Theory Ventures Partner Tomasz Tunguz: Why Attack Parallelization Makes AI Security the Third Product-Market Fit
Tomasz Tunguz, a partner at Theory Ventures, argues that security is the third product-market fit for AI, following programming and customer service. The economic mechanism is as follows: attackers have achieved parallelization, reducing response times from months to minutes, which forces enterprises to introduce AI into five budget categories—security operations, SIEM, penetration testing, threat intelligence, and vulnerability management—each generating significant token consumption.
Programming and customer support were the first two product-market fits in AI; Tomasz Tunguz, a partner at Theory Ventures, considers security to be the third. His core argument is not that AI makes security better, but that attackers' parallelization capabilities have overwhelmed human defenders' response speeds, creating a structural demand for token consumption.
The attack data cited by Tunguz comes from multiple sources. Black Kite reported that ransomware incidents against the financial services sector rose from 156 in 2024 to 202 in 2025, reaching 65 in the first quarter of 2026 alone, a 76% year-over-year increase. Cisco Talos discovered that eight intermediate certificates from eMudhra were compromised, with private keys evaluating to single- or double-digit integers, allowing attackers to impersonate any website or service. StepSecurity tracked 56 supply chain attacks over twelve months, one of which was a five-day campaign that stole 78,330 secrets from 2,186 organizations, including 92 publicly traded companies. These figures are self-reported by various institutions, and Tunguz did not independently verify them.
A key step in the economic mechanism is the collapse of response times. Tunguz wrote that intrusion response times have plummeted from months to minutes, making it impossible for human teams to read every alert at that speed. This forces Security Operations Centers (SOCs) to introduce AI for automated triage. He surveyed 75 enterprise security practitioners, asking how they would allocate their security budgets excluding endpoint security, resulting in five categories: Security Operations Center, SIEM, penetration testing, threat intelligence, and vulnerability management. Each category involves significant token consumption. In penetration testing, models continuously probe every endpoint at a cost far lower than human red teams; in vulnerability management, AI ranks massive scanner findings by reachability and exploitability; in SIEM, analysts query databases in natural language, receiving answers in seconds rather than filing tickets to wait for query writing.