Security as Standing Consumption: Resilience Spend Outgrowing Convenience Spend in High-Income Markets by 2032openMediumorigin: briefs
Output
| Thesis probability | 76.3%from a 90.9% prior · 23 active evidence items |
| Reasonable range | 56% – 93% tick = prior · marker = posterior |
| Historical analogy strength | 55/ 100 · 20 analogues in the reference class |
| Current evidence strength | 99/ 100 · 23 active items |
| Evidence quality | 68/ 100 |
| Contradictory evidence | High |
| Confidence in probability | Medium |
| Next major confirmation signal | Unchanged as the decisive test: the FY2027 Gartner/IDC vendor-revenue print reconciled against the IANS/Artico CISO budget benchmark, in a year where total nominal IT spend grows <2%. Added near-term tell: whether agent-governance appears as a separately disclosed, separately priced revenue or budget line in Q4 FY2026 / Q1 FY2027 disclosures from PANW, CRWD, IBM, Okta or DigiCert — or whether it is bundled free into platform deals. Bundled free would confirm the deflation thesis and effectively settle sub-condition (a) against the thesis; separately priced with attach-rate disclosure would be the single strongest confirmation available this cycle. |
Posterior log-odds = prior log-odds (reference-class base rate) + sum of quality x independence weighted log likelihood ratios. Research-informed estimate until enough theses resolve for Brier calibration.
Formalized thesis
By 31 December 2032, spending on security and resilience — cyber protection, fraud/scam defense, physical/home security, defense-adjacent and civil-preparedness goods — grows faster than discretionary convenience spending in high-income markets, operationalized as: (a) enterprise cybersecurity budgets treated as non-discretionary, growing >10% CAGR 2026–2032 even in years of flat overall IT spend; (b) a majority of surveyed adults in the US/EU report paying for at least one dedicated security/identity/fraud-protection subscription; and (c) at least five OECD states legislate mandatory resilience procurement (energy, cyber, or stockpiles).
Source observations
- 2026-09-13Security is replacing convenience as the dominant consumer and corporate need — energy security, supply-chain security, cyber security (a single cyberattack broke Boston Scientific's guidance, not demand).
- 2026-09-14Security physical, energy, and digital is replacing convenience as the premium people and institutions will pay for. Cybersecurity budgets become non-discretionary as AI supercharges scams (FT: criminals using AI for scams), and energy security drives national LNG/nuclear procurement.
- 2026-09-25Security — physical, energy and digital — becomes a standing consumption category: Italy restarting nuclear, a drone strike on a UAE nuclear plant, Danish intelligence warning Russia could hit NATO within months, exchange hacks. Households and states both spend on resilience ahead of optimisation.
Causal mechanism
[inference] Loss aversion dominates gain-seeking once threat becomes salient and personal. AI-generated scams, deepfake voice fraud, ransomware on hospitals and utilities, drone strikes on infrastructure, grid failures and war proximity convert an abstract tail risk into a vivid, recently-experienced one. People and boards do not optimize expected value; they buy the elimination of a dreaded, uncontrollable, high-variance outcome — and they keep paying because cancelling protection requires an explicit act of self-exposure.
[inference] Historically resilience was expensive, technical and required behavioral discipline (patching, password hygiene, drills, generators, stockpiles). The friction removed is cognitive and operational: security is being packaged as a managed subscription, an insurance-like product, a bundled telco/bank/OEM line item, or an autonomous agent that acts without the user. The buyer no longer has to be competent — only willing to pay. [fact] Consumer-grade examples already shipping: bank-embedded scam detection, card-issuer identity monitoring, telco spam/scam call filtering, cloud-managed home cameras, managed detection and response (MDR) for SMEs.
[fact] AI on both sides of the ledger: generative models industrialize fraud (voice cloning, phishing at scale, synthetic identity) while the same models power behavioral detection, anomaly scoring, autonomous SOC triage and agentic response. [fact] Supporting stack: cloud-delivered SASE/zero-trust, identity infrastructure, edge/on-device inference for privacy-preserving detection, cheap IP cameras and sensors, behind-the-meter generation and storage, and digital identity/attestation schemes (eIDAS 2.0, mDL).
