AI Agents Are Changing the Economics of Cybersecurity

Security has always been an economic problem. Attackers spend effort to find and exploit weaknesses; defenders spend budget to find and fix them first. Both sides make trade-offs about what is worth the time.

In my conversation with Apostol Vassilev, a senior researcher at NIST who works on adversarial AI, it became clear that AI agents are shifting those trade-offs on both sides at once. What isn’t clear yet is how to put numbers on the shift. That is an open question, and an important one.

The patching math stopped working

Vassilev knows of no large organization that can patch vulnerabilities as fast as they’re now being discovered. Size makes it worse. A small shop with a few computers can keep them current; an enterprise with thousands of systems can’t.

For years, enterprises managed this by triage. Fix what crosses a severity threshold, and defer the rest. The economics of that approach depended on a simple assumption: some vulnerabilities are so hard to exploit that they can safely wait.

“AI models can exploit vulnerabilities that previously were considered hard or impossible to exploit.”

That, Vassilev says, “blows the previous prioritization out of the window.” The backlog of deferred fixes was only cheap because exploiting it was expensive. When exploitation gets cheap, the backlog becomes a liability.

Attack capability got cheaper

Security teams have long sorted attackers into tiers: “script kiddies” running borrowed tools, organized crime, and nation-states with deep resources. The tiers mapped roughly to capability and cost.

Vassilev says that map no longer holds. With open-weight models running only a few months behind the frontier, script kiddies “can unleash attacks that are as powerful as state entities.” Capability that once required a state budget is now available to almost anyone.

Defenders pay costs attackers ignore

The obvious response is to fight agents with agents. Vassilev agrees: you have to meet the attacker’s technology with similar technology, and that means deploying agents inside the enterprise to find and patch vulnerabilities.

But the two sides don’t carry the same costs. An attacker doesn’t care if an agent breaks something along the way. A defender cares a great deal. A defensive agent that misbehaves can take down the systems the business runs on, for hours or for a week.

“The defenders need to care about the unknown behavior of the agent. The attackers don’t care. They just unleash it and see what happens.”

That asymmetry is an economic one. Defenders have to pay for reliability (testing, monitoring, oversight, recovery) on top of capability. Attackers only pay for capability. And agents read data from everywhere, so a defender also has to account for adversarial text, planted somewhere an agent will find it, that can send the agent off course.

The model nobody has built yet

In business we try to price things, so markets can weigh them. Vassilev agrees that quantifying the risk is the first step: putting numbers on it so you can estimate “the potential economic upside or downside of a specific technology or an action.”

He points to early research estimating what it costs to use AI to attack a system, and what it costs to defend one. Those initial figures are a starting point for what he calls collaborative financial models: ways for an organization to ask, “If I deploy this technology in this business model, how much am I exposing myself?”

He is candid that this is “a work in progress.” The interview doesn’t offer a finished model, and I won’t pretend to supply one. But the questions such a model needs to answer are already visible:

What does it now cost an attacker to exploit a given weakness, and how fast is that cost falling?

What is the real cost of a deferred patch, when exploitation is cheap?

What does it cost to run a defensive agent reliably, including the oversight and the failures?

How should a business case for an AI deployment account for the exposure it creates?

Enterprises that start answering these, even roughly, will make better decisions than those still running yesterday’s triage math. And whoever builds the tools to answer them well will be building something the market needs.