JPMorgan estimates AI-driven security spending opens a three-year incremental market above $430 billion, as shrinking vulnerability windows and sub-$1,000 attack tooling push cyber budgets into fixed AI-infrastructure spend. Netskope's Q2 fiscal 2027 results show the pipeline building — $899 million ARR, up 27% — but net new ARR growth of just 9% and negative free cash flow confirm the revenue conversion lands in Q4 2026 and 2027, not now.
Cybersecurity budgets are being reclassified from discretionary IT line items into fixed AI-infrastructure costs, a shift JPMorgan estimates opens a three-year incremental market of more than $430 billion, with the first real earnings contribution arriving in the fourth quarter of 2026.
"Security is no longer a cost center that gets cut when the macro turns — it is the toll enterprises pay to run AI in production," Brian Essex, analyst at JPMorgan, said in the report.
The bank's argument rests on attack economics that have inverted. The average window between a vulnerability's public disclosure and its weaponization fell from 63 days in 2018 to five days in 2023, and reached negative seven days in 2025 — meaning attackers now build working exploits before a patch exists. Roughly 29% of known exploited vulnerabilities were weaponized on or before the day they were disclosed. The cost of scanning an entire operating system for flaws has dropped below $50, and a full remote-control attack tool now costs under $1,000, against $500,000 to $2 million on traditional black markets. JPMorgan cited Anthropic models that autonomously locate zero-day flaws and complete end-to-end penetration tests; Anthropic's offensive security lead expects rival models to reach comparable capability within months.
Cheaper offense forces more expensive defense. Detection and response have to run continuously and automatically because human triage cannot keep pace with a five-day — or negative — patch window. That is the mechanism converting security from a per-seat software purchase into infrastructure capacity, and it is why JPMorgan frames the spending cycle as structural rather than thematic.
The clearest public test of the thesis so far is Netskope (NASDAQ: NTSK), which reported second-quarter fiscal 2027 results on September 2, 2026. Annual recurring revenue reached $899 million, up 27% year over year, and quarterly revenue rose 29% to $220.5 million, beating guidance on every reported metric. Net retention improved to 114%, and 59% of customers now run four or more Netskope One products, up from 51% a year earlier — the platform-consolidation behavior JPMorgan describes, where buyers shrink vendor counts and fold identity, network, endpoint and data security into one contract.
The caution sits in the same print. Net new ARR grew just 9% year over year to $54 million, a deceleration management attributed to second-half seasonality and a migration of customers to annual billing that defers cash collection. Free cash flow worsened 51% year over year to negative $29.8 million, and free cash flow margin slipped to negative 14% from negative 12%. Management guides full-year fiscal 2027 revenue of $888 million to $892 million and expects free cash flow margin to reach roughly 2% by year-end — about $18 million positive for the year.
Roughly one-third of Netskope's AI security pipeline is in or entering proof-of-concept, against typical enterprise sales cycles of six to 12 months. That timing places meaningful AI security revenue in fiscal 2028, not fiscal 2027. Non-GAAP operating margin improved 11 percentage points year over year to negative 9%, and the company holds $1.1 billion in cash and marketable securities. Netskope was named a Leader in the Gartner Magic Quadrant for SASE Platforms for a third consecutive year, positioned highest on Ability to Execute, and holds AWS Security Competency status for AI Security.
AI infrastructure buildouts are creating security demand that did not exist three years ago. Sovereign AI programs, emerging cloud providers and frontier AI labs are buying firewalls, secure access service edge (SASE) — the architecture that routes branch and remote traffic through cloud security checkpoints — and data security tooling at the same time they buy compute. Some enterprises now require AI models and training data to run inside their own perimeter, which pulls air-gapped deployments and data governance into the infrastructure budget rather than the compliance budget.
The beneficiary list is broad rather than narrow: real-time detection and response, non-human identity governance, software supply chain security, data security and exposure management. Each is a separate attack surface that AI expands. Non-human identities — service accounts, API keys and autonomous agents — are the newest, because AI agents act on systems without a human at the keyboard.
JPMorgan's own framing carries the risk. Flexible commitment pricing lets customers redirect existing contract value into new AI security products without a fresh procurement cycle, which lifts contract size and retention but delays revenue recognition. That is why ARR and bookings are the better momentum gauges than reported revenue this cycle, and why management teams are guiding conservatively on near-term impact.
The conversion window is the number that matters. JPMorgan expects AI security projects to move from evaluation and trial into orders starting in the fourth quarter of 2026, with a clear acceleration in 2027. Investors buying the thesis today are underwriting a 12-to-18-month lag between visible pipeline and reported revenue — and Netskope's 9% net new ARR growth is the reminder that the lag is real. The fourth-quarter 2026 prints, and the fiscal 2028 results that follow, are where the $430 billion estimate either starts showing up in income statements or gets revised down.
This article is for informational purposes only and does not constitute investment advice.