[inference] Expected loss avoided exceeds premium for the buyer; for the seller, security is the rare software category with negative price elasticity at the point of fear and high renewal rates. [fact] Insurance and regulation externalize the incentive: cyber insurers condition coverage on controls (MFA, EDR, backups), lenders and auditors condition terms on attestations, and liability regimes (EU NIS2, DORA, CRA, SEC disclosure rules) make non-spending a board-level personal risk. [inference] Once protection is a condition of transacting, it stops competing with convenience for wallet share and starts competing with rent.
[inference] The buyer must trust a vendor with the keys to the thing being protected — endpoints, identity, home video, financial credentials. This is the binding constraint: each vendor breach (SolarWinds, Okta, Change Healthcare, CrowdStrike's 2024 outage) is a trust shock that re-prices the category. Consolidation toward a few audited, insured, certified platforms is the likely resolution; certification regimes and government attestation act as trust substitutes.
[fact/inference] Three channels, in ascending order of penetration: (1) direct subscription (small, high-intent minority); (2) bundling into products people already buy — banks, card networks, telcos, ISPs, insurers, device OEMs, Amazon/Google home ecosystems — which is how consumer penetration crosses 50% without an explicit purchase decision; (3) statutory mandate and public procurement, which converts adoption into compliance. Enterprise distribution runs through MSPs/MSSPs, cyber insurers and cloud marketplaces.
[inference] Moderate and mostly data-side: threat intelligence, fraud graphs and device reputation improve with scale, giving incumbents a compounding detection advantage (a data network effect, not a social one). Negative externality version: as more entities harden, attackers concentrate on the unprotected, raising the private return to spending and producing a herding/ratchet dynamic. Standards and interoperability (SBOM, attestation, shared fraud signals between banks) add a coordination layer.
[inference] High in enterprise (agent deployment, policy configuration, integration debt, audit continuity, multi-year ELAs, platform consolidation discounts) and moderate-to-high in consumer (identity histories, camera footage archives, bundled pricing, inertia on autorenewal). Regulation raises switching costs further by attaching certifications to specific implementations. This is why the category's revenue is durable even when growth decelerates.
[fact] Regulation is predominantly a tailwind here, not a constraint: NIS2, DORA, the EU Cyber Resilience Act, UK Online Safety/APP fraud reimbursement rules, SEC cyber disclosure, CMMC in US defense supply chains, EU/NATO defense-spending floors, energy reliability standards. [inference] Counter-forces exist: privacy law limits surveillance-based detection, antitrust/consumer-protection scrutiny of junk-fee-style bundled protection products, budget politics on stockpiles, and the risk that mandates cap prices or commoditize baseline protection into 'must be free' (as happened with antivirus and credit monitoring).
Historical analogues
| Analogue | Period | Mechanism | Similarity | Occurred | Yrs to mainstream | Lesson | |
|---|---|---|---|---|---|---|---|
Video doorbells and DIY home cameras (Ring, Nest, Wyze) | 2015–2024 | Same protective motivation, but friction collapsed: no installer, no contract, cheap hardware, cloud subscription attached afterwards. | 66 | ✓yes | 7 | [fact] Went from niche to tens of millions of US households in under a decade, with attach-rate cloud subscriptions. [inference] This is the template for sub-condition (b): protection sold as a cheap device plus a small recurring fee, distributed by a platform, adopted by a majority within ~7 years. Friction removal, not threat level, was the swing variable. | |
EMV chip-card migration and PCI-DSS after mass card fraud | 2004–2017 | Liability shift plus industry standard forces universal upgrade; the payer is the merchant, the beneficiary is system-wide trust. | 65 | ✓yes | 10 | [fact] US EMV took ~11 years from EU rollout because the mandate was a private liability shift, not law. [inference] Where liability can be reassigned contractually, adoption is complete but slow; legislation compresses the timeline by ~3–5 years. | |
