The AI-native cybersecurity market: agents attacking and defending

1) Thesis

Cybersecurity is being restructured from human-led tools and ticket queues into semi-autonomous systems that continuously discover, exploit, prioritize, remediate, and govern risk—while attackers use the same agentic primitives to scale reconnaissance, social engineering, and vulnerability exploitation.

2) Market map

Segment 1: AI-native SOC, detection, and response agents

What it does: Uses LLMs and specialized agents to investigate alerts, correlate telemetry, write detections, contain threats, and execute remediation.

Companies:

• Microsoft — Security Copilot, Defender, Sentinel, and Entra are being combined into agent-assisted security operations.
• Google — Gemini in Security Operations and Google SecOps provide AI-assisted investigation and response.
• CrowdStrike — Charlotte AI is embedded across Falcon for analyst assistance and response workflows.
• SentinelOne — Purple AI supports natural-language investigation and endpoint/SIEM response.
• Palo Alto Networks — Cortex XSIAM and Precision AI automate detection, investigation, and response.
• Dropzone AI — purpose-built autonomous SOC analyst for alert investigation and triage.

Dynamics: The strongest near-term adoption is as a “copilot,” but the strategic prize is permissioned autonomous execution; incumbent platform vendors have a major advantage because agents need broad telemetry, identity context, and the ability to take action.

---

Segment 2: Autonomous offensive security, pentesting, and validation

What it does: Agents continuously enumerate attack surfaces, generate attack paths, exploit weaknesses, validate impact, and produce remediation guidance.

Companies:

• XBOW — autonomous AI penetration testing and vulnerability discovery.
• Horizon3.ai — NodeZero autonomous penetration-testing platform.
• Pentera — automated security validation and breach-and-attack simulation.
• SafeBreach — continuous breach-and-attack simulation and control validation.
• Cobalt — crowdsourced pentesting platform increasingly incorporating automation and AI.
• Bishop Fox — offensive security consultancy and Cosmos platform for attack-surface and testing workflows.

Dynamics: Autonomous testing is moving from periodic compliance exercises toward continuous validation, but production deployment is constrained by authorization, safety, false positives, and the difficulty of proving that an agent’s exploit path reflects real business risk.

---

Segment 3: Security for AI models, applications, and autonomous agents

What it does: Protects models and AI applications against prompt injection, data leakage, model theft, supply-chain compromise, unsafe tool use, and malicious or misaligned agent behavior.

Companies:

• HiddenLayer — AI model security, monitoring, and protection.
• Protect AI — security for the machine-learning and AI software supply chain.
• Lakera — AI application security and guardrails, including prompt-injection and harmful-content detection.
• Prompt Security — enterprise controls for employee and application use of generative AI.
• CalypsoAI — AI security, governance, and secure deployment controls.
• Cisco — AI Defense and related security capabilities for AI applications and model usage.

Dynamics: This is a rapidly forming control layer, but the category remains fragmented between model scanning, runtime guardrails, data-loss prevention, and governance; buyers increasingly want one policy engine spanning models, agents, tools, and data rather than another point product.

---

Segment 4: Agent identity, non-human access, and runtime governance

What it does: Manages the identity, permissions, secrets, authorization, observability, and lifecycle of software agents and other non-human identities.

Companies:

• Astrix Security — discovery and governance of machine identities, service accounts, and non-human access.
• Oasis Security — non-human identity management and protection.
• Aembit — workload identity and secrets access for machine-to-machine connections.
• Entitle — identity governance and just-in-time access management.
• CyberArk — privileged access and secrets management increasingly extended to machine identities and AI workloads.
• Okta — identity and access infrastructure with growing relevance to service and machine identities.

Dynamics: Agent proliferation creates a new identity problem—each agent may call many tools, APIs, and data stores—but the market is still being assembled from adjacent PAM, IAM, secrets, and cloud-security products; no clear category leader yet owns the full agent runtime.

---

3) Which segment wins the most value?

Likely winner: AI-native SOC and security operations platforms

This segment should capture the most economic value because:

1. It sits directly in the highest-frequency security workflow: alert triage, investigation, detection engineering, and response.
2. It can monetize existing budgets: security operations, SIEM, endpoint, cloud security, and managed detection budgets already exist.
3. It benefits from proprietary telemetry: agents become more useful when they can access endpoint, identity, network, cloud, email, and vulnerability data.
4. It has an execution loop: detect → investigate → contain → remediate → learn, which supports measurable ROI.
5. Platform vendors can bundle it: Microsoft, Google, CrowdStrike, Palo Alto, and SentinelOne can distribute agents into installed bases and attach them to existing contracts.

The offensive-security segment may have higher automation potential, but it is more episodic, more legally constrained, and less embedded in daily operations. Agent-security and non-human-identity products could become strategically important, but much of their value is likely to be absorbed into broader security, IAM, cloud, and developer platforms.

4) White-space opportunities

A. Agent authorization and “runtime governor” for enterprise agents

Gap: No current player appears to fully control an agent’s behavior across identity, tool calls, data access, model choice, delegation, and real-time risk.

A strong product would provide:

• Per-agent and per-task identity
• Fine-grained, time-limited tool permissions
• Real-time policy enforcement before every action
• Human approval for high-impact actions
• Provenance showing which model, data, prompt, and tool caused an action
• Automatic rollback or kill-switch capability
• Cross-cloud and cross-model support

Astrix, Oasis, CyberArk, Okta, Aembit, and AI-security vendors each cover portions of this problem, but the unified runtime control plane remains substantially open.

B. Closed-loop autonomous adversary-to-defense system

Gap: There is no widely adopted platform that safely lets offensive agents continuously attack an organization, translate findings into concrete defensive changes, deploy those changes, and then re-test them across endpoint, identity, cloud, SaaS, and AI-agent surfaces.

The product would connect:

1. Autonomous attack-path discovery
2. Business-impact prioritization
3. Detection and control generation
4. Safe deployment into production
5. Continuous re-validation
6. Evidence for auditors and insurers

XBOW, Horizon3.ai, Pentera, SafeBreach, and major SOC platforms address parts of this loop, but no current player clearly owns the full attack-to-remediation-to-validation lifecycle across the enterprise.

Company fit note: Cobalt and Bishop Fox are real and relevant to offensive security, but they are more traditional or hybrid services/platform businesses than purely autonomous-agent companies. CalypsoAI and Cisco are relevant to AI security, though their offerings span broader governance and security categories rather than only autonomous-agent protection.