Today's Cyberattacks and the US Companies Defending Against Them
Cyberattacks now hit company earnings directly. For investors, they cut two ways: the "risk" that a company you own gets attacked, and the "demand" created as spending on security rises. This column covers attack methods, where budgets are going, market size and the key US companies, in that order.
30-second read
The key points in 7 slides — enough to get the whole picture.
Introduction
Cyberattacks now hit company earnings directly. In October 2025, Japanese online office-supplies retailer Askul was infected with (malware that demands a ransom), halting its order processing. For the fiscal year ended May 2026 it swung to a net loss of ¥22.1 billion (about $150 million), from a ¥9.0 billion profit the year before. UnitedHealth, the largest US health insurer, lost about $3.1 billion from a single attack.
For investors, this issue has two sides. This column covers attack methods, where corporate budgets are going, the size of the market, and the US companies that provide the defenses, in that order.
Multibillion-dollar losses and swings into the red: the attack methods that hit earnings
A company that is attacked doesn't just lose sales. It also pays for recovery, compensation to customers and lawsuits. Attacks keep getting faster. CrowdStrike's 2026 Global Threat Report found that the (the time from an attacker getting into a company's systems to spreading to other PCs and servers) averaged 29 minutes for attacks by financially motivated criminal groups, and was as short as 27 seconds. In other words, if you only start planning a response after noticing something is wrong, it is already too late.
Breakout time for attacks by financially motivated criminal groups (CrowdStrike 2026 Global Threat Report).
There are five main attack methods.
Steals and encrypts data, then demands a ransom. Factories and logistics stop, so the hit to earnings is the largest.
Exploiting
Targets weak spots in software and . Put off applying a and that gap becomes the way in.
Impersonates employees or business partners to get passwords by phone or email.
Gets in through a less-protected business partner or a cloud service the target uses.
AI-powered attacks
Attackers use generative AI too, letting small teams launch large numbers of attacks.
① Ransomware (attacks that demand a ransom)
Once inside a company's systems, attackers steal data and then encrypt it (scramble it so it can't be opened). The most common approach today is "double extortion": pay up if you want your data back, and pay up if you don't want the stolen data published. Because factories and logistics grind to a halt, ransomware has the biggest impact on earnings of any attack type.
Japan's Information-technology Promotion Agency (IPA), an independent body under the Ministry of Economy, Trade and Industry, publishes an annual ranking of the threats companies should watch most closely, called the "10 Major Security Threats." The ranking is decided by discussion and vote among about 250 researchers and corporate security practitioners. In 2026, ransomware ranked first.
- UnitedHealth (February 2024): Its subsidiary Change Healthcare was attacked, halting medical billing at hospitals and pharmacies across the US. Personal data on about 190 million people was stolen, and losses reached about $3.1 billion (about $2.2 billion in response costs plus about $0.9 billion in business disruption). The attackers got in through a remote-access portal that employees used to connect to internal systems from outside. That portal did not have (MFA: confirming identity with something beyond a password, such as a code sent to your phone), so a stolen password was all it took.
- Asahi Group (September 2025): Attackers got in through network equipment at a group site, halting beer orders and shipments. One-time costs, including recovery, came to about ¥17 billion (about $115 million), and operating profit for the year ended December 2025 fell 30.9% from the prior year (though factors other than the attack also contributed).
② Exploiting vulnerabilities (weak spots in software and devices)
Software and network gear such as VPN appliances (devices that let people connect securely to the corporate network from outside) contain vulnerabilities that even their makers don't know about. Each year, US telecom giant Verizon publishes its Data Breach Investigations Report (DBIR), which analyzes real-world breaches. In the 2026 edition (based on about 22,000 incidents), the most common initial access method (how attackers first got into a company's systems) was exploiting vulnerabilities, at 31% of the total. For the first time, it overtook the long-time leader, the use of stolen passwords.
Put simply, when a company delays applying fixes (patches), that gap tends to become the easiest way in. "Zero-day attacks," which strike before the maker has released a fix, are also on the rise.
③ Social engineering (tricking people into giving up information)
Attackers pose as employees or business partners to get passwords by phone or email, then walk right in as if they were legitimate staff. Alongside "phishing" with fake emails, "vishing" (voice phishing) over the phone is also increasing.