Fire insurance and municipal fire codes after the great urban fires (London 1666, Chicago 1871) | 1666–1900 | Catastrophe → private protection market → building codes and mandatory insurance → permanent infrastructure category. | 61 | ✓yes | 30 | [fact] Protection evolved from a private subscription (fire marks) into universal, code-mandated, insurer-enforced infrastructure. [inference] The longest-duration version of this mechanism: security categories that survive become invisible infrastructure with utility-like economics and regulated returns rather than high-growth software multiples. | |
Post-9/11 homeland and aviation security buildout (TSA, DHS, screening capex) | 2001–2010 | Salient catastrophic event converts protection from optional to mandatory; state legislates procurement and creates a permanent budget line that never reverts. | 59 | ✓yes | 3 | [fact] US homeland-security outlays roughly tripled within a decade and never returned to baseline. [inference] Ratchet effects in state security budgets are near-irreversible once institutionalized in an agency and a procurement statute — the legislative sub-condition (c) is the most durable of the three. | |
Identity-theft protection and credit monitoring after mass breaches (LifeLock, Equifax 2017) | 2005–2022 | Recurring personal-harm risk creates a consumer subscription category; breached firms distribute it free as remediation. | 59 | ✓yes | 12 | [fact] Category grew to billions in revenue but paid penetration stalled well below 50% in the US because free monitoring from card issuers, breach settlements and credit bureaus crowded out paid plans. [inference] Direct evidence that sub-condition (b) at >50% *paid* is the hardest of the three — it likely requires the survey to count bundled bank/telco/insurer protection lines. | |
Home alarm monitoring adoption (ADT and successors, US) | 1970–2005 | Physical threat salience plus recurring monitoring fee; crime-rate-driven, insurance-discount-supported. | 59 | ✓yes | 25 | [fact] Peaked around ~20–25% of US households despite decades of marketing and insurance discounts. [inference] Fear alone does not produce majority household penetration when install friction and monthly cost are high — the frictionless, hardware-light version is what crosses 50%. | |
Backup generation and home standby power after Texas Uri / California PSPS / European energy crisis | 2019–2026 | Reliability of a public utility ceases to be assumed; households and enterprises buy private firm capacity. | 59 | ✓yes | 5 | [fact] Standby generator and home-battery attach rates rose sharply in outage-exposed regions, and hyperscalers now contract private generation directly. [inference] Resilience spend concentrates geographically around experienced failures — national averages understate the behavior change; the thesis should be measured regionally as well as nationally. | |
Cyber insurance market formation and control mandates post-ransomware wave | 2019–2025 | Insurers price and then *mandate* security controls as a condition of coverage, converting best practice into procurement requirement. | 59 | ✓yes | 5 | [fact] Premiums spiked, then insurers made MFA, EDR and immutable backups underwriting prerequisites, pulling forward billions of tooling spend. [inference] Private liability transfer is a faster mandate channel than legislation and should be tracked as a leading indicator for sub-condition (a). | |
Bank deposit insurance and bank examination regime (FDIC, 1933–) | 1933–1945 | Systemic trust collapse → state-mandated, industry-funded protection scheme that becomes permanent, unquestioned infrastructure. | 59 | ✓yes | 5 | [fact] Became universal within a few years and has never been repealed. [inference] Where protection is a public good with free-rider problems, the state — not the household — becomes the buyer; the investable exposure then sits with suppliers and compliance vendors, not consumer subscription franchises. | |
Consumer antivirus subscriptions (Norton/McAfee era) | 1995–2010 | Household purchase of protection against an invisible digital threat, sold as an annual subscription via OEM bundling. | 57 | ✓yes | 8 | [fact] Reached majority PC penetration largely through OEM bundling, then was commoditized to zero by Microsoft Defender being made free and good enough. [inference] Consumer sub-condition (b) is achievable via bundling but the *paid* qualifier is fragile: platform owners absorbing baseline security into the OS/bank/telco destroys the standalone price point while raising penetration. | |
