Breaching the Offensive Cybersecurity Space

The Case for Offensive Cyber as AI Changes How We Perceive Software Vulnerabilities

By Alec Lagunes

On June 9^th, 2026, Anthropic released the world’s most advanced large language model to date, Mythos 5. Two weeks later, OpenAI released its own new model, GPT-5.6. These models’ sophisticated cybersecurity capabilities raised concerns among industry experts and government officials alike, leading to controlled rollouts and heavy restrictions to curb their destructive potential. But another model, released the same month with far less American attention, has displayed comparable performance: GLM-5.2, from China’s Zhipu AI.

GLM-5.2 is not just as effective as Mythos or GPT-5.6; it’s cheaper, and it’s open-weight. That means anyone can download the model, run it on their own hardware, and fine-tune it for their specific objectives, all without the safeguards that protect Anthropic’s and OpenAI’s models from antagonistic use.[1]

Knowing that organizations need time to harden their systems before these capabilities become broadly accessible, Anthropic launched an initiative dubbed Project Glasswing in April, providing critical software infrastructure companies early access to Mythos to scan and secure their systems. Notably, Anthropic limited Mythos access to roughly 40 organizations, a stark contrast to the larger universe of companies that need to shore up their defenses. The offensive cybersecurity space, built on finding vulnerabilities and patching them before they can be exploited, is not just a growing market—it is now fundamentally critical to preserving the function of every online system and platform.

The Evolution of Offensive Cyber

Up until the mid-2010s, offensive cyber was built on two primary methods of security: artisan pentesting, in which security professionals manually comb through an enterprise's systems to find bugs, and red teaming, where hackers simulate real-world attacks to evaluate an organization’s ability to detect and respond to threats. Though both processes were generally effective for the technology of their time, they did not scale well due to prohibitive costs, leaving small- and medium-sized enterprises without meaningful security testing.

Automation promised to resolve those issues. As automated pentesting software advanced and became viable for mainstream use, assessments became cheaper and universally accessible. But automated tools rely on pattern recognition, which means a steady stream of false positives and insufficient ability to distinguish which vulnerabilities actually pose significant risk. For that reason, top security boutiques continued to employ high-creativity red teaming and deep-logic manual testing teams. Automation might have made pentesting faster, but it wasn’t smarter.

Agentic AI is beginning to close that gap. Modern pentesting and red teaming agents can now evaluate a company’s full attack surface from a variety of contexts and angles, all with a level of contextual judgment that automated tools cannot replicate. And the case for adopting them is not only about speed or cost anymore: now that advanced generative AI models can generate exploits faster than human teams can audit the underlying code, manual testing alone is no longer a sustainable defense model. The most effective tool against AI-accelerated attacks is AI-driven defense, and in a world where AI can find vulnerabilities “across every major operating system and web browser,” enterprises must harden their defenses before the attackers arrive.[2]

A Market Primed for Growth

Many factors have converged to create an ideal environment for the expansion of cybersecurity. In our increasingly digital world, the accelerated adoption of cloud workloads has expanded enterprises’ attack surfaces, heightening the need for a strong security posture. At the same time, compliance requirements and customer expectations for privacy and uptime have never been higher. While these demands remain relevant, the most important driver of cybersecurity purchasing is no longer compliance or customer trust—it is the financial risk that a breach poses to the foundational programs of an enterprise.

Source: Morningstar

Over the past four years, the FBI has tracked a 37% compound annual growth rate in reported cyber-enabled losses, and that trajectory shows no signs of flattening.^[3] In fact, the rapid improvement of AI models projects to push this trend even further, leading to both more breaches and greater losses incurred with each complaint. Without a strong security posture, a threat actor will attempt to manipulate both technology and people to reach their objectives; an effective cybersecurity protocol is an investment that can protect critical infrastructure from cyberattacks through effective vulnerability mitigation and timely incident response, saving companies from millions of dollars in losses.

The Opportunity for Venture Capital

At first glance, offensive security appears to be an ideal market for startups. With a market projected to double in size by 2031,^[4] the space will significantly outpace cybersecurity overall.^[5] The surface-level thesis is apparent: venture capital can tailwinds the wave of a rapidly growing market and generate substantial returns.

Upon further review, however, it is important to note where this growth originates. Historically, cybersecurity has been a fragmented space, but customers are now gravitating toward platform providers that offer integrated security solutions. Large firms continue to strengthen their competitive advantages: enhancing an existing product is often far less costly than building a new one from scratch, and retaining customers is significantly cheaper than acquiring them. As organizations adopt more security tools, they are simultaneously reducing the number of vendors they work with. The result is stronger customer retention, expanding margins, and a favorable growth environment for large cybersecurity platforms, which are likely to capture a significant share of the industry's expansion over the coming years.

Source: Morningstar

While it is true that consolidation is making cybersecurity a top-heavy space, this is not necessarily a headwind for startups. If anything, it is a benefit for venture capital investment: companies with unique software or agentic capabilities are attractive targets for acquisition. Since 2025, strategic buyers Google, Palo Alto Networks, and CrowdStrike have accounted for $65 billion in exits alone, underscoring their desire to create a comprehensive cybersecurity platform for their clients.

The result is a broader cybersecurity environment with an unprecedented number of opportunities for M&A. In 2025, overall cybersecurity deal value surged to $96 billion across 400 transactions, highlighted by Google's $32 billion acquisition of Wiz, the largest deal ever in the cybersecurity space.^[6] Deal value in 2026 is on pace to surpass that record; as the market grows, the frequency and size of strategic acquisitions grow with it, creating an environment in which a startup can reliably scale to an exit—not despite consolidation trends, but because of them.

