Seth Boro, a managing partner at Thoma Bravo, went on record warning that the rapid expansion of artificial intelligence demands strong cybersecurity measures — to preserve trust and prevent malicious exploitation. That sentence contains four nouns, one obligation, and almost no information.
A statement carries information only when it excludes something. 'AI growth requires stronger security' excludes nothing. No rational actor has ever publicly argued for weaker security. No procurement committee has ever been fired for endorsing it. The threat actor is unspecified. The attack surface is unspecified. The deployment scenario is unspecified. There is no number, no product name, no policy proposal, no time horizon, no priority ranking. By the standards I apply to any contract I review before signing it, this is not a disclosure. It is a press release with a threat model painted on the side.
I read it twice anyway. Not for the sentence. For the byline.
Thoma Bravo is not a research institute and Boro is not an analyst. He is a managing partner at the largest private equity holder of cybersecurity software assets on the planet, and the firm's holdings sit precisely inside the budget line his warning would expand. When a person with that balance sheet says the category is becoming more dangerous, the correct first question is not 'is it true.' It is 'who pays, and for what.'
The second thing I noticed is a semantic hole wide enough to drive a fund through. The phrase 'malicious exploitation' works in two directions, and they are not the same business. It can mean attackers exploiting AI capabilities to attack faster and cheaper. It can mean attackers exploiting vulnerabilities inside AI systems. Those two readings imply different technology stacks, different buyers, different budget owners, different investable assets, and different defensible moats. The source material does not distinguish between them. Every downstream conclusion you draw from it depends on which reading you silently picked.
That ambiguity is the article. Everything else is context.
In 2017 I spent three months reading the Zeppelin ERC20 implementation line by line as a cryptography PhD student in Beijing and found three integer overflow vulnerabilities before public release. I sent patch proposals to the repository; they were merged into v2.0. That work installed a discipline I have never dropped: the value of a security claim is not in its urgency, it is in its specificity. A warning without a threat model is a marketing asset. A warning with a threat model is a purchase order. Boro delivered the first and let the market hear the second.
So let me do the work the piece did not do. Separate the threat models. Locate the budget. Identify who benefits from each interpretation. Then tell you what I would actually watch with capital at risk — which, structurally, I have.
The portfolio is the argument
Start with the holdings, because the holdings are the thesis. Thoma Bravo's cybersecurity complex, as I carry it in my notes and as you should verify against primary filings before trading on any of it, includes SailPoint taken private around $6.9 billion in 2022 and returned to public markets in early 2025; Proofpoint at roughly $12.3 billion in 2021; Ping Identity at about $2.8 billion in 2022, subsequently merged with ForgeRock at roughly $2.3 billion in 2023; Darktrace announced at approximately $5.3 billion in 2024; Barracuda acquired from Francisco Partners in 2022; Sophos at around $3.9 billion in 2020; LogRhythm in 2018. On the exit side, Venafi went to CyberArk for roughly $1.54 billion in 2024, and Blue Coat went to Symantec back in 2016. Fund XIV closed in 2022 at $22.8 billion, at the time the largest technology buyout vehicle ever raised. Treat every one of those numbers as a memory value requiring a primary-source check, not a citation.
The standardized playbook is not mysterious. Buy an asset with decelerating growth but high customer stickiness and mission-critical placement. Raise price. Cross-sell adjacent modules into the installed base. Cut redundant cost. Integrate into a platform. Exit through an IPO or a secondary sale. Four levers, applied in sequence, with a five-to-seven year horizon.
Now map the AI risk narrative onto those levers. It supports two of them directly and unconditionally. Rising category risk justifies price increases, because the buyer's alternative to paying more is being the case study. And it justifies the integration story, because 'you cannot manage AI risk across eleven point vendors' is the single most persuasive sentence a platform seller can say to a CISO in 2026. The narrative is not decoration on the business model. It is an input to two of the four levers.
There is a structural mismatch worth naming, because most coverage misses it. AI-native security companies are early-stage, high-growth, negative gross margin, and iterating faster than any diligence process can track. That profile does not fit a leveraged buyout model, which requires predictable cash flows and a debt package. So the realistic Thoma Bravo trade is not 'buy AI security technology.' It is 'buy traditional security assets whose multiples got compressed by the AI narrative while their customer bases stayed intact, then re-rate them by attaching AI capability as a premium module.' The AI security story, for a firm like this, functions as a valuation lever far more than a technology bet.
Timing reinforces the read. Fund XIV closed in 2022. The 2024-2025 window is a fundraising and exit cycle. A managing partner publicly amplifying category risk during a fundraising and exit window has a positive effect on two things simultaneously: LP appetite for the next vehicle, and the pricing of assets being readied for sale. That is not a conspiracy. It is what the job is. But you should price the statement as a capital-markets event, not a threat assessment.