- MGM Resorts (September 2023): The Las Vegas casino giant was hit when attackers called its IT help desk pretending to be an employee and got a password reset. Hotel and casino systems went down, and losses came to about $100 million.
④ Supply chain attacks (attacks through partners and outside services)
Instead of going straight at a well-defended large company, attackers get in through a less-protected business partner or a cloud service (business software used over the internet) that the company relies on. In Verizon's analysis mentioned in ②, about half of breaches (48%) involved a third party such as a business partner or contractor, up from 30% the year before. Note that a company's operations can be halted by a partner's breach even when the company itself did nothing wrong.
⑤ AI-powered attacks
Attackers have started using generative AI as well. In IPA's "10 Major Security Threats" mentioned in ①, "cyber risks related to AI use" made the list for the first time in 2026, debuting straight at No. 3.
- Misuse of Anthropic's generative AI "Claude" (September 2025): An attack group believed to be Chinese state-sponsored (a group that carries out cyberattacks with backing from a government's intelligence services or similar bodies; unlike financially motivated criminals, they often aim to steal secrets or cause disruption) used Claude in attacks on about 30 organizations, including major tech companies and financial institutions. About 80-90% of the attack work was automated with Claude acting as an AI agent (AI that carries out tasks on its own without waiting for human instructions), and some intrusions succeeded. Because AI lets small teams launch large numbers of attacks, attacks are expected to become even more frequent and faster.
Since December 2023, US-listed companies that suffer a material cyberattack must disclose it to the Securities and Exchange Commission () on Form (a current report) within four business days of determining that its impact is material. If a "cybersecurity incident" appears in an 8-K from a company you own, check how it could affect results.
Where are corporate budgets going? Five defenses and the main areas of spending
Like home security, corporate defense works in three layers. Below, we map each attack type from Chapter 1 to what companies are spending money on.
Tap a dotted term to see what it means
| Attack | Defense | Main spending (product segment) |
|---|---|---|
| ① Ransomware | Monitor PCs and servers constantly and stop suspicious activity on the spot. Store data where attackers can't alter it | , , |
| ② Exploiting vulnerabilities | List vulnerabilities in the company's software and devices and patch the most dangerous ones first | |
| ③ Social engineering | Confirm identity with . Limit each employee's system access and permissions to only what they need | (identity and access management), (privileged access management) |
| ④ Supply chain attacks | Use (trust no access, even from inside, and verify identity and permissions every time) to contain damage | , |
| ⑤ AI-powered attacks | Defenders also use AI to detect and respond automatically. Monitor employees' AI use as well | , |
Three trends shape how budgets are spent. Each one affects the results of security companies.
Also, most security products are sold on a basis: once adopted, they are renewed and used year after year. For the vendors, that means revenue that recurs every year.
About $250 billion a year worldwide, growing over 10% a year: a defensive market that is relatively resilient to the economy
According to US research firm Gartner, worldwide information security spending (what companies and governments spend on security products and services) is expected to reach about $247.5 billion in 2026, up 12.7% year over year (forecast as of September 2026). Spending has been growing at roughly 10% or more a year, and 2026 is expected to come in at about 1.6 times the 2021 level.
Unit: $B
Source: Gartner (2021-2024 from releases published in 2022, 2023 and July 2025; 2025 and 2026 are forecasts as of September 2026, shown in lighter bars). Because the scope of the data differs by release, growth from 2023 to 2024 looks smaller than it actually was.
There are three reasons this market is considered relatively resilient to the economy.
That said, a severe downturn would squeeze IT budgets overall, leading to delayed purchases and pricing pressure as companies consolidate products. The right way to think about it is not "immune to the economy" but "harder to cut than other IT spending."