Mapping the Market: Where Does the Opportunity Lie?

Clearly, companies that can build a defensible niche and differentiated capabilities will be highly valuable to platforms that want to expand and acquire. So where is the next generation of innovation going to emerge?  I have identified three key opportunities in this space:

1.     Superior Agentic Development

Source: Black Opal Ventures, The Companies

As it stands, the development of AI agents is constrained by the availability of data. Companies developing security validation agents start with a model from an LLM backbone, then scaffold their agent with training data. The problem is that they can only use material everyone can access—most proprietary training data is off-limits due to NDA. So, whether they use CVE databases, disclosed exploits, or security research papers for training, there is little differentiation between agents.

Therein lies the first opportunity for a successful startup: developing original training data specific to a certain attack surface to build high-quality agents. New cybersecurity companies have approached this issue in a variety of ways: Armadin, which raised $189.9 million in the largest early-stage raise in cybersecurity history, has leveraged the expertise of professional pentesters and red teamers to generate labeled training data for their agents.[7] Other companies, such as Gray Swan, host hackathons to develop AI red teaming data sets and learn more about how agents respond to novel prompt injection methods.[8] Companies that innovate in this space by developing their own data and training superior agents can get a leg up on the competition.

2.     Vulnerability Triage

Anthropic's research on Mythos's ability to identify software bugs found that it can uncover high- and critical-severity vulnerabilities that have sat dormant since the code was written. However, despite agentic AI’s promise to solve the issue of false positives that plagued automation for the past decade, these dangerous bugs sit among hundreds of harmless ones with no demarcation between the two.

This is not a new bottleneck in cybersecurity, but innovative solutions now exist. Rather than software engineers combing through every flagged bug, agents can perform the triage; the problem is that most do not do so effectively. Platforms such as CrowdStrike have emphasized the need for new bug exploitability metrics as the rise of AI hacking has made “traditional metrics...less meaningful on their own.”[9] Enterprises need to prioritize based on exploitability, asset value, and attack path relevance—startups that can effectively streamline this process will secure a key market.

3.     Market Expansion

Pentesting is just the starting point. In the past, pentesting and red teaming were processes that companies performed a couple of times a year, at most. Now, autonomous hacking agents can provide always-on security validation. As Tenzai founder and CEO Pavel Gurvich remarked: “For every dollar an organization spends on products, it spends about five on services.”[10] Pentesting is a market hindered by cost and scope. Autonomous platforms can expand offensive security beyond pentesting and red teaming into vulnerability management & remediation, attack surface protection, and security validation, presenting a sizeable market and generating a lucrative opportunity for investors.

Conclusion

When I began analyzing this sector, I was initially uncertain whether offensive cybersecurity represented a compelling investment opportunity. Deeper research convinced me that it does—I expect that this market will see a sharp jump in demand over the next few years, particularly among vulnerable small- and medium-sized enterprises, as AI-driven threats become more sophisticated in parallel with declining security validation cost. At the most fundamental level, this thesis rests on a simple reality: companies will recognize that the cybersecurity risks posed by advanced AI models are legitimate and significant threats to their critical software. From there, the questions will become practical: where are the vulnerabilities, and how do they ensure those flaws are not exploited? Offensive cybersecurity sits at that intersection.

As AI-powered agents enable the transition from periodic assessments to continuous security validation, offensive security is evolving from a specialized service into an essential layer of digital infrastructure. For investors, an expanding market, rapidly improving technology, and strategic acquirers actively searching for differentiated capabilities all pose a great opportunity for returns. The question that remains is which companies will emerge to define the category and capitalize on the sector’s potential.

[1] Katie Paxton-Fear et al., "We Have Mythos at Home: GLM 5.2 Beats Claude in Our Cyber Benchmarks," Semgrep, June 22, 2026, semgrep.dev/blog/2026/we-have-mythos-at-home-glm-52-beats-claude-in-our-cyber-benchmarks.

[2] Bloomberg News, "Anthropic Limits Mythos Model Release in Bid to Stave Off Hacks," The Star, April 9, 2026, https://www.thestar.com.my/tech/tech-news/2026/04/09/anthropic-limits-mythos-model-release-in-bid-to-stave-off-hacks

^[3] Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 Internet Crime Report (FBI, 2026), https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf.

^[4] Mordor Intelligence, Penetration Testing Market Size, Share & Trends – Forecast to 2031 (Mordor Intelligence, 2026), https://www.mordorintelligence.com/industry-reports/penetration-testing-market.

^[5] MarketsandMarkets, Cybersecurity Market – Global Forecast to 2030 (MarketsandMarkets, 2025), https://www.marketsandmarkets.com/Market-Reports/cyber-security-market-505.html.

^[6] Momentum Cyber, 2025 Cybersecurity Almanac: Year-End M&A Update (Momentum Cyber, 2026), momentumcyber.com/cybersecurity-mergers-acquisitions-report-2025.

[7] Aleix Pérez, "Offensive Security Market Map: The Rise of Autonomous Hacking," Cyberflow, April 22, 2026, cyberflow.substack.com/p/offensive-security-market-map-the.

[8] Gray Swan AI, "Gray Swan Arena," app.grayswan.ai/arena.

[9] CrowdStrike, "Five Steps for Frontier AI Security Readiness," https://www.crowdstrike.com/en-us/resources/white-papers/five-steps-for-frontier-ai-security-readiness/.

[10] Meir Orbach, "Guardicore Founders Launch Tenzai with $75M Seed Round to Build Autonomous 'Hacker' AI," CTech by Calcalist, November 11, 2025, https://www.calcalistech.com/ctechnews/article/sjngskgewg.