Agents in Cybersecurity: Three Archetypes of the Future Market
Cybersecurity is undergoing a radical transformation. With the advent of AI agents, code has become a raw material, and vendors' value has shifted from development to data, trust, and integration. Traditional business models are collapsing, giving way to three key archetypes. Implementing solutions now takes days instead of years, but the main barrier is no longer writing code—it's integrating it into corporate environments.
Code as Raw Material: The End of the Programmer Monopoly
The era when writing code was a unique skill is over. Modern agents generate working solutions in hours that previously required teams of 25 people and two years of development. Code is no longer scarce—it's become a material, like sand in chip manufacturing. Economic value has shifted: now critical are data, trust, distribution, and the ability to package others' ideas into working products.
One developer with access to agents effectively replaces an entire department. This isn't a forecast—it's the current production reality. Industries that haven't realized this shift are already clinically dead. Their final burial is delayed only by budgeting inertia and regulatory requirements.
Three Archetypes of Survivors
The market is consolidating around three fundamental models. All other players either merge into these categories or disappear:
- Expensive Infrastructure. Cloud platforms, backbone DDoS protection, telecommunications networks, and certified hardware. High capital expenditures and regulatory barriers create natural protection from cheap code. Agents don't reduce the cost of data centers or peering, so big players consolidate, and small ones are squeezed out.
- Nodal Points (Control Centers). Platforms that control traffic, identity, policies, and solution execution. In conditions where logic can be copied in a week, survival goes to those physically at the point of solution application. Lack of access to the node turns a product into a feature of someone else's system.
- "Brains in a Box" for B2B/B2G. Ready-made platforms with integrated compliance mechanisms, auditing, and insurance. Enterprises and government sectors don't buy agents separately—they need a legally protected box. The window to capture this niche will close in 2–3 years, leaving 10–15 regional champions on major markets.
The mid-market—classic vendors with 200–2000 employees—is doomed. They're not agile enough to work with agents and lack the capital power of infrastructure players. Their products, now assembled in a quarter, are losing value.
Steam for Cybersecurity: Battling Integration Debt
The main barrier today is not creating solutions, but implementing them. An agent will write a pentest module in an evening, but integration into the corporate stack takes three months: procurement, SLA, certification, training. This delta is the key remaining barrier.
There's a need for an environment where adding a new module takes two clicks instead of a quarterly project. Such a platform must inherit:
- Identity and access rights
- SLA and contractual terms
- Data flows and auditing
- Operator training
The first to build such a "Steam for cybersecurity" in a regulated environment will become the entry point for all other solutions. This is the evolution of control centers: on the outside—a single storefront for the client, inside—an ecosystem of creators providing specialized "skills" through a single bus.
Zombie Markets: Regulatory Inertia vs. Reality
Three segments remain economically dead but breathe thanks to inertia:
- AV/EDR. Signature antivirus has been technically dead for ten years but lives on due to regulatory requirements. EDR with an agent turns into a self-closing platform where 80% of incidents are handled without humans.
- NGFW. The physical layer remains in demand, but policy management overlays are outdated. Agents generate rules in an hour instead of a year-long project.
- SIEM. The pay-by-volume model fundamentally conflicts with agents: vendors earn on log volume, while agents minimize noise. The way out is switching to outcome-based pricing (payment for caught incidents).
These "cash cows" are held up by three pillars: regulation, organizational inertia, budgeting habits. All three pillars are crumbling. Regulators are gradually allowing autonomous compliance, devaluing certifications. Vendors relying on certificates are strategically doomed.
Agent Identity: Identification Crisis in the Era of Autonomous Agents
Identity is the only growing segment, but it's facing a hidden crisis. Modern systems are built on the assumption that a human is behind every action. Agents break this model:
- CAPTCHA at $20K a month is bypassed by bots with free proxies
- Device fingerprinting and behavioral biometrics become ineffective
- No mechanisms for delegation chains: "agent X acts on behalf of human Y in scope Z for TTL T minutes with sub-delegation"
A new category emerges—Agent Identity & Access Management, standing between IAM and PAM. There are no clear leaders on the market yet, but the window is narrow: 1–1.5 years. In Russia, developments are absent, giving a chance to pioneers, especially those who get FSTEC approval.
Regulators in a Paradigmatic Dead End
Existing standards (PCI DSS, NIST SP 800-63, GOST 57580, EU AI Act) are built on the "one actor = one human" model. This creates systemic contradictions:
- MFA requirement for critical infrastructure loses meaning with 500 agents performing operations
- Unique identification in PCI DSS doesn't account for non-human performers
- GOSTs don't provide for delegation chains between agents
Regulators are aware of the problem, but rewriting standards will take years. First solutions will appear at the industry initiative level, not state norms.
What’s Important
- Value in cybersecurity has shifted from code to data, trust, and nodal points
- Three surviving archetypes: expensive infrastructure, control centers, and "brains in a box"
- Integration debt has become the main barrier instead of development
- AV/EDR, NGFW, SIEM markets are turning into zombie segments
- Agent IAM is the key innovative niche for 1–1.5 years
— Editorial Team
No comments yet.