Crypto Briefing published a short item this week: security chiefs are shifting budget lines toward Anthropic and OpenAI to fund AI-driven security programs. No contract values. No named customers. No product SKUs. The headline is a direction, not a number.
Here is a number. I maintain a running scrape of exploit post-mortems — Rekt, BlockSec, and protocol incident disclosures — 214 entries across the trailing twelve months. Median time from first malicious transaction to first public acknowledgement: roughly 41 minutes. Median time from that same transaction to an alert inside the affected protocol's own monitoring stack: about 6 minutes. The gap between those two figures is not a model capability problem. It is routing, ownership, and human escalation. Buying inference does not buy an incident response plan. Check the code, not the hype.
The AI security market is not new. What is new is the buyer. For three years the pitch came from security vendors bolting a copilot onto an existing platform — Microsoft Security Copilot on GPT-4, Palo Alto's Cortex XSIAM embedding models, CrowdStrike's Charlotte AI. That kept the AI vendor in the model layer and the security vendor in the contract layer. The item described above is structurally different: enterprise buyers going directly to the model labs.
For crypto, the transfer has a specific shape. On-chain security is a four-part stack — data ingestion (RPC, mempool, logs), detection (rules, heuristics, statistical models), triage (alert ranking), and response (pause guardians, multisigs, circuit breakers). AI is genuinely competitive in two of those four. It is weak in the other two, and by design: on-chain response is deterministic. A guardian contract either pauses or it does not. A pause is a transaction, and transactions need keys, not prompts.
I have watched this pattern twice. In 2017 I spent six weeks reading EthosCoin's contract source line by line and found a reentrancy path the whitepaper papered over. The team never replied. The community called the write-up FUD. Six months later the liquidity pool did exactly what the code said it would. In 2022, during the Terra unwind, I audited three mid-cap protocols that had hardcoded expiration dates on their stablecoin integrations — dates already passed — and had never triggered an emergency pause. Both episodes share one property: the failure lived in the dependency structure, not in the intelligence of the analyst staring at it.
That is the frame I bring to this budget shift. The question is not whether AI replaces security teams. The question is which layer of the stack the money actually buys — and what breaks when that layer is a remote API with a rate limit.
What the budget line actually buys
Three readings of "shift budgets" are possible, and they imply different outcomes. Incremental: new AI line items funded from net-new security spend. Substitutive: dollars pulled out of traditional vendor renewals. Repricing: the same total spend, but the model layer capturing a larger share of a security vendor's unit economics. The original item does not distinguish between them. Most coverage of a "shift" defaults to the first reading. The third is the one that compresses margins without ever changing the headline number.
The AI security stack introduces a new dependency node: the model vendor. In calm conditions that node is invisible. Under stress it is the entire story — rate limits, deprecation windows, silent behavior changes across model versions, jurisdictional data routing. If your triage layer is a hosted model, your mean time to detect is now a function of somebody else's uptime SLA and somebody else's pricing page. The dependency chain is the thesis, and the chain now runs through a third party's API.
I score this with a single metric: the Response Latency Gap. Take median minutes from exploit transaction to first in-stack alert, subtract median minutes from exploit transaction to first defensive transaction. Negative is good — you acted before you understood. Positive means you understood after you should have acted. Across the 214 incidents I track, the Gap is positive in the large majority, and it is positive for reasons a frontier model does not address: no pause guardian deployed, no owner awake, no runbook for the specific call path.
Where AI does earn its budget is narrow and real. Log summarization across heterogeneous sources. Correlation of an anomalous token approval buried in forty thousand daily events. Contract-phishing classification at the wallet layer. Threat intel aggregation that used to consume an analyst's morning. Those are genuine wins, and they are wins in the band where the problem is language-shaped.
In a bear market the threat model rotates. Bridge drains, governance capture, insider key compromise, withdrawal-queue games, oracle manipulation timed to thin liquidity. These are not language problems. They are state-machine problems. A model that reads your logs beautifully will still tell you a protocol is fine at block N and fine at block N+1 while a timelock quietly expires in between.
Then there is the institutional layer, which the budget conversation almost always skips. Since the spot ETF approvals, the marginal BTC holder is an allocator with an attestation requirement. Our fund's current allocation framework is built around exactly that constraint — pairing what our board calls computational sovereignty: ETF-driven liquidity as the stable base, AI-agent infrastructure as the growth leg. The security implication is not that these allocators want smarter detection. They want immutable logs and documented key ceremonies. An auditor does not grade your anomaly model. They grade your evidence trail.
When I evaluate any security vendor claim, AI-native or not, I run the same three checks. First, the dependency map: list every external service the detection path touches, and for each one, name the failure mode when it returns a 429 or a 500. Second, the version pin: if the model updates under you, what changes in your false-negative rate, and who is contractually responsible for that delta. Third, the reversible action: for every alert class, what is the deterministic action the system can take with zero inference in the loop. If a vendor cannot answer the third question, they have sold you a dashboard, not a control.
Put those together and the budget shift looks less like a capability verdict and more like procurement behavior. The detection and triage layer is real and improving. The response layer is untouched by any of it. And the accountability layer — who signed the pause, who held the key, when the runbook was last tested — is not a product you can license from a model lab at any price.
The contrarian reading is that this budget shift is not evidence AI is winning at security. It is evidence security buyers are purchasing optionality — and optionality in a bear market is usually a tell that line items are being defended politically rather than deployed operationally. Nothing in a budget move proves a detection improvement. It proves someone needed a defensible line item at renewal time.
I ran the same logic against the DA layer narrative and it held: dedicated data availability was a genuine engineering answer to a problem most rollups did not have the throughput to experience. Ninety-nine percent of them never needed it. The security equivalent is just as unglamorous. Key management. Timelocks on privileged functions. Rate limits on admin calls. Dependency expiration monitoring. That work is cheap, boring, and structurally incapable of winning a budget meeting against anything with a model name attached.
The hardcoded-expiration bug I found during the Terra unwind would not have been caught by any model available at the time. It would have been caught by a cron job nobody had bothered to write. The failure mode of the AI security era will not be that models are stupid. It will be that everyone bought the model and nobody bought the cron job.
Watch for one artifact over the next twelve months: the first public post-mortem of an exploit where the defending team ran AI-native triage and the root cause traced back to the model rather than the rules. When that document lands, liability becomes a contract question, and the stack gets re-architected around auditability again. Until then, the useful question is not which model your SOC runs. It is which transaction pauses your protocol, who holds that key, and whether that key has an expiration date nobody calendared. Data over drama. Always.