Column|Cybersecurity: Customer Checks Show Enterprises Still Prefer to Access LLM Security Capabilities Through CSPs and Security Vendors

The PHP2Shell incident has put LLM security capabilities back in focus. Our channel checks suggest that customers are unlikely to increase security spending materially this year. Interest in higher spending is more evident over the medium term.

Executive Summary

1. AI labs are getting better at finding vulnerabilities, often faster and at lower cost. This puts pressure on point solutions whose main offering is scan results or labor-intensive penetration testing. But the opportunity is not limited to scanning: demand is also moving toward platforms that manage assets and policies, as well as products that protect WAFs and APIs.
2. Most customer spending is still directed toward remediation, incident response and governance. These jobs depend on systems already running in the customer environment—endpoint agents, firewalls and identity tools that collect telemetry, block threats and support remediation—as well as teams that can investigate and handle incidents. AI labs generally do not own this infrastructure or provide those operating teams. Channel checks also point to two practical constraints: people are still needed to carry out remediation, and sensitive data must stay within controlled environments. As a result, new spending tends to go to vendors customers already use.
3. For now, partnerships are the more common route to market. AI labs supply the models and tokens; security vendors connect them to customer data, enforce policies and build the models into existing products. The leading security models are also being made available through partners or tightly controlled programs, rather than through unrestricted direct access.

How Enterprise Security Work Gets Done: Models Help Find Vulnerabilities, but Spending Is Concentrated in Remediation, Response and Governance