The AI Trade’s Other Beneficiary

“Why cybersecurity’s tailwinds look structural and why purity of exposure matters.”

At ARK we believe AI is the defining technology platform of this decade, and most of the capital chasing it goes to the companies that build it, from the chipmakers and cloud platforms to the model developers themselves. There is a second group of beneficiaries that gets far less attention: the companies that make AI safe to deploy. Every model, agent and application a business switches on creates new identities to manage, new data to protect and new code to secure, and the same tools are making attackers faster and more capable. Cybersecurity demand therefore grows with AI adoption itself, which in our view makes it one of the most direct and least appreciated ways to participate in the AI build-out. This piece sets out the case in three steps: AI has multiplied what needs defending, the spending has followed, and the companies are already seeing it in their numbers.

AI Has Multiplied What Needs Defending

Switch on an AI agent inside a company and you have created a new identity with access to data and systems.¹ The research firm Gartner expects 40% of enterprise applications to embed AI agents by the end of 2026, which is remarkable given that the figure was under 5% at the start of the year.² Each of those agents needs its own protection, and a new category of security products has grown up to provide it, guarding AI models and agents against manipulation and controlling what data flows in and out of them. Gartner sees spending on this category, which it calls securing AI, growing from around $2.8bn in 2026 to $7.7bn in 2028, a compound annual growth rate of roughly 65%.³

Chart 1 AI is Creating the Demand⁴

The threat side is moving just as quickly. In April 2026 Anthropic reported that one of its frontier models had found thousands of high-severity vulnerabilities on its own. Some of them were in the operating systems and browsers most of us use every day.[5] When machines can find flaws at that speed the challenge for software owners shifts from spotting problems to fixing them fast enough. Security spending rises in step with AI adoption, and in our view adoption is still at an early stage. That is the heart of the case.

The Spending Has Followed, By Choice And By Law

Gartner forecasts worldwide security spending of $244bn in 2026 and $322bn by 2029, a compound annual growth rate of about 10%.⁶ IBM’s latest Cost of a Data Breach study puts the average breach at a record $4.99m. Furthermore, one in four malicious breaches is now AI-enabled and the time to contain a breach has stretched to 247 days.⁷ That number had been falling for five years before AI changed the rules of engagement.

Regulation has turned this spending from a choice into an obligation. The EU Cyber Resilience Act’s 24-hour reporting rules went live on 11 September 2026.⁸ DORA and NIS2 are already in force. The UK’s Cyber Security and Resilience Bill carries fines of up to £17m or 4% of turnover and makes boards personally accountable.⁹ Spending that the law requires does not get pushed into next year when budgets tighten.

Chart 2 Regulation Has Made Security a Mandatory Expense ¹⁰

And The Companies Are Seeing It In Their Numbers

Forecasts are one thing, but the clearest evidence comes from what the companies themselves are reporting. The table below covers ten of the best-known listed pure-play cybersecurity companies, and on the latest broker consensus compiled by S&P Capital IQ (the financial data platform of S&P Global) they are growing revenue by about 17% this fiscal year and 15% next. Every one of them is expected to generate free cash flow this year, with an average margin of 24%, and seven of the ten raised their full-year guidance during 2026, six of them twice.¹¹

Table 1 ¹²

Palo Alto Networks gave the clearest explanation of what is driving this. On its September earnings call the company said its AI-security product had reached $100m of annual recurring revenue within four quarters of launch. Management called it the fastest-scaling product in the company’s history. AI-agent traffic across its network platform had grown nine-fold in nine months and bookings had accelerated for a second quarter running. The chief executive summed it up in one line: “AI is a long-term tailwind for cybersecurity.”¹³

The Specialists Are Buying The Future

2025 was a record year for cybersecurity M&A. Disclosed deal value reached $92.5bn, up 82% on 2024, and the first half of 2026 was the busiest half ever. The big deals made the headlines, with Google paying $32bn for Wiz, Palo Alto Networks $25bn for CyberArk and ServiceNow $7.75bn for Armis, each of them a scaled platform paying up for something it could not build fast enough.¹⁴

The smaller deals tell you more about where the industry is heading. Among around 30 listed pure-play cybersecurity companies, S&P Capital IQ records more than 50 acquisitions since the start of 2025. At least 13 of those targets secure AI models and agents and together they carried more than $2bn of disclosed value. Protect AI went for $700m, Lakera for $300m, Pangea for $260m and Prompt Security for $171m.¹⁵ The specialists are building the securing-AI product line themselves one deal at a time. The market is fragmented and that means the buying has further to run.

Why Purity Of Exposure Matters

If the case above holds, the next question is how to own it. We think the answer is as purely as possible, for three reasons.

You want the driver, not the proxy. A company that earns most of its revenue from security lives or dies by threat levels, regulation and AI adoption, as the company results discussed earlier show. A diversified technology giant that also sells some security is driven by everything else it does. A cybersecurity basket built around names like that can turn into a technology allocation in disguise.

You probably already own the mega-caps. Most portfolios hold the big technology names through broad market and growth exposure. A security allocation built on the same names adds very little that is new. One built on specialist companies has low overlap with the major indices and so it diversifies instead of duplicating. Owning the lock is not the same as owning the house.

Focus is where the strategic value sits. The consolidation wave is paying for capability and capability lives in the specialists. They are the natural targets. The platforms doing the buying are specialists too. A pure-play allocation sits on both sides of that trade.

A pure-play approach does come with higher volatility than the broad market and the usual risks of a single-sector allocation, which is also the point. Specialist cybersecurity companies answer to a different set of forces, so they can behave differently from the wider market in both rising and falling conditions. An investor who wants that difference should own it undiluted.