Alex Stamos, Facebook's former head of security and now chief information security officer at AI coding company Cognition, says AI has pushed the cost of launching an attack close to zero.
But the price of defending against one, he told the Decoder podcast, remains high.
That imbalance is reshaping the security industry, and the stock market has already noticed.
A machine that hacks
Stamos said freely available AI models can now automate almost every step of an attack.
They can choose a target, find weaknesses, write the code to exploit them and break into many systems at the same time.
The economics are stark.
A study by security firms Wiz and Irregular found AI agents could complete advanced hacking challenges for less than $50 in computing costs, against nearly $100,000 for the same work done by human researchers.
CrowdStrike's own research found that hackers using AI increased their activity by 89% last year, while IBM says one in four data breaches now involves AI.
Stamos believes every company will need to use AI to attack its own systems, a practice known as red-teaming, within 90 days or risk being breached.
The Binance lesson
The $6.3 billion theft from Binance, the world's largest cryptocurrency exchange, shows how this plays out in practice.
The hackers never broke Binance's code.
According to the exchange's own report, the attack began in June, when an engineer downloaded a tampered installer while trying to set up an AI coding tool.
Another engineer was later targeted with a fake job interview.
On 20 October, the attackers used one of Binance's own internal AI tools to take control of the computers of engineers who managed its digital wallets.
The money was stolen nine days later.
The FBI has blamed TraderTraitor, a North Korean hacking group, which Pyongyang denies.
The same group was blamed for last year's $1.5 billion theft from Bybit, which until Binance was the biggest crypto heist on record.
Binance said it had already blocked 57 suspected North Korean attacks this year, which shows that defenders have to win every time while attackers need to succeed only once.
The case also highlights a new problem.
The AI tools companies are rushing to give their staff can become a way in for attackers.
A gold rush for security firms
For cybersecurity companies, this is a powerful selling point.
Dan Ives, a technology analyst at Yorkville Ives, said on 3 November that security budgets could roughly double over the next two to three years.
Read more about Cybersecurity
- 15/09/26Cybersecurity stocks rally as AI leaders warn on safety
- 30/06/26Why AI lowers the skill barrier for cyber-attacks
- 27/05/26Tech-focused bank raises price targets on Palo Alto Networks and CrowdStrike as AI drives cyber spending
Investors have bet heavily on that view.
By late October, CrowdStrike shares were up 127% this year, Palo Alto Networks 114% and Okta 157%.
Wall Street expects CrowdStrike's revenue to reach $9.03 billion in the year to January 2029, almost double the $4.81 billion it reported for the year to January 2026.
The catch
The problem is that much of this growth is already in the share price.
CrowdStrike trades at 154 times expected earnings, against an average of 105 times over the past three years.
It is also valued at about 51 times its sales over the past year, nearly double its 10-year median.
At that level, there is little room for disappointment.
There is also a risk running the other way.
Earlier this year, cybersecurity shares fell sharply on fears that new AI models could do some of the work of expensive security software, cutting into the companies' business.
AI, in other words, could prove both the industry's biggest source of demand and its biggest competitive threat.
The next test comes with results from Palo Alto Networks on 18 November, CrowdStrike on 1 December and Zscaler on 2 December.
