Add up the security software Thoma Bravo has taken private since 2020 and the figure lands north of $30 billion: SailPoint at roughly $6.9 billion, Proofpoint at $12.3 billion, Ping Identity at $2.8 billion merged with ForgeRock at $2.3 billion, Darktrace at $5.3 billion, Sophos at $3.9 billion. So when Seth Boro, a Managing Partner at the largest software private equity firm on earth, warns that AI's rapid growth demands stronger cybersecurity to preserve trust and prevent malicious exploitation, I do not read it as a threat advisory. I read it as a pricing memo.
Boro is almost certainly right that the risk is real. That is what makes the statement so effective. But "prevent malicious exploitation" carries two entirely different meanings โ attackers weaponizing AI, or attackers compromising AI โ and the ambiguity is doing an enormous amount of commercial work. Those two readings have different threat models, different budgets, different buyers, and different investable assets. One of them is a hard engineering problem. The other is a marketing category.
Thoma Bravo's playbook is not mysterious, and it is not new. Buy a security asset with sticky customers and decelerating growth, raise prices, cross-sell, strip cost, integrate it into a platform, then exit through an IPO or a secondary sale. The narrative that AI risk is rising supports precisely two links in that chain: the price increase and the necessity of consolidation. Neither requires a single line of new code.
The hard evidence is not theoretical. Sophos, which Thoma Bravo owns, closed its roughly $859 million acquisition of Secureworks in early 2025. SailPoint returned to public markets in the same window. Venafi went to CyberArk for about $1.54 billion in 2024. Meanwhile Gartner put 2025 worldwide security and risk management spending near $212 billion, growing around 15 percent โ well ahead of total IT spending. Security is one of the few software categories that grows through a downturn.
Fund XIV closed in 2022 at $22.8 billion, then the largest technology buyout vehicle ever raised. That puts the firm squarely inside a fundraising and exit cycle right now. A managing partner amplifying an industry risk narrative during that window has a measurable effect on LP appetite and on exit pricing. That is not a conspiracy. It is the job description.
For crypto readers this is not a spectator sport. AI agents already hold keys, execute swaps, and manage DAO treasuries, and every one of them inherits the same two exposures โ a model that cannot separate instruction from data, and an operator who has not set a spending limit. The security budget debate in traditional finance and the key management debate on-chain are the same argument wearing different clothes. When the largest software buyout firm in the world starts pricing that argument, the pricing eventually reaches us.
Let us do the technical work the statement left undone. Reading one: attackers using AI. The fastest deployment is social engineering โ localized phishing, cloned voice, generated exploit code. In the Hong Kong engineering firm case, roughly $25 million moved in a single wire after a deepfake video call. No vulnerability was exploited. No malware was installed. The barrier to entry is now measured in hours and dollars.
Reading two: AI as the target. Here the bottleneck is architectural rather than operational. Prompt injection remains unsolved in the general case. Any system that pipes external data into a model which also holds tools has instruction and data sharing the same channel, and OWASP has kept it at the top of its LLM application risk list for years โ not because nobody is trying, but because no general fix is known.
Both readings are true, which is why the ambiguity survives. Attackers are using AI, and AI systems are being attacked, and the two trends reinforce each other because the same models that generate convincing phishing also generate convincing patches. But they route to different purchase orders. Defending the model is a platform decision, made by a CTO and budgeted once. Defending against AI-assisted attacks is a subscription, renewed annually, sold to a CISO who is measured on incident count. Only one of those renews.
I spent the DeFi summer of 2020 auditing flash loan modules, and reentrancy is the closest analogue I know. The bug was never that developers were careless. It was that the EVM let a call re-enter state before the first call finished writing it, and you cannot patch a language with discipline. Prompt injection has the same shape: the architecture refuses to separate what should be separated. Code is law, but humans are the protocol โ and right now the protocol has no validator.
