AI cybersecurity is entering a new phase as attackers and defenders increasingly use artificial intelligence to automate their operations.

“The AI Offender Is Here”: Cybersecurity’s Next Arms Race Has Already Started

Finance Big Tech by Marcus Thorne

George Kurtz has a blunt message about the next phase of cybersecurity: “the AI offender is here.”

The CrowdStrike CEO’s warning lands at an unusually important moment for both the security industry and Wall Street. After reporting its fiscal second-quarter 2027 results, CrowdStrike shares jumped 20.5% in the following trading session. Cybersecurity-focused funds rallied too, with the Amplify Cybersecurity ETF gaining roughly 7%.

The immediate catalyst was a strong quarter. CrowdStrike reported $1.47 billion in revenue, up 26% year over year, while annual recurring revenue reached $5.84 billion, up 25%. But behind those numbers sits a much bigger investment thesis: AI may not simply create another category of software spending. It could make the security problem itself larger.

That creates a peculiar economic loop. Attackers can use AI to automate, accelerate and personalize parts of cyber operations. Defenders can deploy the same underlying technology to detect anomalies, investigate incidents and respond faster. Each side becomes more capable, potentially forcing the other to spend more just to keep pace.

The result looks increasingly like an AI-powered cybersecurity arms race. The important question is not whether vendors can sell that narrative. They clearly can. It is whether AI actually changes the economics of cybercrime enough to create structurally higher demand for security.

Table of contents

What “the AI offender is here” actually means

Kurtz’s phrase is effective because it moves the conversation away from hypothetical future threats.

AI-assisted cybercrime is no longer primarily a scenario involving some future superintelligent hacking system. The more immediate change is less cinematic and potentially more consequential: existing attackers can use AI to make existing techniques cheaper, faster and easier to scale.

CrowdStrike itself says the shift is already visible. Its 2026 Global Threat Report says AI-enabled adversary activity increased 89%, while the fastest observed cybercriminal breakout time fell to just 27 seconds. The company also says 82% of detections observed during 2025 were malware-free.

Those numbers come from a cybersecurity vendor with a commercial interest in emphasizing the threat environment, so they should not be treated as neutral proof that AI has transformed every category of cybercrime. But they point toward a broader change that is easier to defend technically: AI reduces the amount of human labor required for some parts of an attack.

That distinction matters.

The near-term danger is not necessarily an autonomous model discovering revolutionary zero-day vulnerabilities and independently compromising global infrastructure. It is an attacker using AI to perform reconnaissance faster, generate convincing messages, analyze stolen information, adapt scripts, translate social-engineering campaigns and process large volumes of potential targets.

AI does not have to invent a new kind of cyberattack to matter.

It only has to improve the economics of the old ones.

How AI changes the economics of cyberattacks

Cybercrime has always had an automation component. Botnets, credential stuffing, vulnerability scanners and phishing kits existed long before generative AI.

What modern AI systems potentially change is the range of tasks that can be automated.

Traditional automation works especially well when the task is predictable. AI can extend automation into tasks involving language, classification, summarization and adaptation — areas where attackers previously needed more human intervention.

Consider phishing.

Sending millions of generic phishing emails is already trivial. Producing thousands of individually tailored messages based on information collected about specific employees is more expensive because personalization takes time.

AI can compress that gap.

An attacker can potentially collect public information about a company, identify employees, classify their roles, generate plausible messages in multiple languages and vary those messages automatically. None of those capabilities guarantees a successful compromise. But the marginal cost of experimentation drops.

The same principle applies elsewhere.

AI systems can help analyze technical documentation, explain unfamiliar code, modify scripts, summarize reconnaissance data or rapidly generate variations of malicious content. A moderately skilled operator can potentially perform tasks that previously required more time or greater specialization.

That does not magically turn every amateur into an elite hacker. Models still make mistakes. Security restrictions can limit their usefulness. Sophisticated intrusion operations still require operational knowledge, infrastructure and judgment.

But cybercrime does not need perfect automation to become more dangerous.

It needs cheaper automation.

