Why Generative AI Will Increase Cybersecurity Spending

Our analysts Brian Nowak, Keith Weiss and Matt Bombassei break down the most important tech insights from Morgan Stanley’s Spark Private Company Conference and industry shifts that will likely shape 2026 and beyond. 

Read more insights from Morgan Stanley.

----- Transcript -----  

Brian Nowak: Welcome to Thoughts on the Market. I'm Brian Nowak, Morgan Stanley's Head of U.S. Internet Research. I'm joined today by Keith Weiss, Head of U.S. Software Research and Matt Bombassei from my team.

Today we're going to talk about private companies and technology – and how they're showing us the direction of travel for disruptive technologies and emerging investment opportunities.

It's Wednesday, October 22nd at 10am in New York.

Keith and Matt, we just returned from Morgan Stanley's Spark Private Company Conference last week in Los Angeles. It had over 85 private tech companies, 150 plus investor firms. There were a lot of themes that were discussed across the entire tech space impacting a lot of different sectors, including energy, healthcare, financial services, and cybersecurity.

Keith, what were some of the biggest takeaways you took away from Spark this year?

Keith Weiss: I'd say just to start off with, the Spark Conference is one of my favorite conferences of the year. It's a more intimate conference where you really get to spend time with both the private company executives and founders, as well as investors from the VC community and public company investors. And the conversations are more broad ranging; they're more about the thematics in the industry. They're more long term in nature.

So, it's not just a conversation about what's next quarter going to look like, or what data points are you drumming up. You're having these thoughtful conversations about what's going on in the industry and how that's going to impact business models, how it's going to impact innovation cycles, how it's going to impact pricing models, within these companies. So, it tends to be a very interesting conference for me to attend.

So, for me, some of the key takeaways. Typically, when we're in these innovation cycles, it feels like everybody's rowing in the same direction. We all understand where the technology's heading, we're all understanding how it's going to be delivered, and it's a race to get there. And you're having a conversation about who's doing best in that race, who's best positioned, who's got a better motor in their race car, if you will.

So, to me, one of the big takeaways was we don't have that agreement today, right? There's different players that are looking at this market evolution differently. On one side of the equation, the application vendors – and a lot of this debate is in SaaS based applications. They see SaaS based applications having a very big role in taking these models that are inherently in-determinative and making them to be more determinative and useful within an enterprise context.

Bringing them the data that they need to get the job done and the right data; bringing them the context of the business process being solved; bringing the governance that's necessary to use in an enterprise environment. But most importantly, to make it effective and efficient for the large enterprise.

On the other side of the equation, you have venture capital investors and more early-stage investors who are looking at this as a huge phase shift, right? This is going to fundamentally change how we build software, how we utilize software, and they worry about a deprecation of that SaaS application layer. They think the model itself is going to start to encompass, it's going to start to subsume a lot more of that application functionality, a lot more of that analytics. And they see a lot more disruption going forward.

So that debate within the marketplace, that's something that's interesting to me. It's something that we don't typically see in these innovation cycles. So that's takeaway number one.

Takeaway number two, we're still really early days, and that's a little bit implied in in the first statement; I definitely hear a lot of it when I talk to the end customer. When I talk to CIOs. This wasn't necessarily at Spark, but earlier in the week, I was at a CIO conference, there was 150 CIOs in the room. One of the gentlemen on stage asked a question. ‘Who in the room has a good understanding of what we're talking about when we mean Agentic AI, when we mean agentic computing within our enterprise.’ Of the 150 CIOs, four raised their hands. Still very early days in understanding how this is going to evolve, how we're going to actually deliver these capabilities into the enterprise.

And the last takeaway I would say is more excitement about the federal government becoming a better customer for software companies overall. People are more interested in new avenues into that federal government. There's been some very successful companies that have opened the door to getting into these federal government contracts without going through the primes, without doing the typical federal government procurement cycles.

And that's very interesting to the startup community, which tends to move faster, which tends to drive on innovation versus relationship building; versus being in an existing kind of incumbent prime. So, I thought that opening was – it was pretty interesting as well.

Brian Nowak: it sounds like it's still very early, there are a lot of different points of view and no real consensus as to where technologies could go next. However, one theme with an enterprise software – [it] does seem like cybersecurity has a little more of a unified view.

So maybe walk us through what you learned from a cybersecurity perspective and what should we be focused on there?

Keith Weiss: Yeah, absolutely. If there is a consensus, the consensus is that generative AI and these innovations and the fast pace of innovation is going to be a positive for cybersecurity spending, right? The reason being, there's three main factors that are driving that overall spending.

One is expansion of surface area, right? Cybersecurity in one dimension, you can think of how much is there to be protected, right? And if we think about the major themes that we're talking about, we're going to be developing a lot more software, right? The code generation tools are improving software developer productivity. You have an expanding capability of what you can actually automate.

