Investing in Cybersecurity After the AI Bubble: A Framework for the Next S-Curve

The current AI market boom is showing clear signs of a correction. Warnings from central bankers and major CEOs about inflated valuations are no longer abstract. Earlier this month, the Chair of the Bank of England warned of a "sudden correction" in AI-driven asset valuations. Last week, Jamie Dimon echoed this, saying "a lot of assets look like they're entering bubble territory." This is not a prediction; it is a historical pattern. Every new technology first experiences explosive, uncomfortable adoption, then it gets disrupted by new market economics, then re-optimized to market value. The AI bubble is simply this innovation's reality check.

This phase is necessary, not catastrophic. It is a clarification. As inflated expectations meet cyber reality, it separates durable infrastructure from speculative tools. The cybersecurity industry, which has made AI adoption central to its entire value proposition, now faces a pivotal moment. The bubble burst will accelerate infrastructure consolidation, creating a clearer path for cybersecurity to become a fundamental, monetizable layer in the post-hype economy. The core thesis is clear: cyber leaders must pivot from chasing AI hype to building cyber resilience and information integrity as core mandates.

The evidence is already fracturing. The industry's eleven largest providers have captured the lion's share of AI-driven valuations, but this concentration reflects a dangerous bet on a handful of geographically concentrated firms. History suggests such concentration in strategic sectors triggers political intervention. Governments are already acting decisively to counter sovereign cyber risk, mandating supply-chain diversification and localizing digital-defence capacity. This shift creates a direct opportunity for cyber leaders who act now to build geopolitical resilience.

At the same time, the nature of the threat is changing. The most tangible malicious use cases of AI lie not in undetectable technical attacks, but in cognitive manipulation. AI-driven automation has made phishing, deepfake identity creation, and online fraud exponentially faster. Yet most cybersecurity budgets remain focused on traditional information security. This creates another fracture. Organizations that expand their security mandates now to include deepfake detection and information operations monitoring will defend against the AI threats that exist. The bubble burst is not an endpoint; it is a necessary checkpoint that reveals the true S-curve of adoption. The winners will be those building the fundamental rails for the next paradigm.

The Post-Burst Landscape: Where Cybersecurity Wins

The bubble burst will not end the need for security; it will redefine it. In the immediate aftermath, organizations will face a stark "capability gap." The AI-powered security tools that promised full-scale machine-versus-machine warfare are built on a foundation of stranded data center assets and unsustainable compute demands. When the infrastructure reality hits, these tools will fail to deliver. This creates a direct, urgent demand for reliable, non-AI-dependent solutions that can operate on existing, resilient infrastructure. The winners will be those whose products work when the AI hype stops.

Long-term value will shift decisively to companies investing in diversified, resilient infrastructure rather than speculative AI tools. The industry's eleven largest providers have captured the lion's share of AI-driven valuations, but this concentration is a vulnerability. History shows such concentration in strategic sectors triggers political intervention. Governments are already acting to counter sovereign cyber risk, mandating supply-chain diversification and localizing digital-defence capacity. Cyber leaders who have built geopolitical resilience into their operations will be positioned to win contracts and market share as this regulatory and economic shift accelerates.

The World Economic Forum's 2026 outlook crystallizes this new mandate. Its Global Cybersecurity Outlook emphasizes that cyber resilience is foundational, not optional, for trust and innovation. As the report notes, the threat environment is accelerating, and traditional defences are being tested. The solution is not more AI hype, but a fundamental recalibration. Organizations that recognize cyber resilience as a shared, strategic responsibility will be the ones that thrive. The bubble burst is a necessary checkpoint that reveals the true S-curve of adoption. The winners will be those building the fundamental rails for the next paradigm.

The Investment Framework: 3 Criteria for the Next S-Curve

The bubble burst will separate the durable from the disposable. For investors, the task is to identify the cybersecurity startups that will build the fundamental rails for the next paradigm. Based on the strategic analysis, here are three concrete criteria to evaluate them.

First, look for the "good combination" of team, market, and product. As Cato Networks' CEO Shlomo Kramer notes, every promising startup needs this alignment. The product itself must have a clear hook-a concept that is quick to understand and feels right intuitively. More importantly, it must show platform potential, the ability to evolve into something broader over time. This is the infrastructure layer, not a single feature.

Second, prioritize companies whose solutions address a fundamental, non-speculative customer problem. The AI bubble has obscured this. Many startups are selling an AI feature, but the real, urgent need is for reliable, non-AI-dependent security that works on existing infrastructure. The winners will be those solving the persistent, tangible threats: phishing, deepfakes, and information operations. Their value proposition must be clear even if the AI hype stops.

Third, assess the team's understanding of the actual customer problem. Kramer points to the founder of Check Point, who was a system administrator. That deep, firsthand understanding of the pain point allowed him to build the right solution. Investors should look for founders who have lived the problem, not just theorized about it. This is the "granularity" that comes from true expertise, not just big-picture vision. In a post-bubble world, that practical insight is the most valuable currency.

Catalysts and Risks: What to Watch for the Next Inflection

The cybersecurity infrastructure thesis hinges on a few clear signals. The next inflection point will be marked by the speed of the AI adoption slowdown, the physical constraints of data center power, and a fundamental shift in how security dollars are spent.

First, watch for the pace of AI adoption itself. Cato Networks' CEO Shlomo Kramer has already framed this as a key variable, noting that the advancements of AI are "happening at a much slower pace than right now". His assessment is that while AI has value in specific areas like customer support, it is not yet replacing core functions like engineering. If this slower, more modest adoption rate becomes the norm, it will accelerate the economic reality check. The bubble's fuel-expectations of rapid, transformative ROI-would deflate, forcing a hard look at the true cost of AI infrastructure versus its tangible benefits.

Second, monitor data center electricity consumption as a key physical constraint. The build-out during the AI boom was staggering, with projections that data centers could consume around 945 terawatt-hours globally by 2030. In reality, this expansion hit a wall. Projects worth billions of dollars in Ireland and across the U.S. and Europe are stranded because they cannot get connected to the grid. This isn't just a supply-chain issue; it's a fundamental limit on compute power. When the bubble bursts, these stranded assets will become a visible, costly reminder of the unsustainable energy demands of the AI hype, directly impacting the viability of AI-dependent security tools.

Third, track the shift in cybersecurity budgets. The post-burst landscape demands a recalibration from speculative AI tools to foundational resilience. Evidence shows this is already happening, as firms and governments move toward a greater focus on digital resilience and investments in diversified infrastructure. The winners will be those whose solutions work when the AI hype stops. Investors should watch for a clear pivot in spending: away from AI-powered threat detection that requires constant, expensive compute, and toward reliable, non-AI-dependent solutions that defend against persistent threats like phishing and deepfakes. This budget shift is the most direct signal that the market is accepting the new S-curve.

The bottom line is that the next inflection will be driven by these tangible, forward-looking metrics. The speed of adoption slowdown will confirm the bubble's unwind. Data center power constraints will make the economic reality undeniable. And a budget shift toward resilience will show where durable value is being created. These are the signals that will determine if the cybersecurity infrastructure thesis plays out.