Cyber Threat Intelligence, Entrepreneur, Presentation Virtuoso
articles

Wall Street Just Found a Way to Short the Apocalypse

The AI threat everyone has read about all year just became a stock trade. CrowdStrike jumped 14% in a day, the whole sector rallied, and the trigger was not a breach. It was fear. The threat is real. The defense is real. And the same fear that fills my posts now fills their earnings calls.
Wall Street Just Found a Way to Short the Apocalypse

the ai threat everyone has been reading about all year just became a stock trade. crowdstrike (crwd) jumped around 14% in a single day. not unheard of, it has happened plenty of times previously. but palo alto, zscaler, and the whole cyber security sector rallied.

the trigger was not a breach. it was fear. surprise surprise.

anthropic's ceo published an essay arguing ai development should slow down so safety can catch up. this is a solid idea many people much smarter than me are advocating. the market read that as a warning, and money rotated. it moved out of the chipmakers building ai, and into the companies defending against it. crowdstrike was positioned as the clearest bet, and it ran.

first, the threat is real. i have spent this month documenting it. ai rebuilding malware faster than defenders can block it. attacks running as swarms of agents. a full compromise for a few dollars in tokens. crowdstrike's own numbers say ai-adversary activity is up 89% year-over-year. average ecrime breakout time has collapsed to 29 minutes, with the fastest observed at 27 seconds. none of that is invented. the machine-speed attack is happening, and is well documented by the world's best cyber security software.

crowdstrike's response is also real. at fal.con, its yearly user conference earlier this month, ceo george kurtz declared the old threat model obliterated. he coined a phrase for the new one, the agent-state, where ai gives ordinary attackers capabilities once associated with nation states. to their credit, the company has shipped a wave of ai-defense products to match their rhetoric. that is a legitimate business responding to a legitimate problem.

there is one additional variable to consider, which is also true. the company sounding the alarm is the same company selling the alarm system. that is not an accusation. it is just the structure. and it is worth being aware of, for every security vendor, not only crowdstrike. the firms documenting how terrifying the threat is are the very same firms whose revenue depends on you finding it terrifying. the incentive to warn and the incentive to sell point in the exact same direction.

that does not make the warning false. it is something to consider. the threat can be genuinely dangerous and genuinely good for business at the same time. those are not in conflict. they are not mutually exclusive. but when a vendor's threat report and its sales pitch are the same document, read the report knowing what it is also trying to do. critical thinking skills are vital now more than ever.

wall street noticed the danger. did the market price the danger, or the story about the danger? crowdstrike now trades at roughly 148 times next year's expected earnings. that is a lot of certainty about a future nobody can see clearly yet. one analyst made the quiet point that everyone chasing the trade skips. elevated risk does not automatically mean companies double their security budgets. being scared is not the same as spending, and a stock priced for the spending needs the spending to actually show up.

in my experience, most security budgets are shrinking, not increasing. crowdstrike would like to see more module adoption in all their existing customers, and marketing fear is one way to force the issue. this is not to say the fear is necessarily a lie, but it is something to be aware of when reading these reports.

none of this is advice about the stock. i am not in that business, and you should not take market calls from me. ever. it is just an observation about a loop. the same fear filling my posts fills their earnings calls, and this week it filled a rally.

once wall street starts rewarding the fear, the loop gets even cleaner. warn about the threat, sell the defense, watch the stock rise. now the market itself becomes evidence everyone else must be taking the threat seriously too.

the machine-speed attack is real. the defense is real. and the fear is now an asset class. all three are true, and the third one is the part nobody selling you either of the first two will point out.

cyber security used to monetize breaches. now it can monetize the anticipation of breaches before they even happen.

wall street found a way to short the apocalypse and go long on the people selling the fire extinguishers.

Similar topics

Nobody Broke Into Revolut, They Just Asked

Nobody Broke Into Revolut, They Just Asked

Revolut handed a stranger its customers passports, selfies, and full transaction histories. Nobody broke in. A fraudster asked, using a legitimate government email domain, and Revolut said yes. No hack, no exploit, just an email and a lie, and the trust a bank extends to anything official.
Facebook Lies to Your Lock Screen to Make You Tap

Facebook Lies to Your Lock Screen to Make You Tap

Facebook sent me a push notification saying someone replied to my comment. Nobody did. The real event, sitting in the app, was a stranger commenting on a group photo. The push had rewritten it into something personal, on iOS and Android both. The error only ever breaks one way, toward the tap.
China Hacked the Software that Reads Every Key You Press

China Hacked the Software that Reads Every Key You Press

UNC3569, a china-nexus group, broke into Windows machines through Sogou, the input tool millions use to type Chinese characters. One crafted link, one click, and a backdoor opened. Tencent patched it fast, but the embedded browser underneath is still ancient and defenseless.
Cozy Bear Taught an AI to Rebuild Its Malware Every Time Its Detected

Cozy Bear Taught an AI to Rebuild Its Malware Every Time Its Detected

Russia's Cozy Bear used AI to watch its own malware and rebuild it the instant a security product flags it, over and over, in seconds. Detection used to impose a cost. Now the machine just regenerates until nothing catches it. The static-indicator layer never stood a chance.
America Named the Man Attacking Its Water Plants and Can Do Nothing About It

America Named the Man Attacking Its Water Plants and Can Do Nothing About It

The US put a $10 million bounty on the IRGC officer it says is attacking American water systems. He is a serving Iranian official, sitting inside Iran, and the money will never be paid. After three years of sanctions and indictments that did not work, this is what is left. It patches nothing.