Automotive safety mandates (seatbelts, airbags, ABS, ADAS) | 1968–2022 | Safety features migrate from expensive option → marketing differentiator → legal requirement → invisible standard cost. | 55 | ✓yes | 15 | [fact] Each wave followed the same option→mandate path over 10–20 years and permanently raised unit content value. [inference] Terminal state of a successful security thesis is *embedded and mandatory*, which raises supplier volumes but transfers pricing power to the OEM/platform — good for content growth, bad for standalone vendor margins. | |
Water filtration and bottled water after contamination scares (Flint, Cryptosporidium, PFAS) | 1993–2024 | Loss of trust in a public utility drives private, recurring household protection purchases. | 55 | ✓yes | 10 | [fact] Household water filtration crossed a majority of US homes in under two decades once the product became cheap and passive. [inference] Loss of confidence in a public guarantee reliably creates a mass-market private protection category — the analogue for 'fraud protection' if trust in banks/telcos to stop scams erodes further. | |
European defense spending reversal after Russia's invasion of Ukraine | 2022–2026 | Geopolitical shock converts a 30-year declining budget line into a legislated floor with multi-year procurement commitments. | 52 | ✓yes | 3 | [fact] NATO members moved from chronic 2%-target undershoot to legislated increases and multi-decade procurement programs within 2–3 years. [inference] Strongest live evidence for sub-condition (c): state resilience spend re-rates fast and is politically ratcheted, though delivery lags funding by 3–5 years. | |
NERC CIP critical-infrastructure standards after the 2003 Northeast blackout | 2003–2015 | Infrastructure failure → mandatory, auditable reliability and cyber standards with financial penalties for utilities. | 51 | ✓yes | 6 | [fact] Created a permanent, penalty-enforced compliance spend category across North American utilities. [inference] Energy-sector resilience mandates are the most likely of the five OECD statutes to materialize, because the regulator, the asset owner and the ratepayer recovery mechanism already exist. | |
Sarbanes-Oxley compliance spending after Enron/WorldCom | 2002–2008 | Trust failure → statutory mandate → non-discretionary recurring spend with personal liability attached to executives. | 50 | ✓yes | 3 | [fact] SOX created a multi-billion-dollar permanent audit/controls market within ~3 years. [inference] Personal officer liability is the single most powerful converter of discretionary spend into mandatory spend — SEC cyber-disclosure and NIS2 management liability replicate this exact design. | |
AML/KYC compliance spending after the USA PATRIOT Act and FATF expansion | 2001–2020 | Statutory obligation with criminal liability makes financial-crime prevention a permanently growing, headcount-heavy cost centre. | 49 | ✓yes | 5 | [fact] Global AML compliance spend grew for two decades at rates far above bank IT spend and proved fully insensitive to the credit cycle. [inference] This is the closest structural precedent for the 'non-discretionary even in a flat-budget year' claim in sub-condition (a): mandated crime-prevention spend is counter-cyclical to the budget, not pro-cyclical. | |
GDPR-driven privacy and data-governance spending | 2016–2021 | Regulation with turnover-linked fines creates a new mandatory enterprise budget category from near zero. | 48 | ✓yes | 3 | [fact] A DPO/privacy-tech industry appeared within three years of enforcement date. [inference] Mandates create spend faster than fear does, but the spend is capped at the compliance floor — growth decays to GDP+ once the checkbox is met, which is the main risk to the >10% CAGR sub-condition. | |
Y2K remediation programs | 1996–2000 | Salient, date-certain catastrophic risk drives emergency non-discretionary IT spend across every enterprise simultaneously. | 48 | ✓yes | 3 | [fact] Enormous spend surge followed by a sharp 2000–2002 air pocket. [inference] The clearest failure mode for this thesis: fear-funded spend with a defined terminal date mean-reverts violently. Durability requires a *recurring adversary*, which cyber and fraud have and Y2K did not. | |
Post-COVID pandemic preparedness stockpiles and PPE capacity | 2020–2024 | Catastrophic event triggers state and corporate stockpiling mandates and domestic capacity subsidies. | 48 | ✓yes | 2 | [fact] Enormous immediate procurement surge; by 2023–24 many national stockpile programs were quietly defunded and domestic PPE producers failed. [inference] Resilience mandates without a permanent statutory funding mechanism decay within ~3 years of the salient event — sub-condition (c) should be scored on *binding statutes with enforcement*, not announcements. | |
