Tomasz Tunguz on why the third product-market fit for AI is security
Tomasz Tunguz believes that, after coding and customer support, security will become the third product-market fit for AI. Citing a survey of 75 enterprise security practitioners, he breaks down security budgets excluding endpoints into five categories—security operations centers, SIEM, penetration testing, threat intelligence, and vulnerability management—and notes that each category has significant token consumption. The article also cites OpenAI President Greg Brockman's judgment that security spending should far exceed software spending.
Why read this
AI score 61
The author uses a budget breakdown from 75 enterprise security practitioners to explain why security may become the third product-market fit for AI.
Topics
Body
Coding & customer support were the first two product-market fits in AI.
Black October, the industry’s term for the deluge of new security vulnerabilities, is the prelude to the third product-market fit in security.
Attacks on banks, certificate authorities & core open source libraries have never been greater.1 Ransomware against financial firms rose 30% last year, & 76% again in the first quarter.2 Compromised intermediate certificates let an attacker impersonate any website or service.3 A single five-day campaign stole 78,330 secrets from 2,186 organisations.4
The good news : AI can defend as well as it attacks, provided someone pays for the tokens.
Security is already a massive market, $175b last year & growing 13% a year.5 That was before security entered the token path.6
To see where that money goes, we surveyed 75 security practitioners at the enterprise & asked them how they would divide their security budget excluding endpoint, the security that runs on laptops.
They broke their spend down across five categories.
Security operations center. The SOC is the team that analyzes the enterprise’s alerts coming from all the sensors across the network. With time to respond plummeting from months to minutes, AI SOC automates the triage because no human team can read every alert at that speed.7
SIEM. Security information & event management. These databases aggregate all the information across the enterprise & empower the analysis for the SOC & others. AI queries these stores in natural language so an analyst answers a question in seconds rather than filing a ticket to write a query.
Penetration testing. The use of AI to determine which parts of a system are weak by trying to break in deliberately. Models attempt the intrusion because they can probe every endpoint continuously at a fraction of the cost of a human red team.
Threat intelligence. Understanding who is attacking the enterprise. AI correlates attacker chatter across sources because the volume of new campaigns has outrun manual curation.
Vulnerability management. The continuous process of finding the enterprise’s software weaknesses across the estate, ranking them by risk & patching the ones that matter.8 AI ranks which flaws are actually reachable & exploitable, because scanners report far more findings than any team can patch.
Every category has significant token consumption.
Greg Brockman, OpenAI’s president, puts the consequence plainly.9
Security spend should actually vastly outstrip software spend.
Every company needs AI security in an age when attackers can parallelize their efforts.
Black Kite, 2026 Financial Services Cybersecurity Report : finance-sector ransomware climbed from 156 incidents in 2024 to 202 in 2025, then 65 in Q1 2026 alone, a 76% increase over Q1 2025. https://blackkite.com/reports/2026-financial-services-report ↩︎
Cisco Talos found eight compromised eMudhra intermediate certificates whose private keys evaluated to single- & double-digit integers. https://blog.talosintelligence.com/compromised-intermediate-certificates/ ↩︎
StepSecurity tracked 56 supply chain attacks in twelve months, roughly one every three days since March 2026. One five-day campaign stole 78,330 secrets from 2,186 organisations, including 92 public companies. https://www.stepsecurity.io/blog/state-of-open-source-supply-chain-attacks ↩︎
So You Want to Sell Inference : https://tomtunguz.com/so-you-want-to-sell-inference/ & Databricks Widens the Lead on the Yellow Brick Token Path : https://tomtunguz.com/databricks-widens-lead/ ↩︎
Time to respond to an intrusion falling from months to minutes, & the case for AI SOC : https://tomtunguz.com/sunil-agrawal-office-hours/ ↩︎
Survey of 75 enterprise security practitioners. Largely qualitative rather than quantitative : error bars on the charts are significant. ↩︎
Greg Brockman on No Priors with Sarah Guo & Elad Gil, “Revolutionizing Cybersecurity & AI-Driven Science,” October 2026 : https://podcasts.apple.com/us/podcast/revolutionizing-cybersecurity-and-ai-driven-science/id1668002688?i=1000796472163 ↩︎
Get the next one in your inbox
The 1-minute read that turns tech data into strategic advantage.
Read by 150k+ founders & operators.