We'll be building a lot more software. That software needs to be protected, right? We have new entities that are going to be operating inside of enterprises, and that's the agents. So, CIOs are thinking about this future state where you have tens, thousands, maybe hundreds of thousands of agents operating in the environment, doing work on behalf of end users, but having permissions and having ability to execute business processes. How do we secure that side of the equation? We're talking about outside of just the four walls of the large enterprise, going into more operational technologies, being able to automate more of that work. That needs to be secured as well.

So, an expanding surface area is definitely good for the cybersecurity budget. You can almost think of cybersecurity as a tax on that surface area. We generally think about it; somewhere between 4 and 6 percent of IT spend is going to be spent on overall security. So, that's one big driver.

The second big driver is the elevated threat environment. So, while we're excited to get our hands on these extended capabilities of generative AI, the bad guys are already there, right? They're taking advantage of this. The sophistication, the volume and the velocity of these attacks is all increasing. That makes a harder job for the existing infrastructure to keep up, and it's going to likely necessitate more spending on cybersecurity to tackle these newer challenges; the newer dynamism within the cybersecurity threat appropriately. So, you're going to have to use generative AI to counter the generative AI.

And then the last component of it; the last driver would be the regulatory environment. Regulatory tends to have some cybersecurity angles. If we think about it here, we're seeing it in terms of data governance is probably the big one. Where does this data go when it goes into the model? Are we putting the right controls around it? Do we have the right governance on it? So that's a big area of concern.

A lot of complaining going on at the conference about the lack of consistency in that regulatory environment. All these different initiatives coming up from the state – really creates a challenging environment to navigate. But that's all good-ness for cybersecurity vendors that can help you get into compliance with these new regulations that are coming up. So overall, a lot of positivity around cybersecurity spending and startups definitely look to take advantage of that.

Brian Nowak: Matt, so Keith says there's lack of consensus and boats being rode in every direction on what should be adopted first. And only 3 percent of CIOs know what agentic AI means. What did you learn about early signal on adoption? And some of the barriers to adoption? And hurdles that companies are talking about that they need to overcome to really adopt some of these new tools?

Matt Bombassei: Yeah. Well, to Keith's point, it is really early, right? And that was a consistent theme that we heard from our companies at the conference. They are seeing early signs of cost efficiency, making employees more productive as opposed to maybe broad scale layoffs. But it's the deployment of these model technologies into specific sub-verticals – so accounting, legal engineering – where that adoption is driving greater efficiency within the organization.

These companies are also adopting models that are smaller and a bit more fine tuned to their specific work product. And so that comes at a lower cost. We heard companies talking about costs at 1/50 of the cost of the broader foundational models when they're deploying it within the organization. And so, cost efficiency is something that we're seeing.

At the same time, to speak to how early it is, one of the biggest hurdles here is change management and actually adoption. Getting people to use these products, getting them to learn the new technologies, that is a big hurdle. You know, you can lead a horse to water, you can't make it drink, right? And so, getting people to actually deploy these technologies is something that organizations are thinking through. How do we approach [it]?

Brian Nowak: And you make an autonomous car drive? I know you've been doing a lot of work on autonomous driving more broadly. There were some autonomous driving and autonomous driving technology companies at Spark. What were your takeaways on autonomous driving from last week?

Matt Bombassei: Yeah, well, not only can you make an autonomous car drive, you can make a truck drive and a bunch of other physical equipment. I think that was one of the takeaways here was that these neural nets that are powering autonomous vehicles are actually becoming much more generalizable. The integration of the transformer architecture into these neural nets is allowing them to take the context from one sub-vertical and deploy it in another vertical.

So, we heard that 80 to 90 percent of the software, the underlying neural net, is applicable across these verticals. So, think applicable from autonomous ride sharing to autonomous trucking, right? What that means from our point of view is that it's important to get the scale of total miles driven – to establish that kind of safety hurdle if you're these companies.

But also, don't necessarily think of these companies as defined by the vertical that they're operating in. If these models truly are generalizable, a company that's successful and scaled and autonomous ride hailing can switch or navigate verticals to also become successful potentially in trucking and other industries as well. So, the generalization of these models is particularly interesting for scale, and long-term market position for these companies.

Brian Nowak: It's fascinating. Well, from consumer and enterprise adoption, the future of agentic computing and autonomous driving, there will be a lot more themes we all have to stay on top of. Keith, Matt, thanks so much for taking the time today.

Keith Weiss: Great speaking with you Brian.

Matt Bombassei: Thanks for having us.

Brian Nowak: And thanks for listening. If you enjoy Thoughts on the Market, please leave us a review wherever you listen and share the podcast with a friend or colleague today.