Cold War civil defense and household fallout shelters | 1950–1965 | Maximal threat salience plus state encouragement of household preparedness purchases. | 46 | ✗no | 0 | [fact] Despite peak fear and federal promotion, private shelter construction reached only low single-digit percentages of US households. [inference] Households refuse resilience purchases that demand large capex, effort and confrontation with the threat; the pattern only works when protection is cheap, passive and recurring. This is the base-rate counterweight to the household leg of the thesis. |
[definition] The reference class is 'threat-salience-driven reclassification of protection from discretionary to non-discretionary spend', split into three sub-classes matching the three resolution conditions. Sub-class A (enterprise mandated-protection budgets): SOX, GDPR, AML/KYC, PCI-DSS/EMV, NERC CIP, cyber insurance control mandates, Y2K — 7 cases, 7 produced a durable multi-year spend category, but 2 (Y2K, GDPR) decayed to low-growth within ~5 years of the compliance floor being met, and only those with a *recurring adaptive adversary* (AML, PCI, cyber insurance) sustained double-digit growth for a decade-plus. Sub-class B (household paid protection subscriptions): antivirus, identity/credit monitoring, monitored alarms, video doorbells, water filtration, fallout shelters — 6 cases, 4 reached majority or near-majority penetration, 2 stalled badly (alarms ~25%, shelters <5%); the discriminating variable is not fear level but friction and price point, and in 2 of the 4 successes the *paid standalone* revenue was subsequently absorbed into a platform bundle or given away free. Sub-class C (state resilience mandates): post-9/11 DHS, European defense post-2022, NERC CIP, pandemic stockpiles, fire codes, FDIC — 6 cases, 6 legislated within 2–6 years of the salient event, but 1 (pandemic stockpiles) was materially defunded within 4 years. [base-rate summary] Across 20 analogues: 19 of 20 exhibited the pattern in some form; median time from salient trigger to mainstream/mandated status ≈ 5–6 years (state mandates 2–6 years, enterprise compliance 3–6 years, household penetration 7–25 years); the failure modes are reversion after a date-certain threat passes, defunding once salience fades, and commoditization of the paid consumer layer by platform bundling.
Caveats: [caveat] Selection bias: security categories that became invisible infrastructure are easy to recall; the many micro-panics that produced no durable spend (bioterror home kits, EMP preparedness, most disaster-prep retail) are under-sampled, so the 19/20 hit rate overstates the unconditional base rate. [caveat] Composite resolution: the thesis requires 2 of 3 conditions, and the three sub-classes have very different base rates — (a) and (c) are high-probability given existing NIS2/DORA/CRA/CMMC/defense-floor legislation already in force, while (b) is the genuine binding constraint and historically the most likely to fail on the word 'paying'. Definitional drift in the survey instrument (counting bundled bank/telco/insurer protection vs standalone subscriptions) could flip (b) by 20+ points, so the metric is partly a measurement choice rather than a fact about the world. [caveat] Analogue non-independence: SOX, GDPR, AML, NIS2 and DORA are the same regulatory technology applied serially by an overlapping policy community — they are perhaps 2–3 independent observations, not 5. Likewise antivirus, identity monitoring and cyber insurance share the same underlying threat generator. [caveat] Denominator risk: the thesis is relative (security > convenience). In a nominal-5%-rates, high-inflation regime both numerator and denominator move; a convenience-spend collapse driven by a consumer recession could satisfy the relative claim without any security re-rating, and conversely AI-driven cost deflation in security tooling could cut vendor revenue growth while *protection intensity* rises — spend is an imperfect proxy for the behavioral shift. [caveat] Commoditization asymmetry: the historical record shows adoption and vendor economics decouple. Seatbelts, antivirus, credit monitoring and deposit insurance all reached universality while destroying or socializing the standalone profit pool. Investable exposure therefore depends on where the mandate lands in the value chain, not on whether the thesis resolves TRUE. [caveat] Trigger dependence: most analogues were detonated by a single vivid catastrophe. The 2026–2032 path is materially conditional on whether a mass-casualty cyber/infrastructure event or a NATO-adjacent kinetic escalation occurs; absent a trigger, the timeline skews to the slow end (10+ years) and (b) likely fails.
