AI Cyber Risk: $23T Threat vs. $1B Safety Bet Flow

The volume of AI-driven cyberattacks is surging, establishing a clear and growing risk. Globally, the number of reported AI-enabled cyber attacks rose by 47% in 2025. Financial services emerged as the top target, experiencing 33% of all AI-driven incidents last year. This isn't just a volume problem; the attacks are becoming harder to stop, with 68% of cyber threat analysts reporting that AI-generated phishing attempts are more difficult to detect than ever.

The sophistication of these attacks is accelerating rapidly. A key indicator is the shift from simple automation to systems that can plan and adapt. In 2025, 14% of major corporate breaches were fully autonomous, meaning no human hacker intervened after the AI launched. This sets the stage for a new, more dangerous phase. Experts predict the arrival of agentic AI, which can autonomously execute an entire attack lifecycle. As one threat intelligence head forecasts, by mid-2026, at least one major global enterprise will fall to a breach caused or significantly advanced by a fully autonomous agentic AI system.

The bottom line is a dramatic change in the attack economy. The cost to launch a targeted exploit has collapsed, making precision attacks economically viable at scale. This flips the script from broad "spray and pray" campaigns to micro-targeted attacks built for a single system. The flow of attacks is moving from being numerous to being smarter, faster, and more surgical, with the next major breach likely to be orchestrated by an AI that operates without direct human oversight.

The Safety Investment: Flow of Capital

The industry's safety spending is dwarfed by the projected economic damage. OpenAI's $1 billion commitment over the next year from its non-profit arm is a notable pledge, but it represents a single company's effort. This flows into a broader market that was valued at $39.8 billion globally in 2025. Even with that market size, the scale of the threat is incomparable.

The projected cost of cybercrime is on a different planet. The IMF forecasts that global losses will reach $23 trillion in 2027, a 175% surge from 2022 levels. This isn't just a future risk; it's an accelerating flow of economic damage that dwarfs current defensive investments. The safety bet is a drop in the bucket compared to the threat's projected tide.

The bottom line is a massive adequacy gap. With the safety market at $40 billion and the threat's projected cost at $23 trillion, the flow of capital into defense is insufficient to match the scale of the coming damage. This imbalance suggests the response is lagging far behind the economic reality of the AI-powered attack economy.

Policy Catalysts and Market Implications

The regulatory push is gaining serious traction, with industry leaders now calling for it. Sam Altman, CEO of OpenAI, has urged the creation of an IAEA-like global oversight body to coordinate AI safety, framing regulation as urgent and necessary for a powerful technology. His call for frameworks to supervise advanced systems signals a strategic shift from pure development to managed deployment.

This marks a notable change from past congressional antagonism. In his first Senate testimony, Altman largely agreed with lawmakers on the need to regulate, trading the usual tech executive dressing-down for a more cooperative tone. This shift in industry posture could accelerate the passage of meaningful legislation, reducing uncertainty for public tech companies.

The financial stakes are immediate and high. Hours after Altman met with lawmakers to discuss AI warfare guardrails, OpenAI struck a deal with the Defense Department just as rival Anthropic was blacklisted. This strategic win for OpenAI, coming amid a regulatory push, directly boosts its valuation and market position, turning policy momentum into tangible capital flow.