The demand backdrop makes the story easy to tell. Gartner's late-2024 forecast for worldwide security and risk management end-user spending in 2025 was roughly $212 billion, growing about 15 percent year over year — again, memory value, verify it. Security is one of the very few software subcategories that grows through an economic downturn, because the alternative to spending is an incident, and incidents are not deferrable. A category with rigid demand and a fresh existential justification is exactly the category a levered owner wants to be holding when it goes to market.
What the article declined to mention is the capability gap. Thoma Bravo's portfolio companies — Sophos, Proofpoint, Ping, Barracuda — compete against CrowdStrike and Palo Alto Networks on detection engineering, and on pure model capability they are behind. Their advantage is installed base, procurement relationships, certification coverage, and price elasticity. That is a real advantage. It is not the advantage the narrative implies.
Two threat models, two budgets, one word
Here is where the ambiguity becomes expensive. Take the defensive reading first: attackers exploiting vulnerabilities inside AI systems. The dominant technical problem in that space is prompt injection, which has held the top position in the OWASP LLM application risk list for as long as the list has existed. The reason it persists is architectural, not negligent. Any system that connects a language model to external data sources or callable tools — which is to say nearly every production agent — cannot reliably separate instructions from data at the token level. There is no general fix. There are mitigations, filters, and architectural constraints, and every one of them is probabilistic.
Layer agentic execution on top and the failure mode changes character. When a model holds execution permissions — sends mail, calls APIs, writes to a database, initiates a payment — a single successful injection escalates from 'produced incorrect text' to 'executed an incorrect action.' That is excessive agency, and it is the fastest-growing exposure in enterprise AI deployment right now, because capability is shipping faster than permission governance. Most organizations I have looked at have no least-privilege design for their agents at all. They gave the agent the service account because it was Tuesday and the demo needed to work.
Then there is the model supply chain, which is the part that should keep compliance officers awake. Open weights are unverifiable. Data provenance is frequently undocumented. Nobody can audit a third party's RLHF quality, red-team coverage, or refusal-rate distribution. When I built the zkML verification layer for NexusChain, the hard problem was never proving that an inference had been computed correctly. The hard problem was proving that the proof corresponded to the model the customer believed they were running. Verifiable inference is solvable. Verifiable model identity across a supply chain is a governance problem dressed as a cryptography problem, and the industry has no standard for it. Which means the article's stated goal — 'maintain trust' — has no delivery mechanism. Trust is not a metric. Detection rate, mean time to detect, mean time to respond, false negative rate on a defined corpus: those are metrics. Trust is what you say when you have not defined the metrics.
The offensive reading is different and, commercially, faster. Attackers using AI to attack. The earliest and highest-return application is not autonomous exploitation. It is social engineering at scale: localized phishing that reads like it was written by someone who knows the target, voice cloning, video impersonation. There is a public case from 2024 involving a roughly $25 million loss at an engineering firm's Hong Kong operation, executed through a video conference of synthesized executives. No technical vulnerability was exploited. Every technical control in the stack was bypassed. The attack went straight at the human authorization process, and it worked because the process had a single point of trust.
Now put the two readings side by side and notice what happens to the investment conclusion. Defending AI systems is a research-stage problem with rigid budget and no reliable solution. Attacking with AI is a mature, cheap, immediately deployable capability that defeats controls you have already paid for. They are not the same market. They do not have the same buyers. And the second one is where the money moves first, because the losses are already happening and the first one's losses are still mostly hypothetical.
The asymmetry is the trade
What actually characterizes this moment is not that AI is risky. It is that the attack cost curve is falling faster than the defense efficiency curve is rising. That produces a rare structural condition: security spending grows faster than security outcomes improve. Budgets expand while customer-perceived effectiveness declines. When those two lines diverge, the arbitrage accrues to whoever can sell compliance and consolidation rather than demonstrated capability — which is precisely the PE integrator's product.
The defense-side bottleneck is people, not tooling. The SOC analyst shortage has been quoted in the millions for years and has not closed. Which means the highest-ROI, most easily verified application of AI in security is not detecting novel attacks. It is triaging, deduplicating, and prioritizing the alert queue. 'AI for Security' is commercializing at a completely different speed than 'Security for AI.' The source material collapses them into one phrase. That collapse is the largest information gap in it, and it inverts the conclusion: the near-term revenue is in labor substitution inside the SOC, not in protecting models from adversaries.
