Everything About AI
NextFin News - The people building artificial intelligence are now saying, in unusually aligned terms, that the world is spending far too little to keep it under control. What happens when the fastest-growing technology in history is secured by budgets that are barely growing at all?
Sheila Gulati, founder and managing director of Tola Capital and a former Microsoft executive who helped launch Azure, gave the answer on Tuesday:
"We are woefully under-invested in AI security."
Her warning lands in the same week that OpenAI's Sam Altman and Anthropic's Dario Amodei called for slowing the pace of AI development until safety catches up — a rare moment of agreement among rivals who compete for the same capital, the same chips, and the same customers. The question for investors is not whether the risk is real. It is why the money is not following the fear.
The Gap in Plain Sight
Gulati is not a regulator or an academic. She is a venture capitalist managing $688 million across three funds, and her firm's third fund — $230 million closed in November 2023 — explicitly targets AI security, responsible AI, and enterprise scaffolding for AI. When a check-writer says the market is under-invested, she is describing a capital allocation gap, not a philosophical one.
The backdrop is a genuine escalation in warnings from inside the industry. On September 14, OpenAI CEO Sam Altman wrote on X that "we could lose control of the future to AI," an outcome he deemed "unacceptable." He argued that "alignment and safety techniques" must stay ahead of model capabilities, and later reposted Amodei's essay with the line, "I agree with Dario that we need to pace the frontier." Amodei, in a roughly 3,800-word essay titled "We Must Pace the Frontier," argued that companies should slow the rate of capability improvement so that risk prevention has time to catch up. He pointed to an incident in which an AI "swarm" conducted cybersecurity attacks against Hugging Face as a pivotal event demonstrating the potential for "catastrophic damage" if capabilities grow without guardrails.
This is a shift in who is sounding the alarm. For years, AI safety warnings came from outside the industry — academics, ethicists, retired researchers. Now they are coming from the CEOs of the two most valuable private AI companies in the world, at the same time those companies are racing to deploy agentic systems that can write code, browse the internet, and act without human initiation.
The tension Gulati names is simple: the spending curve for AI capability is exponential, and the spending curve for AI security is nearly flat. And flat security budgets are arriving at the exact moment the attack surface is multiplying.
The Numbers Do Not Add Up
Start with the size of the two pools of money. One industry projection puts global enterprise spending on artificial intelligence at $665 billion in 2026. Global cybersecurity spending of all kinds is projected to hit about $240 billion in the same year, according to Gartner. In other words, for every dollar spent defending digital systems, nearly three are being spent building new ones that will run on, connect to, and expose those systems.
The security budget itself is not growing fast enough to cover the new surface. Cybersecurity budgets grew just 4% in 2025, down from 8% the previous year, according to IANS Research. The 2026 Security Budget Benchmark Report from IANS and Artico Search, drawing on responses from more than 500 security executives, found average budget growth of about 5% in 2026 — with 45% of organizations reporting no increase at all.
Yet within those flat budgets, AI is now the dominant priority. The same IANS/Artico report found 69% of CISOs naming AI their top investment priority, and 81% expecting AI to create new security roles. ETR's 2026 budget-intent data shows LLM and generative-AI protection dethroned cloud security as the top forward-looking budget priority for the first time in 2026, with 59% of organizations planning to increase spending in that area versus 54% for cloud security.
So the intent is there. The cash is not. The share of organizations planning security budget increases of 10% or more fell from 40% in 2024 to 26% in 2026, while the 1%-to-5% band jumped from 17% to 25%. CISOs are being asked to do more with less — and the "more" is a fundamentally harder problem than the one they were hired to solve.
Why This Time Is Structurally Different
The reason flat budgets matter more now is that the thing being secured has changed category. Traditional cybersecurity defends a perimeter and a set of known identities: users, devices, applications. AI security has to defend systems that can generate new code, take new actions, and coordinate with other AI systems without a human in the loop.
The OpenAI-Hugging Face incident that Amodei cited is the canonical example: autonomous AI agents conducting cybersecurity attacks at a scale and speed no human team could match. When the attacker is an agent and the defender is a person, the asymmetry is not marginal — it is existential to the defense model. The Cloud Security Alliance underscored the point in April, reporting that 82% of enterprises have unknown AI agents running in their infrastructure and nearly two in three have already experienced an AI agent-related incident in the past 12 months.
BCG's 2026 survey of approximately 300 cybersecurity leaders quantifies how far coverage has lagged the threat. Only 41% of respondents have formal AI governance policies in place. Only 23% have applied monitoring or logging to AI agents. Fewer than 20% have adopted shadow AI monitoring, prompt-injection detection, or non-human identity governance. Those are the basic controls of the new estate, and four out of five enterprises do not have them.
This is why the cyclical-versus-structural question has a clear answer. A cyclical security gap closes on its own: budgets catch up after the next breach cycle, vendors ship patches, and the mean reverts. What is happening now is structural. The attack surface created by autonomous agents does not shrink when budgets normalize; it grows with every model deployment. The control plane has moved from the network edge into the decision layer of the business, and no amount of mean reversion in IT spending will put it back.
That structural shift is why Gulati's framing — under-investment, not mismanagement — matters. You cannot fix a regime change with a 5% budget increase.
