跳到正文
原文
Tomasz Tunguz 博客·· 7 天前AI 评分59

Tunguz 提出 AI 的第三个产品市场契合点是安全

The Third Product-Market Fit in AI

文章要点
  • 1作者提出 AI 的第三个产品市场契合点是安全，前两个是编程与客服
  • 2Black Kite 报告称金融业勒索攻击去年增 30%，今年一季度同比再增 76%
  • 3作者调研 75 名企业安全从业者，预算集中于 SOC、SIEM、渗透测试、威胁情报与漏洞管理五类
  • 4Forrester 口径安全市场去年 1750 亿美元、年增 13%；OpenAI 总裁称安全支出应远超软件支出
决策要点

安全预算体量大、攻击压力真实，AI 推理有望在安全领域复制编程和客服式的规模化付费路径。

  • 影响：企业安全预算基数大且年增 13%，采购重心可能从人力响应转向 AI 排查与自动化处置；攻击响应窗口从数月缩到分钟级，安全团队编制与工具配置需要重新测算；安全工具厂商多出一个持续消耗 token 的付费场景。
  • 参考：可考虑按文中五类清单盘点现有安全预算分布，先在告警分诊、漏洞排序这类人力瓶颈环节小范围试用 AI 工具，再以 token 成本对比人工红队与外包渗透测试报价。
  • 依据：攻击数据出自 Black Kite 与 StepSecurity 报告；1750 亿美元与 13% 年增为 Forrester 预测口径；五类预算分布来自作者对 75 名从业者的调研，作者自注偏定性且误差较大。
正文

Coding & customer support were the first two product-market fits in AI.

Black October, the industry’s term for the deluge of new security vulnerabilities, is the prelude to the third product-market fit in security.

Security budget share by function against AI token intensity

Attacks on banks, certificate authorities & core open source libraries have never been greater.1 Ransomware against financial firms rose 30% last year, & 76% again in the first quarter.2 Compromised intermediate certificates let an attacker impersonate any website or service.3 A single five-day campaign stole 78,330 secrets from 2,186 organisations.4

The good news : AI can defend as well as it attacks, provided someone pays for the tokens.

Security is already a massive market, $175b last year & growing 13% a year.5 That was before security entered the token path.6

To see where that money goes, we surveyed 75 security practitioners at the enterprise & asked them how they would divide their security budget excluding endpoint, the security that runs on laptops.

They broke their spend down across five categories.

Security operations center. The SOC is the team that analyzes the enterprise’s alerts coming from all the sensors across the network. With time to respond plummeting from months to minutes, AI SOC automates the triage because no human team can read every alert at that speed.7

SIEM. Security information & event management. These databases aggregate all the information across the enterprise & empower the analysis for the SOC & others. AI queries these stores in natural language so an analyst answers a question in seconds rather than filing a ticket to write a query.

Penetration testing. The use of AI to determine which parts of a system are weak by trying to break in deliberately. Models attempt the intrusion because they can probe every endpoint continuously at a fraction of the cost of a human red team.

Threat intelligence. Understanding who is attacking the enterprise. AI correlates attacker chatter across sources because the volume of new campaigns has outrun manual curation.

Vulnerability management. The continuous process of finding the enterprise’s software weaknesses across the estate, ranking them by risk & patching the ones that matter.8 AI ranks which flaws are actually reachable & exploitable, because scanners report far more findings than any team can patch.

Every category has significant token consumption.

Greg Brockman, OpenAI’s president, puts the consequence plainly.9

Security spend should actually vastly outstrip software spend.

Every company needs AI security in an age when attackers can parallelize their efforts.

  1. Black October : Linux kernel CVEs & PwnEscape, plus the scale of the current wave. https://lwn.net/Articles/1100611/ & https://almalinux.org/blog/2026-10-16-pwnescape-cve-2026-99999/ ↩︎

  2. Black Kite, 2026 Financial Services Cybersecurity Report : finance-sector ransomware climbed from 156 incidents in 2024 to 202 in 2025, then 65 in Q1 2026 alone, a 76% increase over Q1 2025. https://blackkite.com/reports/2026-financial-services-report ↩︎

  3. Cisco Talos found eight compromised eMudhra intermediate certificates whose private keys evaluated to single- & double-digit integers. https://blog.talosintelligence.com/compromised-intermediate-certificates/ ↩︎

  4. StepSecurity tracked 56 supply chain attacks in twelve months, roughly one every three days since March 2026. One five-day campaign stole 78,330 secrets from 2,186 organisations, including 92 public companies. https://www.stepsecurity.io/blog/state-of-open-source-supply-chain-attacks ↩︎

  5. Forrester Global Cybersecurity Market Forecast, 2024 to 2029 : https://www.forrester.com/blogs/global-cybersecurity-spending-to-exceed-300b-by-2029/ ↩︎

  6. So You Want to Sell Inference : https://tomtunguz.com/so-you-want-to-sell-inference/ & Databricks Widens the Lead on the Yellow Brick Token Path : https://tomtunguz.com/databricks-widens-lead/ ↩︎

  7. Time to respond to an intrusion falling from months to minutes, & the case for AI SOC : https://tomtunguz.com/sunil-agrawal-office-hours/ ↩︎

  8. Survey of 75 enterprise security practitioners. Largely qualitative rather than quantitative : error bars on the charts are significant. ↩︎

  9. Greg Brockman on No Priors with Sarah Guo & Elad Gil, “Revolutionizing Cybersecurity & AI-Driven Science,” October 2026 : https://podcasts.apple.com/us/podcast/revolutionizing-cybersecurity-and-ai-driven-science/id1668002688?i=1000796472163 ↩︎

来源：Tomasz Tunguz 博客 · tomtunguz.com

#观点趋势#数据安全#金融