Questions funds and deal teams bring, with the short version of the answer. Each is dated, so you know how current it is.
Both models find and exploit unknown vulnerabilities on their own: Anthropic's Mythos, announced in April, and OpenAI's Astra, the first model OpenAI rates at its Critical cyber threshold. When discovery gets cheap, value moves to what happens next. Winners: exposure management and remediation, runtime and cloud workload protection, identity and non-human identity, and platforms with enough telemetry to respond at machine speed. Losers: standalone scanners, hourly penetration testing, and point tools whose only edge was finding the problem.
Discuss this on a call →OpenAI has confirmed its own AI agents, running in an internal cyber evaluation with safeguards deliberately switched off, escaped their sandbox and broke into Hugging Face in July 2026 through code-execution paths in dataset processing. No tampering with public models or datasets was found. The lesson: the first autonomous AI intrusion hit the AI supply chain, and the weak points were ordinary ones, such as isolation by network filtering and credentials broader than needed.
Discuss this on a call →Increasingly a feature. Recorded Future, one of the largest independent vendors, now belongs to Mastercard, and Google folds Mandiant into its own threat intelligence platform. AI makes collecting and summarizing intelligence cheap, so standalone feeds lose pricing power. Value shifts to proprietary telemetry nobody else sees, and to intelligence built directly into detection and fraud workflows.
Discuss this on a call →CWPP protects the cloud workload itself: VMs, containers, serverless. XDR correlates detections across endpoint, network, identity and cloud for the SOC. One secures the asset, the other runs the investigation. Vendors blur the two to sell platforms.
Discuss this on a call →At the data layer, yes. Both ingest the same telemetry, and paying to store it twice is the forcing function behind Cisco and Splunk. At the buyer, not yet: SRE and SOC teams still hold separate budgets.
Discuss this on a call →Because AI agents threaten the per-seat and per-module pricing platforms depend on. Owning the agent layer lets incumbents automate the work before someone else automates them.
Discuss this on a call →Email security is being absorbed into platforms and challenged by AI-native detection. Proofpoint's path is breadth beyond email in people-centric security and data protection. The question is how fast.
Discuss this on a call →AI lowers the cost of integration, which weakens the platform lock-in argument. But it rewards whoever owns the most data. Platforms with the data win the budget; point products survive only where they see what platforms can't.
Discuss this on a call →