically.

Anthropic said it suspended accounts associated with malicious activity and strengthened monitoring after investigating the incidents.

The company also acknowledged that some harmful requests had passed its existing safeguards, including requests involving surveillance software. Its response included changes to detection systems intended to identify similar activity.

Corporate spending on access protection has continued to expand. In its fiscal 2026 financial disclosures, Okta reported growing demand for identity-security services used to manage employee accounts, privileged access and automated applications.

The company has also expanded its products for securing non-human identities as businesses deploy AI agents with access to corporate systems. These investments address the credentials and permissions attackers can exploit to reach sensitive company information.

AI-Driven Intrusions Expose Weaknesses in Corporate Access Systems

On July 16, 2026, Hugging Face disclosed that an autonomous AI agent had gained access to part of its production infrastructure through a vulnerability in its dataset-processing system.

The intrusion exposed cloud credentials and allowed access to a limited number of datasets. The company reported no evidence that its publicly available models or software packages had been altered, although it was still investigating whether customer or partner information had been affected.

A subsequent investigation published on July 27 traced the intrusion to an AI agent operating during an OpenAI cybersecurity evaluation.

Hugging Face reconstructed approximately 17,600 actions and identified a shared credential that provided administrator access across several internal clusters.

The company rebuilt affected infrastructure, replaced compromised credentials and restricted access between its systems. Its AI-assisted monitoring had detected suspicious activity but did not immediately escalate the warning to the security team.

Palo Alto Networks completed its $21.1 billion acquisition of CyberArk on February 11, 2026, adding privileged-access management to its cybersecurity business.

CyberArk’s products control access to sensitive corporate systems, including accounts used by employees, automated applications and machines.

Palo Alto Networks plans to integrate these capabilities into its existing security platform, extending its services to organisations managing access permissions for AI agents.

The acquisition also introduced substantial integration commitments. Palo Alto Networks’ fiscal 2026 disclosures identified approximately $3.5 billion in acquired platform-renewal intangible assets associated with CyberArk, reflecting the accounting value assigned to expected customer renewals rather than revenue already earned.

The company identified integration expenses and possible disruption to customer relationships among the transaction’s risks. Its subsequent financial performance will provide a clearer measure of how much CyberArk contributes to customer spending on identity protection.

Cybersecurity Companies Report Growth in Enterprise Security Subscriptions

CrowdStrike generated $333 million in net new annual recurring revenue during the quarter ended July 31, 2026, an increase of 51% from a year earlier.

Subscription revenue rose 27% to $1.40 billion. Annual recurring revenue associated with its Falcon Flex purchasing programme reached $2.29 billion, up 101%, as customers expanded their use of security products covering corporate devices, employee identities and cloud infrastructure.

The company reported that 51% of subscription customers used at least six Falcon modules, reflecting wider adoption of its services within existing accounts.

Palo Alto Networks reported $9.10 billion in next-generation security annual recurring revenue for fiscal 2026, a 63% increase. Total revenue reached $11.48 billion, up 24%, supported by network security subscriptions, Cortex security operations and acquired businesses.

Its remaining performance obligations rose to $21.2 billion, representing contracted services awaiting revenue recognition. The results include several cybersecurity products and acquired operations, rather than sales attributable exclusively to AI-related threats.

Microsoft’s security products are being used to reduce the time businesses spend investigating suspicious activity. In September, professional services company Avanade reported that Microsoft Security Copilot and Entra reduced its average identity-incident resolution time from 10–12 minutes to 2–3 minutes, an improvement of approximately 70% to 80%.

Semiconductor equipment manufacturer ASM separately reported saving about 337 staff hours weekly through Security Copilot-assisted investigations. Neither company disclosed how much it spent on the technology.

CrowdStrike’s customer disclosures provide a further indication of how enterprise security contracts are developing. By July, 26% of its subscription customers were using at least eight Falcon modules, purchasing protection across more functions through the same supplier.

Such arrangements allow vendors to expand their business with existing customers, although the reported adoption figures do not establish the additional amount each customer paid.

For investors, subscription revenue, new contracts and customer spending provide more direct evidence of cybersecurity demand than the number of AI security features introduced.

Financial Institutions Expand AI Protection Against Payment Fraud

US financial institutions estimated that AI-generated techniques contributed to 19% of their fraud losses, according to an October 19 report from LexisNexis Risk Solutions.

Websites accounted for 39% of reported losses, while mobile applications represented another 30%. The study also found that every $1 lost to fraud cost financial services firms $5.47 after investigation, recovery and other related expenses, compared with $4.00 in 2021.

The figures reflect respondents’ estimates rather than independently verified industry-wide losses.

Financial institutions are already using AI to identify fraudulent customers and transactions. The study found that 56% of respondents applied the technology against synthetic identity fraud and account takeovers, while 48% used it to detect scams.

Among institutions relying primarily on automated fraud prevention, 89% rated their programmes effective, compared with 61% of those using mainly manual processes. The survey did not establish that automation alone accounted for the difference.

Investment plans are increasingly directed towards verifying customers before transactions are approved. Biometric authentication was identified as a priority for the next 24 months by 53% of surveyed institutions, followed by verifiable credentials and digital identity wallets at 48%.

Behavioural intelligence attracted 47%, while nearly two-thirds planned to invest in AI-enhanced identity verification. Technical expertise, integration costs and data quality remained obstacles to implementation. These commitments represent planned expenditure rather than completed purchases.

Visa expanded its A2A Protect service in September with fraud-detection technology from Featurespace, the company it acquired.

The service uses AI-generated risk scores to assess account-to-account payments before funds leave a customer’s bank. Visa reported that testing identified more than 50% additional fraud reduction and over 40% fewer unnecessary alerts.

It did not disclose the number of financial institutions using the upgraded service or the revenue generated. The technology targets fraudulent payment authorisations and account misuse, including transactions that may occur without any intrusion into a bank’s internal systems.

Digital Asset Expansion Raises the Cost of Cybersecurity Failures

On October 21, the US banking regulator issued final rules requiring stablecoin issuers under its oversight to protect customer assets, maintain adequate reserves and manage operational risks.

The rules, scheduled to take effect on January 18, 2027, cover reserve assets, custody arrangements, operational risk management and regulatory oversight. Issuers will need to demonstrate that their systems can safeguard customer funds and support compliant payment operations.

Cryptocurrency theft exceeded $3.4 billion between January and early December 2025, according to Chainalysis. The total included approximately $1.5 billion stolen from Bybit in February after attackers compromised a software developer’s computer and manipulated the transaction interface used by the exchange.

Authorised signers subsequently approved a malicious transfer. Chainalysis also recorded approximately 158,000 personal-wallet compromise incidents during the year.

The Federal Reserve proposed separate stablecoin requirements in September 2026, including provisions covering reserves, capital and operational risk.

Those proposals have not become binding regulations. BNY announced on October 8 that it had expanded its digital-asset custody platform to selected institutional clients in the European Union under the MiCA framework.

The service uses segregated client wallets, multiparty computation and private-key storage controls to protect assets held on behalf of customers.

Deutsche Bank is also preparing institutional digital-asset custody services using hardware-protected private keys, multiple transaction approvals and separate online and offline storage arrangements.

The planned service remains subject to regulatory completion. These safeguards address the possibility that compromised credentials or transaction permissions could allow assets to be transferred without authorisation.

For banks and custodians, protecting digital assets adds security and compliance expenses to their operations. Cybersecurity companies supplying access controls, transaction monitoring and incident-response services can compete for that spending, with revenue dependent on contracts secured and services delivered.