Soochow: AI agents expand security boundaries; traditional cybersecurity is expected to usher in a new round of product upgrades.

Soochow released a research report stating that AI security is becoming a rigid and necessary investment for enterprises' intelligent transformation, and application protection has opened up a brand-new incremental market for the cybersecurity industry. As large models evolve from content generation to intelligent agents executing business tasks, security needs have expanded from input-output review to full business process control, and the scope of protection has extended from content compliance and sensitive information protection to cross-system identity authentication, runtime isolation, abnormal termination and recovery mechanisms, driving up per-customer procurement value. AI brings two growth paths to the cybersecurity industry: new protection demand and efficiency gains in existing businesses. Industry commercialization will first manifest as sales of standalone AI security products, and then expand customer value through platform capacity expansion, renewals and continuous operation services. Commercialization will go through three stages: point protection, unified governance and continuous operations. Vendors that can consolidate permissions, auditing and continuous monitoring into standardized products are expected to achieve sustained growth as customers' AI applications expand. Soochow's main points are as follows: AI security is becoming a rigid and necessary investment for enterprises' intelligent transformation, and application protection has opened up a brand-new incremental market for the cybersecurity industry As large models evolve from content generation to intelligent agents executing business tasks, security needs have expanded from input-output review to full business process control. Early large models mainly handled Q&A, retrieval and text generation, and model vendors could cover a considerable portion of general risks through safety training, API restrictions and content filtering; after intelligent agents connect to databases, business accounts and execution tools, the impact of erroneous judgments expands to enterprise production and data assets, and enterprises need to independently set data access boundaries, operation permissions and approval processes. Security needs will deepen progressively along office assistance, business collaboration and core production, and the scope of protection will extend from content compliance and sensitive information protection to cross-system identity authentication, runtime isolation, abnormal termination and recovery mechanisms, driving up per-customer procurement value. AI brings two growth paths to the cybersecurity industry: new protection demand and efficiency gains in existing businesses. Products such as large-model security gateways, permission governance and data loss prevention directly create incremental revenue; AI empowers alert analysis, vulnerability analysis and assisted response, reducing manual analysis costs and shortening response times. Industry commercialization will first manifest as sales of standalone AI security products, and then expand customer value through platform capacity expansion, renewals and continuous operation services. The AI security industry chain shows a layered collaboration pattern, and enterprises' deployment entry points determine third-party security vendors' market competitive position Model vendors control weights, training processes and deployment strategies, and lead safety training, model alignment and dangerous capability assessment; third-party vendors focus on enterprise-side application and infrastructure protection, combining general security capabilities with customers' data boundaries, permission structures and business processes, while professional assessment institutions participate in independent verification. Enterprises simultaneously use external model APIs, internally deployed models and intelligent agents developed by different departments, which easily leads to inconsistent policies, scattered logs and unclear responsibility boundaries, further raising the value of unified cross-model security management. Third-party vendors form product systems covering access, execution and auditing by linking identity authentication, data governance and security operations systems. Overseas leading model companies have partnered with security vendors on defense projects, validating the industry path of combining model capabilities with security delivery systems: after vulnerabilities are discovered, asset location, remediation coordination, patch verification and continuous tracking are still required. Traditional cybersecurity vendors' core barriers come from data connections formed through long-term deployment, disposal permissions granted by customers and industry delivery experience, enabling them to identify risks in combination with business context and embed remediation into production processes. Domestic AI security commercialization has already landed, and industry profit realization depends on revenue structure and delivery efficiency Domestic vendors have disclosed AI security-related revenue growth, and new protection demand is translating into actual revenue contribution. There are differences in the statistical scope of each company, and it is necessary to distinguish standalone AI product revenue from AI-enabled traditional product revenue, and evaluate actual increments in combination with contract expansion, renewals and delivery costs. Commercialization will go through three stages: point protection, unified governance and continuous operations: in the initial stage, security gateways are procured around specific applications; subsequently, as the number of models and intelligent agents increases, unified identity, policy and auditing capabilities are expanded; ultimately, continuous monitoring, attack testing and security operation services are formed. The higher the degree of standardization, the easier it is for vendors to reduce repeated delivery costs and increase per-customer value. The industry's product focus will extend from pure detection to independent execution control. Model protection cannot fully eliminate prompt injection risks, and should combine least privilege, high-risk operation approval and downstream system authorization verification to limit the impact scope after detection failure. Coupled with domestic and foreign regulatory requirements for security assessment, risk records and incident reporting, vendors that can consolidate permissions, auditing and continuous monitoring into standardized products are expected to achieve sustained growth as customers' AI applications expand. Investment recommendation: screen targets around product implementation, customer expansion and profit recovery. Related companies include: Sangfor Technologies Inc., NSFOCUS Technologies Group, Asiainfo Security Technologies, Shenzhen Sinovatio Technology, Venustech Group Inc., Qi An Xin, Hangzhou Dbappsecurity Co., Ltd. and Topsec Technologies Group Inc. Risk warnings: enterprise AI deployment and security procurement fall short of expectations, traditional cybersecurity demand continues to come under pressure, intensifying competition leads to declines in product prices and gross margins, product protection effects and reliability fall short of expectations, profit recovery and cash flow improvement fall short of expectations, and valuation fluctuation risks.