Here is the insight I would put capital behind. There is no unified 'AI security market.' There are four existing markets that have been relabeled, and the relabeling is the entire commercial event. The budget lands in at least four places: the CISO's information security line, the data office for governance and classification, a newly created AI governance function or legal for compliance, and engineering for model lifecycle. Four owners means four procurement cycles, four sets of evaluation criteria, and no single check writer. For a startup that is fatal — long pilots, custom scoping, no repeatable motion. For a platform it is a gift, because bundling solves the coordination problem the buyer cannot solve internally. For a PE integrator it is the ideal condition, because repackaging existing SKUs with a premium AI module requires no new technology, only a new line on the rate card.
Then there is the transmission mechanism almost nobody models: insurance. Cyber underwriters adjust exclusions and rates faster than any regulator on earth. A single renewal cycle can change corporate behavior more than three years of rulemaking, because a CFO responds to a premium quote in weeks and to a regulatory comment period in years. If AI-related incidents start appearing in exclusion clauses with named carve-outs, enterprise behavior shifts before any compliance deadline. Watch the policy language, not the statute.
Statutes are moving anyway, and in opposite directions. The EU AI Act's general-purpose AI obligations take effect in August 2025. DORA, the digital operational resilience regime for financial entities, applies from January 2025. NIS2 is being transposed across member states. China runs a filing regime for models plus algorithm filing plus data export controls. The United States federal posture shifted visibly toward deregulation and industrial self-direction in early 2025. That is divergence, not convergence. A multinational running one agentic system across three jurisdictions faces three incompatible evidentiary regimes, and the compliance cost of that fragmentation is itself a material risk that no vendor sells against because no vendor can own it.
Compliance-driven procurement has a signature worth memorizing: price-insensitive, auditability-sensitive, and biased toward incumbents. The buyer is not asking which product detects better. The buyer is asking which vendor can produce the artifacts. Certifications, audit trails, FedRAMP packages, documented change control, named accountability. A twelve-person AI-native company with genuinely superior detection loses that deal to a slower incumbent holding a completed audit package. This is the structural reason the PE model works in security even when the technology is inferior, and it is the reason the AI narrative is worth more to the incumbent than to the innovator.
On the competitive map, five camps matter. Platform giants — Microsoft, Palo Alto, CrowdStrike, Fortinet — bundle, run telemetry flywheels, and ship AI security modules as platform features. Microsoft's E5 construct gives it near-zero marginal customer acquisition cost inside accounts that already pay for productivity software, and that is the single largest threat to every independent security vendor alive, including the PE-held ones. AI-native specialists — Lakera, Protect AI, HiddenLayer, Prompt Security and their cohort — hold technical sharpness and the power to define new scenarios, but carry low contract values, thin channel, and structural absorbability. PE integrators hold installed base, compliance, and pricing power, and their weapon is scale rather than model capability. Cloud providers ship default-on baselines for AI services but cannot credibly span multi-cloud. Consultancies and audit firms hold standards interpretation without implementation capability.
Whoever defines the evaluation criteria and the procurement checklist captures the budget. Definition power is the most valuable asset in this category right now, and public narrative is the cheapest instrument for acquiring it. A managing partner's sentence costs nothing and moves the definition. That is the trade being executed in the article you just read.
The narrative is the product
Retail reads the headline and concludes: AI is dangerous, security budgets rise, buy security. Smart money reads the same headline and asks a different question: which balance sheet needed this sentence to exist this week, and what does the sentence cost to produce?
Darktrace is the test case, and I would watch it more closely than anything else in the complex. It was the flagship 'AI-driven security' asset, taken private at roughly $5.3 billion. If its detection capability is genuinely portable and integrable across a portfolio of slower assets, the model replicates and every PE-held security company earns an AI premium at exit. If it is not — if the models are entangled with a specific telemetry pipeline and a specific customer data distribution — then the premium is a multiple arbitrage that decays the moment diligence gets technical. Watch the integration engineering, not the press release. This is the same discipline I applied in 2024 when I structured a box spread between spot bitcoin ETFs and the trust vehicle, locking roughly 1.2 percent on $5 million because the inefficiency was structural rather than directional. The trade was never 'bitcoin goes up.' The trade was the spread between what the wrapper implied and what the underlying could deliver. That spread is measurable here too, and it is currently wide.
Here is the contrarian angle in one line: the warning is not a threat assessment addressed to buyers, it is a category-definition bid addressed to allocators. Boro is competing with Microsoft and with the AI-native cohort for the right to say what 'AI security' means, because whoever says what it means decides whose products appear on the checklist. A firm holding seven security assets needs that checklist to include auditability, integration, and compliance — the three criteria its portfolio wins on — and to exclude raw detection benchmarks, which it loses on. Every public risk statement is a small contribution to criteria design.