If an attacker can attempt ten times as many reasonably convincing operations for roughly the same human effort, defenders have a volume problem even if the success rate of each individual attempt remains unchanged.

The defenders are automating too

Fortunately for the security industry, AI is not an asymmetric weapon available only to attackers.

Security companies have spent years building systems around machine learning, behavioral analysis and automated detection. Generative AI and increasingly capable agentic systems add another layer.

A modern security operations center can generate enormous quantities of telemetry. Endpoints, cloud infrastructure, identities, applications and networks continuously produce signals that may or may not indicate malicious activity.

The bottleneck is often human attention.

Security teams have to determine which alerts matter, reconstruct what happened, establish whether an account or machine has been compromised and decide how quickly to respond.

AI can potentially compress that workflow.

Instead of simply generating another alert, security software can increasingly summarize an incident, connect related events, prioritize suspicious behavior and recommend — or in carefully controlled environments execute — a response.

That changes the competitive metric.

If attackers are using automation to reduce time to attack, defenders need automation to reduce time to understand and respond.

CrowdStrike is hardly alone in pursuing this strategy. The entire cybersecurity industry is increasingly positioning AI as part of the operating layer for security rather than simply another feature added to a dashboard.

And that is where the economics become particularly interesting.

Why AI could structurally increase cybersecurity spending

For investors, the most important question is not whether AI improves cybersecurity products.

It is whether AI causes organizations to spend more money on cybersecurity overall.

There are several reasons that could happen.

First, the volume of malicious activity can increase. If automation makes reconnaissance, phishing, impersonation and other operations cheaper, organizations face more attempts even without a dramatic improvement in attacker sophistication.

Second, AI creates new infrastructure that itself requires protection. Enterprises are deploying models, AI agents, data pipelines and automated workflows. Those systems can introduce new identities, permissions, data flows and interfaces that security teams need to monitor.

Third, AI can increase the speed at which software and infrastructure change. An enterprise deploying more code and more automated agents potentially creates more opportunities for configuration mistakes and unexpected interactions.

Finally, an AI-versus-AI environment can create a powerful escalation mechanism.

Attackers automate. Defenders buy automation to compensate. Attackers use new techniques to bypass those defenses. Vendors develop new detection systems. Enterprises update their security stacks again.

This does not mean cybersecurity budgets increase without limit. CIOs still face budget constraints, vendor consolidation remains a major industry theme, and AI could itself make some security functions dramatically more efficient.

But cybersecurity has an unusual characteristic compared with many other software categories: the customer cannot simply opt out of the problem.

A company might decide it does not need another productivity application. It cannot reasonably decide that protecting its identities, endpoints, cloud infrastructure and sensitive data is no longer necessary.

If AI increases both the number of attacks and the surface that must be defended, security spending can become a second-order beneficiary of the AI boom.

The problem with the cybersecurity AI narrative

There is, however, an obvious reason to be skeptical.

Cybersecurity vendors have discovered that AI is extremely marketable.

Virtually every major technology company now describes some portion of its products as AI-powered, AI-native, agentic or autonomous. Security companies are no exception.

That makes it important to separate three different claims.

The first is that attackers are using AI. There is credible evidence that they are.

The second is that AI materially improves the effectiveness or economics of attacks. That is plausible and observable in specific areas, but the impact varies enormously by technique.

The third is that a particular vendor will capture significant additional revenue because of those changes.

That final step is not automatic.

Security customers do not buy abstract exposure to an industry trend. They buy products that need to detect threats reliably, integrate with existing infrastructure, reduce operational complexity and justify their cost.

A spectacular AI demo does not necessarily translate into better security.

There is also a counterargument to the bullish spending thesis: AI could make security operations more efficient enough that organizations need fewer separate tools or fewer analysts for some workflows. Platform consolidation could move dollars toward a smaller number of vendors without dramatically expanding the total market.

In other words, AI can simultaneously increase the security problem and improve the efficiency of solving it.

Which effect dominates will matter enormously.

