What does AI mean for cyber defence?

Summary

Cyber threats are becoming faster and more persistent
Cybersecurity is a national security priority
AI could be a catalyst and not a headwind for cybersecurity

Why is cyber defence becoming so essential?

Cyber defence operates in a unique sphere because it does not follow traditional procurement cycles seen in traditional weapon systems.

“A cyber programme cannot be paused; while missiles may stop flying when peace negotiations are taking place, cyber-attacks can be actioned at any time and from almost any place”

According to Gartner, global cybersecurity spending is projected to reach $244 billion in 2026, with a constant currency growth of 11.6%.[1]

In 2018, there was an average gap of 2.3 years from discovery of a vulnerability to confirmed exploitation. Now, a working attack emerges, on average, 20 hours after a vulnerability is discovered.[2] The lead times for attacks are collapsing, and these threat assessments are indicative of a structural change that will only become more prevalent with the evolution of both AI and quantum computing.

Source: Zero Day Clock. NB. TTE stands for Time to Exploit meaning the amount of time between a vulnerability being discovered and a working exploit becoming available to attackers and CVE stands for Common Vulnerabilities and Exposures, meaning the publicly recorded weaknesses found. Data as of 02.06.2026. For illustrative purposes only.

What does this mean for nation states?

The ultimate purpose of state sanctioned cyberwarfare is to prepare for potential combat through targeted destabilisation campaigns that weaken infrastructure and disrupt a potential adversary. The most significant recent example of this was in the days and weeks preceding the Ukraine war. Russian linked actors breached the Ukrainian Defence Ministry’s website and two of Ukraine’s largest banks.[3]

Ukraine is not the only victim of these attacks. Russia directed 20% of cyber-attacks in 2025 at the U.S. despite being at war with Ukraine.[4] This threat is directly translating into defence budgets – 1.5% of the 5% GDP commitment made by NATO members is allocated to infrastructure, cybersecurity, and resilience. The resources that are allocated towards cybersecurity will indicate strong policy commitment in favour of increased cyber resilience and preparedness.

Why could AI be a catalyst and not a headwind?

Concerns about AI’s ability to increase the effectiveness of cyber threats has been growing. Anthropic’s Mythos model generated considerable concern when it was announced it broke out of its sandbox (an isolated environment used for testing without real world consequences). It was deemed too dangerous for release because it was able to find thousands of vulnerabilities in major operating systems, web browsers, and other software flaws that could be exploited immediately.[5]

For investors, it may be easy to treat this kind of event as a headwind for cybersecurity stocks. However, what Mythos demonstrated is an acceleration of the cyber threat landscape – every instance of an AI-enabled attack is a potential structural catalyst for greater cyber investment, not less.[6] IBM has stated that there has been 44% year-on-year increase in exploitation of public facing software or systems.[7] Existing and new threats will require considerable investment both from a military perspective and a civilian one.

What does this mean for investors?

Collapsing attack lead times, nation-state aggression that persists irrespective of geopolitical negotiations, and the acceleration of AI-enabled threats may permanently alter the digital landscape. Global cyber crime is projected to cost the world $10.8 trillion by 2026.[8] Against this backdrop, global cyber security spending is projected to reach $308 billion by the end of 2026 and potentially grow to $430 billion by 2029.[9] Private companies and governments are facing greater obligations to protect data. Those companies who are able to action solutions may be positioned to benefit meaningfully.

This material does not constitute a marketing document. It is not an invitation to invest but to be read for educational purposes only.

[1] https://www.gartner.com/en/documents/6998666

[2] https://iapp.org/news/a/ai-such-as-mythos-preview-raises-the-urgency-of-cross-border-flows-of-cybersecurity-data

[3] https://dcnnmagazine.com/security/nearly-90-of-cyber-attacks-worldwide-are-targeting-russia-or-ukraine/

[4] https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf

[5] https://theconversation.com/mythos-ai-is-a-cybersecurity-threat-but-it-doesnt-rewrite-the-rules-of-the-game-281268

[6] https://www.morningstar.com/news/marketwatch/2026033077/heres-why-palo-alto-networks-and-other-cybersecurity-stocks-are-now-standout-gainers

[7] https://www.ibm.com/reports/threat-intelligence

[8] https://www.vestbee.com/insights/articles/cybersecurity-market-2026

[9] https://www.idc.com/resource-center/press-releases/wwsecuritysg/

IMPORTANT INFORMATION This document is approved for professional use only.

