Cybersecurity Stocks Rise on AI Worm Risk

In plain English, the old playbook for worms was comparatively simple: find one vulnerability, weaponize it, and spread until patching closes the door. AI changes that equation by helping attackers test more attack paths, tailor the method to the target, and exploit not just software bugs but sloppy settings, weak passwords and other misconfigurations. Once the worm is launched, it can move with a level of autonomy that makes the attack faster, broader and much harder to interrupt.

That is why the warning from Anthropic and the research led by Nicolas Papernot at the University of Toronto deserves investor attention. Papernot’s team built a prototype AI worm using freely available models in June, underscoring that this is no longer a theoretical problem confined to science fiction. Google DeepMind chief executive Demis Hassabis has also warned that AI-driven cyberattacks could become major incidents within one to two years if safety measures do not improve. Put together, those alerts suggest the cybersecurity market is not dealing with a distant risk — it is facing a rapidly advancing threat profile.

For investors, the implication is straightforward: security budgets are likely to stay elevated, and the winners should be the companies that can detect and stop attacks in real time across endpoints, identity systems, cloud workloads and connected devices. CrowdStrike, Palo Alto Networks and Zscaler all sit in that lane, and each has been telling investors in regulatory filings that threats are becoming more frequent, more automated and harder to recognize before launch. That is exactly the kind of environment that supports long-run demand for security platforms, even if stock prices remain volatile.

The market has already rewarded that expectation in a big way this year. CrowdStrike has surged to about $251, while Palo Alto Networks and Zscaler have also seen powerful moves from their lows, even after recent pullbacks. Technical indicators such as the 50-day moving average and RSI readings suggest these stocks can get stretched quickly, but the longer message is that the market is still pricing in durable growth for cybersecurity spending as attackers get smarter.

There is also a second-order investment angle: the more AI increases the attack surface, the more valuable it becomes to secure the AI systems themselves. That could benefit vendors focused on runtime protection, identity, data loss prevention and AI-specific threat detection. It also puts pressure on enterprises to treat AI deployment as a security problem from day one, not as an IT add-on after the fact.

The risk, of course, is that the threat grows faster than defenses. Papernot’s recommendation to keep AI models disconnected from the internet during early testing, standardize containment practices, and require mandatory incident reporting all point to a sector that still lacks mature guardrails. If regulators move toward those ideas, compliance spending could rise further. If they do not, the first major AI worm may be the catalyst that forces the issue.

For long-term investors, the takeaway is not to panic — it is to recognize that cybersecurity remains one of the most durable secular themes in tech. AI is not killing the case for security spending; it is strengthening it. That makes the leading cybersecurity names worth watching, and for patient investors, potentially worth holding for years.