Is Your Wealth About to Be “Reset”?

For three years, cybersecurity bulls have been arguing that AI-powered attacks would eventually force a step-change in enterprise security spending. Last week, the argument stopped being theoretical.

GreyNoise documented a campaign that began on August 31, using OpenAI’s Codex and a DeepSeek model alongside publicly available offensive tools. Codex functioned as an orchestration harness, directing agents to research vulnerabilities and synthesize attack chains, while a DeepSeek model generated and iteratively refined exploit code. The result was not a proof of concept. At least 440 PaperCut instances across 395 identified organizations in 48 countries were compromised.

Why This Campaign Is Different

PaperCut issued emergency patches on August 28, saying it was “aware of confirmed customer incidents.” Three days later the attacker was already operational. GreyNoise reported the actor went from an empty workspace to first achieving remote code execution in just under four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds. Speed at that scale, across hundreds of autonomous agents, is categorically different from anything a human-paced intrusion team can produce.

The attacker specified a list of countries to avoid, but the agents did not consistently follow these rules, a detail that deserves more attention than it has received. Autonomous exploitation tools that drift from their operator’s instructions introduce unpredictability that even the attacker cannot fully control. That is a new variable for defenders to price in.

GreyNoise said it could not determine the campaign’s objective, but the pattern of mass credential harvesting across hundreds of targets with no immediate follow-on activity is consistent with initial access broker behavior. Those credentials remain valid and usable until rotated. The breach count may not be the final tally.

The Bull Case for CRWD, PANW, and ZS

CrowdStrike, Palo Alto, and Zscaler all entered this week already positioned as beneficiaries of AI-driven threat escalation. The PaperCut campaign hands their sales teams something they rarely get: a documented, named incident with a victim count. Board conversations change when there is a specific event to reference.

CrowdStrike’s timing is notable. On September 1, the company introduced Falcon Guardian, an AI Detection and Response solution delivering runtime enforcement from the endpoint. AI agents can reason, access enterprise systems, and execute tasks autonomously at machine speed, and Falcon Guardian is designed to give organizations visibility into where they operate, what they access, and how to stop threats before they become breaches. CrowdStrike markets 99% detection efficacy on prompt attacks; the company also markets 100ms latency.

Palo Alto’s revenue trajectory also strengthens the bull case. In its fiscal Q4 2026 earnings call, management highlighted nearly $1 billion of net new Next-Generation Security ARR in the quarter. Zscaler, for its part, reported fiscal third-quarter revenue up 25% to $850.5 million, driven partly by zero trust demand.

What Investors Are Missing

Here is the tension the bulls have not fully resolved. Jefferies survey work in June pointed to 2026 cybersecurity budget growth roughly in line with broader IT and software spending, with no sign of a step-change inflection. A single campaign, however dramatic, may accelerate individual deals rather than expand the total pool of money available.

The deeper question is product-market fit. The PaperCut attack was an external agent swarm exploiting unpatched enterprise software. CrowdStrike’s Falcon Guardian is built to monitor AI agents running inside the enterprise. Some Falcon Guardian components were described as planned or forthcoming at launch, including an AI Gateway capability and a 24/7 managed detection and response service. Selling an incomplete product into a threat that is already live creates a credibility window that competitors will attempt to exploit.

Stocks to Watch

CrowdStrike (CRWD) has the most direct product answer in Falcon Guardian and the endpoint installed base to deploy it fast. The timing of the launch relative to the campaign is either fortunate or prescient. Either way, it is the clearest near-term sales catalyst among the three.

Palo Alto Networks (PANW) carries the broadest platform after completing its CyberArk acquisition and adding identity security at scale. Its next-generation security ARR was reported at about $6.3 billion as of Q2 FY26, up 33% year over year. Credential harvesting at this campaign’s scale plays directly into identity security demand.

Zscaler (ZS) is the most complicated read. Zero trust architecture is exactly what would have limited the blast radius of the PaperCut campaign, but ZS shares have lagged the group in 2026. The valuation argument is compelling if revenue growth holds.

The attack happened. The products exist. The remaining question is whether CFOs read the same GreyNoise report that sales teams will be quoting in every meeting this quarter.