Growth also varies widely by segment, with a clear split between segments that are growing and those that are slowing or shrinking.
| Category | Segment | Outlook | Background |
|---|---|---|---|
| Growing | Security software (EDR, IAM, etc.) | Up 14%+ year over year in 2026, the fastest of any major segment (Gartner) | Moving business systems to the cloud and wider use of generative AI mean more to protect |
| Growing | Ransomware protection | From about $28.5 billion in 2025 to about $63.5 billion in 2030, growth of around 17% a year (The Business Research Company) | The hit to earnings is large, so it is a top priority for management |
| Moderate growth | Security services (outsourced operations such as MDR, consulting) | The largest segment at about 40% of total spending, but growing only around 10% a year (Gartner) | Relies heavily on people; AI automation could shift part of it to software |
| Slow growth | Consumer security software (home antivirus, etc.) | Low growth of around 3% a year (Gartner) | PCs and smartphones now come with built-in protection, reducing the need to buy paid software |
| Shrinking | (intrusion detection and prevention systems; network access control devices) | Down 6-8% year over year in 2026 (Gartner) | An older approach that assumes "inside the network is safe"; being replaced by zero trust and SASE |
Source: Gartner (segment forecasts as of March 2026; overall market as of September 2026).
For investors, the key is not to lump everything together as "cybersecurity," but to tell whether a company's main products are in a growing segment or a shrinking one.
US companies capturing demand for defense: key listed names and a wave of big acquisitions
Below are the main US-listed companies for each product segment in Chapter 2. Large vendors offer several segments together. Tap a ticker to go to a page with that company's financials.
CNAPP
High growthServices that detect cloud misconfigurations and suspicious activity
Market growth: CSPM (cloud configuration management) +33.4%, CWPP (cloud server protection) +25.9%
AI security
High growth (market still small)Monitoring employees' use of generative AI and managing what AI agents are allowed to do
Market growth: From about $3 billion in 2026 to about $16 billion in 2030 (around 50% a year; Gartner, as of September 2026)
SASE and firewalls
High growthApplies zero trust to check and inspect traffic wherever employees connect from
Market growth: CASB (cloud usage monitoring) +27.2%, ZTNA (zero trust remote access) +23.0%, firewall appliances +15.9%
Backup and recovery
Above marketBackups attackers can't alter, and fast recovery
Market growth: Ransomware protection market overall around 17% a year (reference figure; not a Gartner category)
Vulnerability and exposure management
Above marketServices that list vulnerabilities in a company's software and devices and flag them in order of risk
Market growth: Vulnerability assessment +15.7% (12.0% a year on average through 2030)
EDR and MDR
In line with marketSoftware that detects and contains attacks on PCs and servers, plus outsourced 24/7 monitoring and response
Market growth: Endpoint protection (incl. EDR) +14.5%, managed services (incl. MDR) +11.1%
IAM and PAM
In line with marketLogin management such as multi-factor authentication, and managing each employee's access permissions
Market growth: Identity and access management overall +11.8% (of which IGA, identity review and permission audits, +14.7%)
Note: "Market growth" is the 2026 year-over-year forecast for each segment as a whole. It does not indicate the growth or share-price outlook of any individual company. Companies listed are examples for each segment, not recommendations of any stock. Year-over-year revenue shown for each stock is from its most recent quarterly results.
Worldwide information security spending overall is forecast to grow in the 12% range in 2026 (Gartner; segment growth rates as of March 2026, overall and AI security as of September 2026). Using that as a benchmark, product segments fall into three groups.
- High growth (roughly twice the market average or more): CNAPP, SASE and AI security. In each case, demand comes directly from the shift in corporate IT itself: the move to the cloud and the spread of generative AI. But big players are moving in aggressively, as with Google's acquisition of Wiz, so competition is intense.
- Above market average: Backup and recovery, and vulnerability management. The rise in ransomware and vulnerability exploitation (Chapter 1, ① and ②) is a direct tailwind.
- In line with the market: EDR/MDR and IAM/PAM. These are mature segments that many companies have already adopted; the markets are large, but growth has leveled off. For companies in these segments, the key to growth is whether they can expand into high-growth areas such as AI security.
Why each segment is growing
- CNAPP (services that detect cloud misconfigurations and suspicious activity): Companies are moving business systems from their own servers to public clouds (cloud platforms shared by many companies) such as AWS and Microsoft Azure. The cloud runs on a "shared responsibility model" (the cloud provider secures the underlying platform, while the customer is responsible for the settings and data on top of it), so misconfigurations such as wrongly assigned access permissions or data stored where outsiders can see it are the customer's responsibility. On top of that, the spread of multicloud (using several clouds at once) and of development methods where engineering teams update systems daily (DevOps) means there are now too many settings, changing too often, for people to check by hand. Attackers are targeting this: according to CrowdStrike, cloud intrusions rose 37% in 2025, and intelligence-gathering cloud intrusions by state-sponsored attackers (government-backed hacker groups; see Chapter 1, ⑤) jumped 266%. Since much generative AI development and operation also runs in the cloud, the attack surface is expected to keep growing.