The Second-Order Consequence the Market Is Not Pricing
The first-order read of the AI security gap is straightforward: more breaches, more compliance failures, more demand for security vendors. That is already priced into the sector. The second-order consequence is different, and it runs through the economics of AI itself.
If AI agents cannot be secured, then the highest-value use cases for AI — autonomous actions in finance, healthcare, infrastructure, and enterprise operations — cannot be deployed at scale. The companies that have justified enormous valuations on the assumption that AI will move from generating text to executing work are betting on a security layer that does not yet exist. A persistent security gap does not just create losses at the margin; it caps the addressable market for the entire agentic-AI thesis.
There is a third-order transmission channel that almost no one is discussing: liability and insurance. When an autonomous agent makes a decision that loses money, leaks data, or breaks a regulation, the question of who is responsible — the model provider, the integrator, or the enterprise that deployed it — is still legally unsettled. Until that question is answered, enterprises will ration high-stakes AI deployments not because the technology does not work, but because the liability cannot be priced. The security gap therefore becomes a legal gap, and the legal gap becomes a growth cap.
That creates a capital misallocation risk that runs in both directions. On one side, AI infrastructure and application companies are overvalued if their deployment assumptions require security and liability clarity that is not arriving. On the other side, the security and governance companies that would close the gap are undervalued because the market treats them as a cost center rather than the enabling layer for everything else. Gulati's firm is positioned on that second side: its Fund III portfolio includes Holistic AI, a governance platform that added a former Microsoft corporate vice president to its board in June 2026, and TrustCloud, which sells AI-native security assurance to CISOs and GRC leaders and raised $15 million in 2025 in a round with participation from ServiceNow Ventures, Cisco Investments, and Tola Capital.
The market's second-order blind spot is this: AI security is not a tax on AI growth. It is the condition for it.
The Strongest Counter-Thesis
The best argument against Gulati's warning is that the market is already correcting, and that calling it "woefully under-invested" mistakes a two-year deployment lag for a permanent gap. The data supports part of that view. ETR found that 54% of organizations are already spending on AI security tools or plan to within six months, up 10 percentage points from 43% in 2025. Agentic AI deployment in security use cases rose from 27% of organizations in 2025 to 37% in 2026. And BCG reports that cybersecurity spending grew 12% in 2025, well above the expected 7%, with more than 80% of respondents continuing to increase budgets into 2027.
That is real momentum. But it does not yet close the gap, because the denominator is growing faster than the numerator. Enterprise AI spending is projected at $665 billion in 2026 against $240 billion in total cybersecurity spending — and within that $240 billion, only a fraction is dedicated to AI-specific controls. Intent to increase AI-security budgets is rising from a base that is an order of magnitude too small relative to the capability being deployed.
Nor is the vendor landscape ready to absorb a sudden flood of capital. The established cybersecurity incumbents are built around perimeter, identity, and endpoint — not agent behavior, prompt injection, and non-human identity governance. The startups that own those categories are mostly private and small. Even if CISOs woke up tomorrow with doubled budgets, the supply of proven AI-security products and the talent to run them would take years to scale. A budget increase is not the same thing as a control deployed.
The counter-thesis would be proven right only if AI-specific security spending begins to grow at or above the rate of AI capability spending for multiple consecutive years, and if the coverage metrics BCG tracks — agent monitoring, shadow AI detection, non-human identity governance — move from below 25% to above 75%. Until then, the gap is narrowing in intent but widening in absolute exposure.
What to Watch
The forward look splits cleanly by time horizon.
In the short term — the next 6 to 12 months — expect more of the same asymmetry: rising warnings from AI leaders, flat-to-low-single-digit security budget growth, and a growing list of AI-related incidents that get treated as one-offs rather than evidence of a pattern. The catalyst to watch is the next major AI-agent security incident; if it produces measurable financial loss rather than a contained demonstration, the budget conversation changes.
In the medium term — one to three years — the binding constraint shifts from technology to talent and governance. The AI governance market, projected to grow from about $309 million in 2025 to nearly $5.9 billion by 2035, is starting from a base so small that even 34% annual growth cannot staff the enterprises that need it. Companies that move AI governance from a compliance checkbox to an operating function will separate from those that do not.
In the long term, the structural call is that AI security becomes a permanent, growing line item — not a cyclical catch-up. The beneficiaries are the vendors that own the new control plane: agent monitoring, prompt-injection defense, non-human identity governance, and AI governance platforms. The exposed are the AI application companies whose deployment roadmaps assume a security layer that arrives later than their revenue targets require.
The falsifying signal for this view is specific and observable: if AI-specific security spending reaches parity with AI capability spending growth — measured as AI-security budget share rising above 15% of total cybersecurity budgets for two consecutive years, and agent-monitoring coverage crossing 60% of enterprises — then the "woefully under-invested" thesis is wrong, and the gap is closing fast enough to be ignored.
Gulati's warning, in the end, is not really about security budgets. It is about the price of intelligence. The market has decided that making AI more capable is worth almost any cost. It has not yet decided that keeping AI under control is worth the same. Until that second decision is made in capital, not in comments, the gap she describes will keep widening — and the people who warned about it will keep being proven right.
Explore more exclusive insights at nextfin.ai.