Communications issued in the UK

The content in this document is issued by HANetf Limited (“HANetf”) and approved by Privium Fund Management (UK) Limited (“Privium”). HANetf is an appointed representative of Privium, which is authorised and regulated by the Financial Conduct Authority. The registered office of Privium is The Shard, 24th Floor, 32 London Bridge Street, London, SE1 9SG

This communication has been prepared for professional investors, but the exchange traded product (“ETCs”) and exchange traded fund (“ETFs”) set out in this communication (“Products”) may be available in some jurisdictions to any investors. Please check with your broker or intermediary that the relevant Product is available in your jurisdiction and suitable for your investment profile.

Disclaimers

Past performance is not a reliable indicator of future performance. The price of the Products may vary and they do not offer a fixed income. This document may contain forward looking statements including statements regarding our belief or current expectations with regards to the performance of certain assets classes. Forward looking statements are subject to certain risks, uncertainties and assumptions. There can be no assurance that such statements will be accurate and actual results could differ materially from those anticipated in such statements. Therefore, readers are cautioned not to place undue reliance on these forward-looking statements. The content of this document is for information purposes and for your internal use only, and does not constitute an investment advice, recommendation, investment research or an offer for sale nor a solicitation of an offer to buy any Product or make any investment.

An investment in an exchange traded product is dependent on the performance of the underlying asset class, less costs, but it is not expected to track that performance exactly. The Products involve numerous risks including among others, general market risks relating to underlying adverse price movements in an Index (for ETFs) or underlying asset class and currency, liquidity, operational, legal and regulatory risks. In addition, in relation to Cryptocurrency ETCs, these are highly volatile digital assets and performance is unpredictable.

Frequently Asked Questions

Why is cyber defence becoming so essential?

Cyber defence is becoming essential because cyber-attacks can happen at any time, from almost anywhere. Unlike traditional defence systems, cyber programmes cannot be paused, as threats continue to evolve across governments, companies and critical infrastructure.

How quickly can cyber vulnerabilities be exploited?

The gap between discovering a vulnerability and attackers being able to use it has narrowed dramatically. The article notes that in 2018, this gap was around 2.3 years on average. Today, a working attack can emerge in around 20 hours.

Why does cyber warfare matter for nation states?

Cyber warfare gives states a way to disrupt infrastructure, weaken institutions and create instability without relying on conventional military force. In Ukraine, cyber-attacks on government and banking websites showed how digital attacks can form part of a wider destabilisation campaign.

Could AI increase demand for cyber defence?

AI could increase demand for cyber defence by making cyber threats faster and more scalable. As attackers use AI to identify and exploit weaknesses more quickly, governments and companies may need to invest more heavily in systems that can detect, prevent and respond to attacks.

Related Funds

No funds found for the specified category.

Adapting precision warfare: How US defence spending priorities are changing

October 2026

What does AI mean for cyber defence?

Last updated: 8th June 2026 | Author: Cameron MacDonald

Summary

Why is cyber defence becoming so essential?

﻿ “A cyber programme cannot be paused; while missiles may stop flying when peace negotiations are taking place, cyber-attacks can be actioned at any time and from almost any place”

What does this mean for nation states?

Why could AI be a catalyst and not a headwind?

What does this mean for investors?

Frequently Asked Questions

Why is cyber defence becoming so essential?

How quickly can cyber vulnerabilities be exploited?

Why does cyber warfare matter for nation states?

Could AI increase demand for cyber defence?

Related Funds

More Articles

Investment Strategies

About Us

Resources

Leaving HANetf's Website

“A cyber programme cannot be paused; while missiles may stop flying when peace negotiations are taking place, cyber-attacks can be actioned at any time and from almost any place”