Evidence
| # | Claim | Direction | Strength | Quality | Indep. | Weight | LR | Wtd log-LR | Kind | Source | Date |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 0 | Gartner/IDC vendor-side forecasts put global information-security end-user spending growth in the low-to-mid teens through 2026 (~$210-240B base), i.e. roughly 2-3x total IT spend growth — consistent with sub-condition (a). | supports | moderate | 0.70 | 0.55 | 0.39 | 2.00 | +0.267 | Consensus expectation | Gartner / IDC security spending guides (vendor-survey methodology) | 2025-2026 |
| 1 | CISO budget benchmarks (IANS/Artico) show average enterprise security budget growth decelerating to mid-single digits (4-8% y/y) since 2023 versus ~17% in 2022, and security's share of IT budget plateauing near 12-13% — directly threatens the '>10% CAGR with no year below +7%' floor. | contradicts | strong | 0.65 | 0.80 | 0.52 | 0.33 | -0.571 | Observed fact | IANS Research / Artico Search CISO Compensation & Budget Benchmark | 2024-2025 |
| 2 | Binding resilience/cyber procurement law is already largely in force across OECD: EU NIS2 (transposition from Oct 2024), DORA (applied Jan 2025), Cyber Resilience Act (obligations from 2026-2027), UK Cyber Security and Resilience Bill, US CMMC phase-in from Nov 2025, Japan Active Cyber Defense law (2025) — sub-condition (c) is close to pre-satisfied. | supports | strong | 0.90 | 0.70 | 0.63 | 3.00 | +0.692 | Observed fact | EU Official Journal, DoD 48 CFR CMMC final rule, national statutes | 2024-2026 |
| 3 | NATO's 2025 Hague commitment to 5% of GDP (3.5% core defense + 1.5% explicitly for resilience/critical infrastructure) creates a statutory-adjacent, multi-decade civil-preparedness procurement line in 20+ OECD states. | supports | strong | 0.85 | 0.60 | 0.51 | 3.00 | +0.560 | Observed fact | NATO Hague Summit declaration; EU ReArm/Readiness 2030 | 2025-06 |
| 4 | Reported fraud losses keep compounding (FBI IC3 ~$16.6B in 2024, +33% y/y) and AI voice-cloning/deepfake scams are now mainstream press, raising threat salience — the loss-aversion trigger the mechanism depends on. | supports | moderate | 0.80 | 0.80 | 0.64 | 2.00 | +0.444 | Observed fact | FBI IC3 annual report; FT reporting on AI-enabled scams | 2025-2026 |
| 5 | A single cyberattack broke Boston Scientific's guidance (not demand), and enterprises (NVDA, PLTR, Booz Allen) restricted a frontier model vendor purely over data-handling fears — evidence that cyber risk is now a P&L and procurement gate, not an IT preference. | supports | moderate | 0.60 | 0.70 | 0.42 | 2.00 | +0.291 | Observed fact | Daily brief 2026-09-13 / 2026-09-14 | 2026-09 |
| 6 | Mandatory reimbursement regimes (UK APP fraud reimbursement from Oct 2024, EU PSD3/PSR drafts, card-network zero-liability) shift fraud cost onto banks and issuers — making consumer protection free at point of use and structurally suppressing paid consumer security subscriptions, the core of sub-condition (b). | contradicts | strong | 0.75 | 0.85 | 0.64 | 0.33 | -0.700 | Observed fact | UK PSR policy statement; EU PSD3 file | 2024-2026 |
| 7 | Historical precedent inside the same category: bundled free Microsoft Defender collapsed the paid consumer antivirus market, and breach-response credit monitoring is routinely given away for free after incidents — baseline protection commoditizes to zero price rather than becoming a majority paid subscription. | contradicts | strong | 0.80 | 0.70 | 0.56 | 0.33 | -0.615 | Observed fact | Gen Digital/NortonLifeLock consumer segment growth; AV market history | 2016-2026 |
| 8 | US monitored-alarm penetration has hovered in the ~20-30% of households range for three decades despite repeated crime and disaster fear cycles; video doorbells scaled on convenience+one-time hardware, not on recurring monitoring subscriptions. | contradicts | strong | 0.70 | 0.80 | 0.56 | 0.33 | -0.615 | Observed fact | ADT/Parks Associates household penetration data | 2019-2025 |
