This is one of those stories that sounds reassuring on the surface and a little grim when you sit with it: a security company says business is booming because AI is making hackers better. Great for their revenue. Not great for the rest of us.
Based on what’s been shared publicly, JFrog is predicting its fastest revenue growth in four years. The reason they’re giving is simple: demand for digital security is rising because AI is helping attackers pull off more sophisticated cyberattacks. Public reporting also points to a stretch of breaches in late 2026 hitting financial institutions and corporate websites. JFrog says it’s responding by pushing new security features, including tools meant to detect “shadow AI” on developer workstations.
That phrase — “shadow AI” — is doing a lot of work here. It’s basically the reality that people are using AI tools at work even when the company hasn’t approved them, hasn’t tracked them, and hasn’t thought through the risks. And honestly, of course they are. If you give a developer a tool that can write, fix, or explain code faster, the tool is going to get used. Rules or no rules.
Here’s my take: security spending is becoming the “tax” we pay for moving fast, and AI just raised the rate. Every new tool that increases output also increases the blast radius when something goes wrong. We’re not just getting more attacks. We’re getting attacks that are easier to launch, harder to spot, and more personal in how they trick people.
Imagine you run a mid-sized company. Your developers are under pressure to ship. Someone installs an AI helper on a workstation to speed up tasks. That helper quietly pulls in code, snippets, config files, maybe even secrets if the setup is sloppy. You don’t notice because work is getting done faster. Then one day you’re responding to an incident and realizing the problem wasn’t some elite hacker breaking down the front door. It was your own team propping the door open because the building was on fire and they needed to move.
Now imagine the attacker’s side. AI doesn’t need to be magical to be dangerous. It just needs to reduce the cost of trying. If it makes it cheaper to write believable messages, probe for weak spots, or vary attacks at scale, the odds shift. Companies that used to be “too small to bother with” stop being safe by default. That’s the part people miss when they hear “sophisticated attacks.” It’s not only about fancy targets. It’s about more targets becoming worth it.
So yes, I believe JFrog’s forecast. The incentives line up. When the fear goes up, budgets loosen. When leadership feels exposed, they buy tools.
But I don’t fully buy the comforting version of this story, where better security products neatly cancel out better hacking. Security tools are necessary, but they’re also reactive by nature. Attackers don’t need to win forever. They just need to win once. Defenders need to be right every day, in every corner of their systems, including the messy human corners where people do “quick fixes” to hit deadlines.
And the truth is, a lot of security buying is emotional. Leaders want something they can point to after an incident. “We invested in security.” That can turn into a shopping spree of features that look good in a demo but don’t change behavior. If “shadow AI” becomes the next hot fear, companies will rush to detect it. Detection helps, but it can also turn into a cat-and-mouse game inside your own walls: workers hide tools because they’re useful, security teams clamp down because they’re scared, and everyone loses trust.
There’s also a bigger consequence here that isn’t about one company’s revenue. If AI raises the baseline threat level, we’re going to see a widening gap between organizations that can afford serious security and those that can’t. Big banks and large tech companies will keep stacking defenses. Smaller hospitals, schools, nonprofits, local businesses — they’ll be told to “do the same” with a fraction of the staff and money. That doesn’t end in a stable place. It ends with more outages, more ransom payments, more quiet cover-ups, and more people feeling like the internet is something that happens to them, not something they control.
To be fair, there’s an alternative read: maybe this is a healthy correction. Maybe we’ve underinvested in software supply chain security for years, and AI is just forcing us to take it seriously. Maybe tools that flag risky behavior on developer machines will prevent real harm. I can see that. I want that to be true.
But I’m skeptical of any narrative that says “don’t worry, the market will fix it.” The market fixes the part that can be sold. It doesn’t automatically fix training, habits, messy workflows, or the quiet reality that people will always trade a bit of safety for speed when the pressure is on.
If AI keeps making both building and breaking easier, what should we prioritize more: tighter control that slows teams down, or looser freedom that accepts more risk?