Mythos Didn't Start an Arms Race. It Started a Sales Cycle.

Everyone agrees that AI is reshaping cybersecurity. The story runs like this: attackers use AI to break in faster, defenders use AI to catch them, and the cycle accelerates. Bad AI meets good AI. It sounds like a movie and it sounds true.

The problem is that the arms-race frame tells you almost nothing about whether cybersecurity stocks deserve the valuations they command. It's a narrative about balance. What's actually happening is a story about fear.

Here's the thing nobody frames as the central point. In April 2026, Anthropic quietly tested a model it called Mythos — powerful enough that the company decided not to release it publicly. Mythos could find zero-day vulnerabilities in every major operating system and browser, thousands of them. It could exploit them. The gap between what the model could do and what any other AI system could do was large enough that Anthropic called it a qualitative leap.

Instead of shipping Mythos, Anthropic partnered with CrowdStrike, Palo Alto Networks, Apple, Google, Microsoft, Cisco, and others in an initiative called Project Glasswing. The idea was to let defenders use Mythos's power to scan and fix vulnerabilities before attackers could find them. Anthropic committed up to $100 million in usage credits.

The headline outcome was that CrowdStrike and Palo Alto reported their best quarters in company history. Between April and June 2026, CrowdStrike's stock rallied 95 percent and Palo Alto's rallied 113 percent. Palo Alto's CEO Nikesh Arora said more than 1,200 customers reached out to discuss cybersecurity after Mythos emerged. CrowdStrike's CEO George Kurtz called it an inflection point.

That sounds like the arms-race narrative being confirmed. But look closer at what actually changed.

AI hasn't meaningfully improved attack quality. Researchers at Symantec and Carbon Black found that agentic AI affects the quantity of attacks more than the quality. Attackers use large language models to write better phishing emails and generate code, but the fundamental mechanics of a breach haven't shifted. The barrier to entry has lowered, which means more noise, not smarter craft.

On the defender side, AI is helping with repetitive tasks — alert triage, report writing, the kind of work that scales headcount without hiring headcount. CrowdStrike's own blog describes AI as an analyst force-multiplier. Useful. Not revolutionary.

So what moved the needle for CrowdStrike and Palo Alto wasn't a fundamental change in the security balance. It was Mythos as a proof-of-concept that the balance could change. The model didn't actually exist in attackers' hands. It was a demonstration that showed CISOs what might happen if it did.

That's the distinction the arms-race frame erases. It collapses a fear signal into a structural reality. The cybersecurity companies that benefited most were the ones that already had installed bases large enough to convert an anxiety spike into expanded contracts. Palo Alto's next-generation security ARR grew 33 percent year over year to $6.3 billion. CrowdStrike's annual recurring revenue reached $5.25 billion for fiscal 2026, with net new ARR of $330.7 million in Q4 alone, up 47 percent.

These numbers are impressive. They're also the kind of growth that platform consolidators achieve when they convince customers that the stakes just went up. The Mythos moment didn't change the underlying economics of cybersecurity. It accelerated a consolidation cycle that was already underway.

Here's the tension that makes this worth thinking about. ISG research from June 2026 found that enterprise cybersecurity budgets grew by an average of 5 percent from 2025 to 2026. Five percent. Meanwhile, 58 percent of respondents said their current AI cybersecurity budgets are insufficient, and 65 percent are only moderately confident in the security of AI. The fear is widespread. The spending response is modest.

When spending grows 5 percent after a watershed security event, the market is telling you something. Either the fear will translate into larger budgets later — which would justify the growth the top vendors just posted — or the Mythos moment was a one-time acceleration of existing demand, and the growth rate will normalize when the fear fades.

The Zscaler earnings miss in May 2026 is a useful data point here. Zscaler's stock fell 24 percent after weaker guidance, and the selloff dragged Palo Alto down 4.2 percent and CrowdStrike 3.3 percent, even though neither had reported results. Wedbush called the selloff a misunderstanding, arguing the shortfall was company-specific. But the market reaction itself is information. When one vendor misses and the whole sector sells off, investors are treating cybersecurity growth as a shared assumption rather than a company-by-company story.

That works in the vendors' favor when the assumption holds. It makes the correction sharper when it doesn't.

I suspect the real question isn't whether AI changes cybersecurity — it does, incrementally. The real question is whether the top two vendors have priced in a permanent step-up in growth that's actually a fear-driven acceleration of a longer consolidation trend.

Palo Alto and CrowdStrike are well-run companies with strong products. But the market is rewarding them for being the right companies to own when a scary model proves how scary the next one could be. That's not a business model. It's a recurring revenue model that happens to coincide with a recurring fear cycle.

The way to test whether the current growth is structural or cyclical is straightforward. Watch what happens to net new ARR growth when the Mythos story moves from breaking news to background noise. If the 47 percent net new ARR acceleration at CrowdStrike and the 33 percent next-gen ARR growth at Palo Alto hold for two quarters without a new catalyst, the growth is probably durable. If it slows to the mid-teens — which would still be impressive by historical standards — then you're looking at a one-time fear premium baked into valuations that assumed it would last.

Most cybersecurity investing boils down to timing the fear cycle. The trick is knowing whether the fear you're paying for is the kind that changes behavior or the kind that just changes headlines.