The gap is observable. Thoma Bravo has almost no self-built AI-native security capability. Its AI story is acquired, not developed, and acquisitions of that kind carry integration risk that does not appear in the narrative. I have watched this movie in crypto since 2017: the announcement is priced in days, the integration is priced in years, and the two prices are set by different people. Structure survives where sentiment collapses, and the structure here is a portfolio of maintenance-heavy software assets with a new module attached.
The word 'trust' deserves one more pass, because it is the tell. Security vendors sell risk reduction, denominated in service levels, detection rates, and time-to-response. They do not sell trust. Trust cannot be placed in a contract, cannot be measured at renewal, and cannot be breached in a way that triggers a remedy. Choosing 'trust' as the object of the sentence places the statement in a marketing register rather than an engineering one, and the register tells you what kind of document you are reading.
The second-order risk nobody is pricing is the AI-ification of defense itself. Put models in the detection path and you introduce a new attack surface: adversarial inputs crafted against the detector, automated generation of alert floods to induce triage fatigue and force the model into a degraded mode, poisoning of the telemetry the detector learns from. The higher the defender's automation, the larger the blast radius of a single point of failure. A security operations center with two hundred analysts degrades gracefully under stress. A center with one model and six humans fails catastrophically. That correlated failure mode appears in no vendor deck and in no risk model I have seen, and it will be the post-mortem headline of the next major breach.
Liability attribution is the sleeper issue. When an agent moves money incorrectly, or discloses data it should not have, the question of whether the model provider, the deployer, or the systems integrator carries the loss determines the pricing of cyber liability cover and the indemnity architecture of every enterprise AI contract. That question is unresolved, and it is more consequential to the next twelve months of enterprise deployment than any general warning about risk. The article says nothing about it, which is unsurprising, because liability ambiguity is good for incumbents and bad for the narrative's clarity.
One more structural shift worth naming: skill polarization inside the security workforce. The roles being displaced are tier-one triage positions — low skill, high turnover, easy to automate. The roles being created are AI red teaming, model supply chain assurance, and AI compliance audit — high skill, thin supply, high wage. Net headcount in the function may fall while the median wage rises. That is not a replacement story, it is a wage-structure story, and it has a direct procurement consequence: vendors that reduce headcount per alert survive the budget review, and vendors that add headcount per alert get cut regardless of detection quality. When I built the delta-neutral structure on Uniswap V2 in 2020 while everyone around me chased yield, the lesson was identical — the return came from the part of the system that could be measured, not the part that could be narrated. Liquidity dries up; logic remains solvent.
What I actually watch
I do not trade headlines. I trade the observables that would have to move if a thesis were true. Here is the short list, and every item on it is a hard number rather than a sentiment.
SailPoint's post-IPO secondary pricing and lockup behavior. A PE-integrated identity asset returning to public markets is the cleanest available read on whether the buy-and-build exit window is genuinely open. If the aftermarket absorbs the paper at a premium to the take-private basis, the model is funded for another cycle. If it trades flat into the lockup expiry, every other asset in the complex gets marked down quietly.
Sophos plus Secureworks retention and average revenue per user. This is the only hard metric that validates the claim that integration creates value rather than merely extracting it. The announced acquisition was around $859 million, completed in early 2025. If retention holds and ARPU rises, integration is real. If ARPU rises while retention slips, you are watching price extraction ahead of churn, which is the classic late-stage exit signature and the thing I would short first.
Renewal rates of PE-held security assets against Microsoft bundling. This shows up in renewal data roughly four quarters before it shows up in any fund's marks, which means it is the earliest honest signal available to an outsider.
Cyber insurance exclusion language for AI-related incidents. This is the fastest transmission mechanism in the entire system. It moves in one renewal cycle, it changes enterprise behavior immediately, and almost nobody models it. If carve-outs start naming agentic systems explicitly, the procurement conversation changes before any regulator writes a word.
The size and target return of Thoma Bravo's next vehicle. That number is the honest measure of how much narrative intensity the firm requires, and narrative intensity is a proxy for how aggressively the portfolio will be repriced.
The forward question is not whether AI creates security risk. It does, in specific and technical ways I have laid out, and the specific ways matter more than the general claim. The forward question is this: if the definition of 'AI security' is being written by the people who own the assets rather than the people who build the systems, what exactly is the buyer purchasing — a capability, or a category label with a compliance wrapper around it? We do not predict the wave; we engineer the board. The board here is a procurement checklist, and it is being drafted in public, by people with a position. Audit trails are the only true alpha in chaos, and the trail on this statement leads to a balance sheet, not a threat model. The ledger remembers what the market forgets.