Then add agency. When a model can send mail, call APIs, touch a database, and initiate payments, a single injection stops being an embarrassing output and becomes an executed action. Excessive agency is the fastest-growing exposure in enterprise AI today, and almost no organization has done the permission minimization that smart contracts forced on us years ago โ allowance limits, time locks, multi-sig thresholds, spending caps. An on-chain agent holding keys without those controls is a reentrancy bug with a wallet.
The budget question is where the commercial analysis gets interesting. AI security does not sit in one line item. It can land under the CISO, the data officer, legal compliance, or the CTO's model engineering group. Fragmented budget means there is no unified AI security market โ there are several existing markets being relabeled: data loss prevention, identity and access management, data classification, model observability, red teaming.
Which explains a distinction the original remarks never made. AI for security โ using models to triage alerts and cut SOC noise โ monetizes today, because the analyst shortage is real and the return is measurable within a quarter. Security for AI โ defending the models themselves โ is where the anxiety lives and where the deliverables are weakest. Detection and visibility sell. Blocking and guaranteeing do not yet exist.
Compliance is the other engine, and it is the one private equity is genuinely good at. EU AI Act obligations for general-purpose models phase in from August 2025. DORA applies to financial entities from January 2025. NIS2 is still transposing across member states. Compliance buyers are price-insensitive and auditability-sensitive. That is a portfolio of assets with existing auditor relationships and published price lists โ not a research lab.
Follow the money one layer deeper and you find a price-setter the commentary never mentions: cyber insurers. Underwriters adjust exclusions and premiums faster than regulators write rules, and a single clause excluding AI-mediated fraud changes enterprise behavior more efficiently than any directive. The data problem is that we still lack credible loss distributions for AI-related incidents. We have vivid anecdotes โ the deepfake wire, the injected support bot, the poisoned dependency โ and almost no actuarial base. Underwriting on anecdotes means pricing on fear, which is precisely the environment in which a security narrative appreciates fastest.
There is one place where the industry already has practice: crypto's audit culture. Since 2016 we have treated adversarial review as a line item, not a launch-day afterthought, and firms publish findings because the market punishes silence more than it punishes disclosure. AI security has no equivalent norm yet. Model cards are marketing. Red-team reports stay in the drawer. The organizations that will come out of this cycle strongest are the ones that borrow the smart contract habit โ publish the threat model, name the auditor, date the review, and let the market price the gap.
Here is where I part company with the consensus reading. Everyone is treating AI security as an emerging market. I think it is largely a relabeling exercise, and I have watched this film before. Liquidity fragmentation was never a real problem in DeFi โ it was a narrative venture capital needed to justify the next generation of aggregators. AI security is running the same script with a larger budget line. The underlying spending is real. The category around it is being manufactured.
There is also a structural mismatch nobody wants to say out loud. AI-native security startups are early, high-growth, negative-margin, and iterate every eight weeks. That is the exact opposite of what a leveraged buyout wants. Thoma Bravo is not buying frontier model defense. It is buying traditional security assets whose valuations were hit by AI anxiety but whose customer bases are intact, then adding an AI module as a premium SKU. Darktrace is the test case: if its detection capability survives integration, the model replicates. If it does not, the premium was narrative.
And the word trust is doing something slippery. Security sells risk reduction โ SLAs, detection rates, mean time to detect, mean time to respond. Trust is not a deliverable. When a firm with a thirty-billion-dollar security portfolio says AI threatens trust, it is converting an engineering gap into a values claim, and values claims are unmeasurable, which is convenient.
The unspoken risk is that we AI the defense itself. Automated detection generates automated false positives. Defenders who trust models without review inherit model-shaped blind spots, and the blast radius of a single failure grows with every layer of automation. In 2026 I co-authored a Human-in-the-Loop standard for on-chain AI governance, later adopted by five DAOs covering millions of users. The lesson that survived was unglamorous: every algorithmic output needs a named human who can be wrong. Education is the antidote to exploitation โ not a certificate, not a compliance checkbox, but the habit of asking who benefits from a warning. From winter's cold, spring's structure emerges. Trust is earned in drops and lost in buckets, and one deepfake wire can empty the bucket. Hold through the noise. The question is not whether AI raises risk. It is who gets to define the risk โ and what they own.