- AI security: Verizon's 2026 DBIR found that 45% of employees regularly use generative AI on company devices, up sharply from 15% a year earlier. Of those, 67% use personal accounts the company doesn't manage, raising the risk of leaking confidential information by entering it into AI tools. Prompt injection (attacks that slip malicious instructions into an AI to manipulate it) has been observed at more than 90 companies (CrowdStrike). As companies increasingly give AI agents permission to operate their systems, demand is emerging for tools that control what AI is allowed to do.
- SASE and firewalls: Remote work and SaaS (business software used over the internet) have broken the old assumption that you only need to guard the entrance to the corporate network. Worse, the VPN appliances that serve as that entrance are themselves being exploited again and again: 40% of the vulnerabilities used by China-linked attackers targeted such edge devices (CrowdStrike). As a result, more companies are dropping traditional on-premises defenses (VPN, IDPS, NAC) and switching to SASE, which verifies every connection in the cloud no matter where it comes from.
- Backup and recovery: Modern ransomware goes after backups first to block recovery. That is driving a shift to immutable backups (backups that, once saved, cannot be altered or deleted, even by administrators). As Asahi's roughly two months to restore its order system showed, recovery speed determines how large the loss is, which is another reason management is spending more here.
- Vulnerability and exposure management: As noted in Chapter 1, ②, exploiting vulnerabilities has become the most common initial access method. Yet of the vulnerabilities the US government has confirmed are being actively exploited, only 26% were fully fixed, and the median time to fix was 43 days (Verizon). Attackers are also using AI to find vulnerabilities faster, increasing demand for products that automatically decide what to fix first.
- EDR and MDR: Most large companies already use EDR, and the market is maturing. Future growth will come mainly from adoption by mid-sized and small businesses, and from MDR, which helps make up for the shortage of security staff.
- IAM and PAM: Another mature segment, but non-human identities, such as AI agents and accounts that let systems talk to each other, are multiplying fast. IGA (identity governance), which inventories these identities and reviews their permissions, is growing faster than the segment as a whole.
Keep in mind that market growth and individual company growth are not the same. Within the same segment, some companies gain share and others lose it, so it is important to also check each company's revenue growth and .
A wave of big acquisitions
This industry has seen a steady stream of large (mergers and acquisitions) deals by big players. In line with the platformization trend in Chapter 2, large vendors are buying companies in segments they lack so they can sell customers "everything in one package."
- Closed in 2026; the company's largest acquisition everGoogle (parent: Alphabet) → Wiz (CNAPP)~$32B
- Closed February 2026Palo Alto Networks → CyberArk (PAM)~$25B
- Agreed; expected to close in the first half of 2027Proofpoint (private) → Varonis (data security)~$6.3B
Metrics commonly used to analyze companies in this industry
Summary
- Generative AI is making cyberattacks faster and more sophisticated. Some companies have swung to a loss from a single ransomware attack, making this a risk investors can't ignore in the stocks they own.
- Corporate budgets are flowing toward "platformization," "AI-driven automation" and "outsourcing."
- Worldwide information security spending is forecast at about $247.5 billion in 2026, with growth continuing at 10% or more a year.
- The US has listed companies with distinct strengths in each segment, while big players continue to make large deals.
Glossary
- Ransomware
- An attack that encrypts a victim's data so it cannot be used and demands a ransom to restore it. Today the dominant form is double extortion, where attackers also steal the data and threaten to publish it.
- Breakout time
- The time it takes an attacker, after breaking into a company's systems, to spread to other computers and servers. The shorter it is, the harder the attack is to contain.
- DBIR
- An annual report published by the major US telecom company Verizon that analyzes real-world data breaches.
- Vulnerability
- A design weakness or flaw in software or hardware. Attackers exploit these weaknesses to break in.
- VPN appliance
- A device that lets people connect securely to a company's internal network from outside. Because it serves as a gateway into the company, it is a frequent target for attackers.
- Patch
- A fix released by a software vendor to repair vulnerabilities or bugs in its software.
