Margin of Safety #46: Next Opportunities in AI Native Security

Kinda obvious, but we wouldn’t bet on AI wrappers on legacy tools. We’d bet on true AI native security (explained)

We’ve previously commented on AI-native process automation. But we don’t think that’s the only place for AI-native capabilities. As AI drives down the marginal cost of production (e.g. for code, content, and increasingly decision-making), everyone benefits. This means attackers as well as defenders. We expect velocities to increase for savvy players across the board. We also expect new avenues of attack to open up. Much like the opportunity for software supply chain security only emerged as industry shifted to rely on open source, new avenues of attack — and needs for defenders — will emerge to combat AI enabled attackers.

As investors, we’ve noticed the trend is increasingly rotating away from AI-enabled wrappers on legacy categories and toward AI-native security primitives. In many cases, interesting primitives will only exist because the threat model itself has changed. The winners in this cycle will not be the companies that merely automate yesterday’s controls. They will be the ones that secure entirely new classes of behavior. We dug out four interesting categories below:

1. Enterprise Brand Defense: Protecting the Digital Footprint

Every enterprise now has an extensive digital footprint. Most are not prepared to defend it.

High fidelity deepfakes and autonomous social agents are making it possible to manufacture synthetic scandals at previously unprecedented speed and volume. Imagine an AI agent swarm seeding a convincing leaked CEO recording across social channels, timed precisely around earnings. Or more insidiously, AI used to amplify minor issues until they become substantial business problems [1]. The technical barrier to this scenario is falling quickly. Legal barriers remain — pump and dump scams are emphatically securities fraud in the United States — but there may be legal workarounds via loosely regulated betting platforms. A quick search reveals a number of betting markets that we can easily imagine people attempting to influence with public deepfakes, especially as the markets draw closer to close [2]. As a business leader or government official, this is surely undesirable.

The naive response is to focus purely on synthetic media detection. That is necessary but increasingly insufficient. The reality is that synthetic content is already becoming part of legitimate enterprise workflows, including marketing, customer engagement, and even internal communications. The question is no longer “Is this AI generated?” but rather “Is this authorized and accurate?”

If brands continue to have issues related to media manipulation, startup upside will shift. First, we expect to see interest in real time provenance and authenticity tracking that can operate in environments where AI generated media is normal, not exceptional. Second, toward automated takedown engines. These are AI systems that combine legal, technical, and platform workflows to neutralize misinformation at the speed of the social algorithm. If this category matures, brand protection will not live inside marketing budgets. It will include legal and potentially security or compliance spend as companies are forced to get ahead of the emerging business problem.

2. EDR for Agents: Securing the New Workforce

Enterprises aren’t just deploy autonomous agents across specific tasks; they’re also trying to figure out how to enable user-managed, desktop agents like Claude Code (and how to respond to employee demands for things like Open Claw or agentic browsers). Versus their task-specific counterparts, these agents are the wild west; dispatched against a wide variety of tasks, operating under the account and credentials of desktop users, and potentially executing fully unreviewed code.

Traditional Endpoint Detection and Response was built to watch users, not their agents. It assumes stable human capabilities and bounded automation. Desktop agents systems break both assumptions. Their workflows evolve, their tool usage expands, and their failure modes are often emergent rather than signature based.

On the task-specific side, agents deployed into roles from customer support to IT investigations are replacing desktop users with cloud processes. These agents are constrained in ways that their desktop cousins aren’t, but they’re relocating business functions to different points and radically different execution modes within the corporate IT environment.

In both these cases, businesses will need the equivalent of an agent-first EDR. The same failure modes that EDR once caught — suspicious behavior, lateral movement, tool misuse, data exfiltration, etc — have a new substrate in which to occur. This substrate is opportunity for builders.

3. Consumer Cybersecurity: Democratizing the Shield

Historically, high end security has been a luxury good.

Advanced fraud detection, identity protection, and threat intelligence were largely confined to enterprises because the unit economics did not work at consumer scale. AI is beginning to invert that equation. Defense is becoming cheaper to produce at exactly the moment offense is becoming more personalized.

The emerging threat profile is hyper personalized phishing. Models can already synthesize emails, messages, and voice calls tailored to an individual’s social graph, writing style, and behavioral patterns. Even in our personal lives, we’re seeing less generic spam and increasingly personalized, first-name spear phishing.

This opens a new solution space. We imagine the rise of personal AI guards. These are low cost, always on tools that screen calls, messages, and transactions for cognitive manipulation signals. A similar opportunity is verticalized protection for vulnerable populations, particularly the elderly and children, where AI can compress complex security judgments into simple binary trust signals. If pricing and UX converge correctly, consumer cyber may finally experience its long anticipated expansion moment.

4. Identity Microsegmentation: Siloing the Silicon

One of the quieter risks in the agentic transition is identity overlap.

Today, many agents, especially on the desktop, operate using credentials that are effectively extensions of their human creators. This creates an uncomfortable blast radius problem. Compromise the agent and you often inherit a meaningful slice of the human’s access graph.

The architectural answer is identity microsegmentation at the task level.

Think of it as moving from a master key model to a single use key paradigm, where each agent action runs with its own ephemeral, least privileged identity that expires the moment the task completes. The enforcement surface shifts from device or network boundaries to the identity plane itself.

For startups, this is a greenfield space albeit one with many players. However, an excellent solution will check a number of boxes that we aren’t seeing widespread across tooling: ease of integration, clarity of identity workflow and visibility, compatibility with existing agentic flows, etc. A best in class solution that checks these boxes has a unique opportunity to establish itself as a key enablement layer for the ongoing tech wave.

Our Outlook…

The most important pattern here is simple. The winning companies will not be the ones that merely add AI to existing products. They will be the ones that secure the new behaviors AI makes possible.

In a world where offensive capability is becoming abundant and automated, the scarce asset is trust. The enduring venture upside will accrue to the platforms that quietly become the infrastructure of that trust.

If you’re building something in this space, feel free to reach out to jpark@forgepointcap.com and kshih@forgepointcap.com.

This blog is also published on Margin of Safety, Jimmy and Kathryn’s Substack, as they research the practical sides of security + AI so you don’t have to.

[1] At least some evidence suggests that this was a factor in Cracker Barrel’s recent logo redesign, as reported here by the Wall Street Journal.

[2] Examples:

Jamie Dimon remaining at JPMC: https://kalshi.com/markets/kxjpmceochange/jamie-dimon-leaves-jpmorgan/jpmceochange

Tim Cook remaining at Apple: https://kalshi.com/markets/kxaaplceochange/tim-cook-leaves-apple/kxaaplceochange

Next departure from the trump cabinet: market 1, market 2, polymarket has an entire category(!) here