| 9 | Current consumer attention data shows the fastest-rising query clusters are convenience/delegation (ai phone assistant, ai agent builder, cloud computing jobs) and entertainment (Netflix +10.3), with no consumer security cluster in the movers — the household leg of 'security beats convenience' is not visible in behavior today. | contradicts | moderate | 0.60 | 0.85 | 0.51 | 0.50 | -0.354 | Observed fact | System attention movers, 2026-09-25 | 2026-09-25 |
| 10 | Security equities re-rate violently on threat headlines (CRWD/ZS +12%, PANW +11% on an AI-safety narrative day) and already carry high pricing scores (CRWD 89, PANW 84) — the market already treats cyber as non-discretionary, meaning the thesis is partly priced even if true. | supports | weak | 0.50 | 0.35 | 0.17 | 1.30 | +0.046 | Observed fact | Daily brief 2026-09-14; internal pricing scores | 2026-09 |
| 11 | Platform consolidation and agentic SOC automation are deflationary to unit pricing: vendors bundle point products free to win multi-year platform deals, and AI triage substitutes for analyst headcount — enterprise 'spend' can rise in seats/coverage while vendor revenue and budget dollars grow slower than 10%. | contradicts | moderate | 0.55 | 0.70 | 0.39 | 0.50 | -0.267 | AI inference | Vendor platformization disclosures (PANW, CRWD flex licensing) | 2024-2026 |
| 12 | Private resilience procurement is already running ahead of statute on the energy side: Amazon's $8B generator order, Meta funding gas plants, Mitsui LNG contracted for data centers, Italy reversing its nuclear ban — firms are buying guaranteed electrons as a budgeted resilience line. | supports | moderate | 0.75 | 0.65 | 0.49 | 2.00 | +0.338 | Observed fact | Daily briefs 2026-09-14 to 2026-09-25 | 2026-09 |
| 13 | Cyber insurers now condition coverage and pricing on specific controls (MFA, EDR, immutable backups), and auditors/lenders increasingly require attestation — converting protection spend from optional to a condition of transacting. | supports | moderate | 0.70 | 0.60 | 0.42 | 2.00 | +0.291 | Observed fact | Marsh/Aon cyber insurance market reports | 2024-2026 |
| 14 | Household budget stress is severe and worsening (7.45% mortgage rates, 65 months of above-target inflation, long-term unemployment third-highest since the GFC, visible consumer bifurcation), which historically causes churn in optional add-on subscriptions of exactly the identity/monitoring type. | contradicts | moderate | 0.70 | 0.55 | 0.39 | 0.50 | -0.267 | Observed fact | Daily briefs 2026-09-13 to 2026-09-25 | 2026-09 |
| 15 | Trust-shock fragility is demonstrated: vendor-side failures (SolarWinds, Okta, Change Healthcare, CrowdStrike's 2024 global outage) each re-priced the category and slowed consolidation — the mechanism's binding constraint (trusting a vendor with the keys) has already broken at least four times. | contradicts | moderate | 0.75 | 0.70 | 0.52 | 0.50 | -0.364 | Observed fact | Incident record 2020-2024 | 2020-2024 |
| 16 | Agent governance — per-agent identity, delegated authority, audit trails, kill switches, millisecond containment — is being established as a distinct recurring enterprise budget line via Nvidia's Open Agent Safety Platform (100+ partners, IBM, DigiCert, Palo Alto, Fujitsu, Palantir) and the Vera CPU for agents. This is incremental non-discretionary spend that did not exist in the 2024 baseline and sits on top of, not inside, legacy security budgets. | supports | moderate | 0.60 | 0.70 | 0.42 | 2.00 | +0.291 | Observed fact | Daily briefs 2026-09-28 to 2026-09-30 | 2026-09 added 2026-10-01 |
| 17 | Cybersecurity now ranks above Cloud and Semiconductors in sector flow readings, indicating capital is treating security as a growth adjacency to AI capex rather than a cost centre. | supports | weak | 0.50 | 0.35 | 0.17 | 1.30 | +0.046 | Observed fact | Daily brief 2026-09-30 flow data | 2026-09-30 added 2026-10-01 |
| 18 | The US federal government chose a voluntary, non-statutory AI accord over binding safety legislation, leaving the private sector to define the agent-governance standard. Private standards are faster to adopt but easier to under-fund and decommit than statute, weakening the 'protection becomes a condition of transacting' leg at the AI layer. | contradicts | moderate | 0.65 | 0.75 | 0.49 | 0.50 | -0.338 | Observed fact | Daily brief 2026-09-30 | 2026-09-30 added 2026-10-01 |