- Social engineering
- A tactic in which attackers pose as employees or business partners and use phone calls or emails to trick people into revealing passwords and other information. It exploits human carelessness rather than technical flaws.
- Supply chain attack
- An attack that, instead of targeting a well-defended company directly, gets in through a less-protected business partner or an outside service the company uses.
- Multi-factor authentication (MFA)
- A way of verifying identity that requires something in addition to a password, such as a code sent to your phone. It makes break-ins harder even if a password is stolen.
- SEC
- The US government agency that sets and enforces the disclosure rules for publicly listed companies.
- Form 8-K
- A current report that US public companies must file with the SEC when a significant event occurs. Material cybersecurity incidents are among the events that must be reported.
- EDR
- Software that continuously monitors computers and servers and contains an attack on the spot when it detects one.
- MDR
- A service in which an outside specialist firm handles security monitoring and response around the clock on a company's behalf. It is used by companies that lack in-house security staff.
- Backup and recovery
- Systems that keep copies of data in a place attackers cannot alter, so the data can be restored quickly after an attack.
- Vulnerability and exposure management
- Services that catalog the weaknesses in a company's software and devices and flag them for fixing, starting with the most dangerous.
- IAM
- Systems that manage employee identities and determine who can use which systems. Multi-factor authentication falls under this category.
- PAM
- Systems that tightly control administrator privileges, which allow unrestricted control over systems.
- Zero trust
- A security approach that trusts no access by default, even from inside the company network, and checks identity and permissions every time. It helps limit the damage to a small area even if an attacker gets in.
- SASE
- An approach that verifies and inspects employees' network traffic in the cloud, all in one place, wherever they connect from.
- CNAPP
- A service that detects misconfigurations and suspicious activity in cloud environments.
- SOC automation
- Using AI to automate the threat detection and response work performed by a security operations center (SOC).
- AI security
- Products that monitor employees' use of generative AI and manage the permissions granted to AI agents.
- Subscription
- A fixed-fee pricing model in which customers, once they adopt a product, keep using it by renewing their contract each year. It gives the provider recurring revenue year after year.
- IDPS and NAC
- Devices that detect and block intrusions, and devices that control which machines can connect to the internal network. These are traditional on-premises defenses, and this market is shrinking.
- NRR
- A metric showing what percentage existing customers are paying now compared with one year earlier. An NRR of 110% means revenue grew 10% even without any new customers.
- M&A
- Companies combining with or buying other companies. In this industry, large players keep buying companies in areas where their own lineup is lacking.
Sources
- IPA, "10 Major Information Security Threats 2026" (Japanese)
- CrowdStrike 2026 Global Threat Report
- Key takeaways from the Verizon 2026 DBIR (SOCRadar)
- The cost of the Change Healthcare (UnitedHealth) attack (Becker's Hospital Review)
- MGM Resorts' losses (BleepingComputer)
- How the MGM Resorts attack worked (Adaptive Security)
- Anthropic's disclosure of an AI-orchestrated attack (BD TechTalks)
- Timeline of the Asahi cyberattack (ISSOH, Japanese)
- Askul, "Consolidated Financial Results for the Fiscal Year Ended May 2026 (Japanese GAAP)" (Japan Exchange Group, Japanese)
- Askul's results for the fiscal year ended May 2026 (Kumamoto Nichinichi Shimbun, Japanese)
- The SEC's cybersecurity incident disclosure rules (Cooley)
- Gartner: information security spending forecast (July 2025)
- Gartner: 2023 forecast (via AlBawaba)
- Gartner: 2022 forecast (via AlBawaba)
- Overview of Gartner's segment forecast (1Q26 edition) (Software Strategies Blog)
- Overview of Gartner's information security spending forecast (3Q26 edition) (Software Strategies Blog)
- The Business Research Company: ransomware protection market (via GII)
- Google completes its acquisition of Wiz (heise)
- Palo Alto Networks completes its acquisition of CyberArk (CRN Asia)
- Proofpoint agrees to acquire Varonis (SEC filing)
This column is for informational purposes only and does not recommend buying or selling any particular stock. Investment decisions are your own responsibility. Figures are based on publicly available information as of October 2026. Dollar conversions of yen amounts are approximate.