AI’s first two product-market fits were coding and customer support. The third, the article argues, is security: an industry wave it calls Black October — the term for the deluge of new security vulnerabilities — is already hitting banks, certificate authorities, and core open source libraries. Ransomware against financial firms rose 30% last year and 76% again in the first quarter. A single five-day campaign stole 78,330 secrets from 2,186 organisations. Compromised intermediate certificates can let an attacker impersonate any website or service.

The good news is that AI can defend as well as it attacks, provided someone pays for the tokens. Security is already a massive market — $175B last year, growing 13% a year — and that was before security entered the token path. To map where the money goes, the article reports a survey of 75 enterprise security practitioners who split their budgets with endpoint security, the security that runs on laptops, excluded. Five categories emerged, and every category has significant token consumption.

Security operations center: the SOC triages alerts coming from all sensors across the network; as time to respond drops from months to minutes, AI automates triage because no human team can read every alert at that speed. SIEM: analysts query these aggregation databases in natural language, getting an answer in seconds rather than filing a ticket to write a query. Penetration testing: models probe every endpoint continuously at a fraction of the cost of a human red team. Threat intelligence: AI correlates attacker chatter across sources because new campaigns outrun manual curation. Vulnerability management: AI ranks which scanner-reported flaws are actually reachable and exploitable, since scanners report far more findings than any team can patch.

Greg Brockman, OpenAI‘s president, draws the consequence plainly: security spend should vastly outstrip software spend. Every company needs AI security in an age when attackers can parallelize their efforts.