What CrowdStrike’s 20.5% rally really tells us

CrowdStrike provides a useful case study precisely because its latest rally cannot be reduced to one AI soundbite.

The company reported record net new annual recurring revenue of $333 million for its fiscal second quarter, up 51% year over year. Total revenue climbed 26% to $1.47 billion, and ending ARR reached $5.84 billion.

CrowdStrike also raised its fiscal 2027 guidance for net new ARR growth to approximately 34% at the midpoint.

Those are fundamental business results, not simply an AI narrative.

Investors responded aggressively. CrowdStrike shares closed 20.5% higher on August 27, while the Amplify Cybersecurity ETF gained around 7%, its strongest single-day percentage increase since April 2025.

That broader movement is significant because it suggests investors were not treating CrowdStrike’s results entirely as a company-specific event. The market was also repricing parts of the cybersecurity sector.

Still, a one-day stock rally is not evidence that AI-driven cyber threats will produce years of accelerating security spending.

CrowdStrike beat expectations and raised its outlook. Those factors alone can explain a substantial portion of the reaction.

The more durable signal will come from future quarters: whether enterprises continue increasing security commitments, whether AI-related products produce genuinely incremental revenue and whether cybersecurity platforms can maintain pricing power as competition intensifies.

Wall Street is effectively placing a bet on the answer.

An arms race with unusually durable economics

There is an irony at the center of the AI security boom.

The technology promising to automate enormous amounts of legitimate work can also automate parts of the work required to attack those systems.

That creates demand for another layer of automation designed to stop it.

The cycle can sound almost suspiciously perfect for cybersecurity companies: more AI creates more attack capacity, which creates more security demand, which leads to more defensive AI.

Reality will be messier.

AI will not make every attacker dramatically more sophisticated. AI-branded security products will not all work. Some threats will be exaggerated. Some spending will simply shift from legacy tools into newer platforms rather than expanding the overall market.

But the fundamental mechanism does not require science-fiction hacking capabilities.

If AI lowers the cost of producing convincing attacks, increases their volume and creates additional infrastructure that companies must protect, then the cybersecurity problem becomes larger. And if defenders need increasingly automated systems to operate at the same speed as attackers, the value of effective security platforms rises with it.

That is the real significance behind Kurtz’s phrase.

“The AI offender is here” is obviously good marketing for the CEO of a cybersecurity company. But it also captures a technological shift that is becoming difficult to dismiss.

The next AI arms race may not be about who builds the smartest model.

It may be about who can automate faster without losing control.

AI cybersecurity: key questions

What did CrowdStrike CEO George Kurtz mean by “the AI offender is here”?
The phrase describes the growing use of AI by cyber adversaries to assist activities such as reconnaissance, social engineering, data analysis and automation. It does not mean fully autonomous AI hackers have replaced human attackers.

How can AI make cyberattacks more dangerous?
AI can reduce the time and labor required for tasks such as generating personalized phishing messages, analyzing information, modifying scripts and processing large numbers of targets.

Can AI also improve cybersecurity?
Yes. Defenders can use AI to analyze security telemetry, identify unusual behavior, prioritize alerts, investigate incidents and automate parts of the response process.

Why could AI increase cybersecurity spending?
AI can increase attack volume while also creating new models, agents, identities, data flows and infrastructure that organizations need to secure. That could expand the overall security workload rather than simply replacing existing tools.

Why did CrowdStrike stock rise 20.5%?
CrowdStrike reported strong fiscal second-quarter results, including 26% revenue growth, record net new ARR and higher guidance. AI-related security demand contributed to investor optimism, but the rally should not be interpreted as proof that the entire AI cybersecurity thesis is correct.

Is the AI cybersecurity boom partly marketing?
Yes. Security vendors have strong incentives to associate products with AI. Investors and customers therefore need to distinguish demonstrable improvements in detection and response from products that primarily use AI terminology as positioning.

Does this article constitute financial advice?
No. This article discusses cybersecurity industry trends and market reactions for informational purposes only. It is not investment advice or a recommendation to buy or sell CrowdStrike shares, cybersecurity ETFs or any other security.