AI vs. real vulnerabilities

Eventually, everything will be secure.

AI agents went from reproducing 3.6% of real software vulnerabilities to 90.9% in nineteen months. The dashed line is the Eventual Security Horizon — the point where every bug is findable. Findable is not fixed, and the same agents run just as well for whoever is attacking you. This curve is the opportunity and the threat at once; what decides which one it becomes is who compounds it faster.

Each dot is one AI agent scored on CyberGym — real vulnerabilities in real open-source projects, not a synthetic test. Height is the share it reproduced; horizontal position is the underlying model’s release date.

Best result to dateBest to date Individual agent resultOne agent The Eventual Security Horizon — 100% foundHorizon — 100%

All results

And what it is worth

Global cybersecurity market capitalisation

—

Every listed pure-play cybersecurity company we track, sized by market capitalisation and coloured by today’s move — one number for how the sector that defends the internet is actually valued.

Sector map

Area is market capitalisation; colour is today’s percentage move. Every tile also carries its signed change, so direction never depends on colour alone.

All holdings

The same figures as the map, sortable and readable without colour.

Cybersecurity companies by market capitalisation, sortable by any column.

“By consistently investing in cybersecurity, we can eventually make the internet secure. It’s not about spending, but building a safer digital future.” — anon

Spotted a missing ticker, or something that looks wrong?

Get in touch