| 19 | The largest consumer attention riser is Streaming & Digital Entertainment (+107.2, Netflix-dominated), with Digital Payments (+65.7), Cloud (+55.8), Advertising (+52.9) and Space (+33.4) completing the list and no consumer security cluster present. A second consecutive monthly snapshot shows households chasing convenience and entertainment, not protection. | contradicts | moderate | 0.55 | 0.80 | 0.44 | 0.50 | -0.305 | Observed fact | System attention movers, 2026-10-01 | 2026-10-01 added 2026-10-01 |
| 20 | Household financial capacity for optional add-on subscriptions deteriorated further: consumer confidence at a 12-year low of 81.9, 9.3m student-loan borrowers in default, 30-year mortgage at 7.45%, and aggregate spending explicitly attributed to a top-quintile AI wealth effect rather than wage growth. Paid identity/monitoring products are the archetypal cancellation candidate in this environment. | contradicts | moderate | 0.75 | 0.50 | 0.38 | 0.50 | -0.260 | Observed fact | Daily briefs 2026-09-25 to 2026-10-01 | 2026-10 added 2026-10-01 |
| 21 | A global term-premium shock — 10-year at 5.33% (highest since 2002), UK 30-year gilts above 6%, long end rising despite a soft core PCE print — raises the funding cost of exactly the statutes sub-condition (c) depends on (NATO's 1.5% resilience line, strategic stockpiles, firm-capacity obligations). These are the easiest budgets to legislate and the easiest to quietly defer, which is the historical post-COVID stockpile pattern. | contradicts | moderate | 0.70 | 0.60 | 0.42 | 0.50 | -0.291 | AI inference | Daily briefs 2026-09-29 to 2026-10-01 | 2026-10-01 added 2026-10-01 |
| 22 | Civil-preparedness stockpiles are now being actively drawn on and infrastructure actively attacked: the White House reportedly asked Germany and France to release diesel stockpiles amid a refining/distillate crisis, following a drone strike on a UAE nuclear plant and Danish intelligence warnings of possible Russian action against NATO within months. Stockpile depletion under live stress is the standard trigger for mandated replenishment statutes. | supports | moderate | 0.60 | 0.65 | 0.39 | 2.00 | +0.270 | Observed fact | Daily briefs 2026-09-29 to 2026-10-01 | 2026-10-01 added 2026-10-01 |
| 23 | An emerging AI credit cycle — Nvidia vendor financing guarantees to chip buyers, rising neocloud leverage, non-tech firms levering into GPUs — creates a channel through which the newly-minted agent-governance budget line could be cut with AI capex, removing the main new source of security budget growth before the 2026-2032 window completes. | contradicts | weak | 0.50 | 0.60 | 0.30 | 0.77 | -0.079 | Speculative hypothesis | Daily brief 2026-10-01 | 2026-10-01 added 2026-10-01 |
Stage of adoption
Enterprise cyber remains on the SOX/EMV mandate-driven path at early majority, and agent governance has opened a second S-curve behind it at the innovator stage (closest analogue: SOX 404 attestation tooling in 2003-04, or PCI-DSS in 2006 — a compliance architecture defined before the statute, then codified). Consumer protection has, if anything, slid further toward the antivirus-commoditization path. State resilience procurement is at early majority on a post-9/11 DHS trajectory but now facing the post-COVID stockpile defunding risk under a term-premium shock.
- ✓Statutory scaffolding in force across OECD (NIS2, DORA, CRA, CMMC, Japan ACD, UK CSR Bill) — sub-condition (c) effectively near-resolved on count
- ✓Threat salience high, recurring and now kinetic as well as digital (drone strike on UAE nuclear plant, NATO-proximity warnings, refining crisis, exchange hacks)
- ✓Insurance, audit and procurement gating makes controls a condition of transacting
- ✓Enterprise distribution mature (MSSP/MSP, cloud marketplaces, cyber insurers)
- ✓Corporate energy-resilience procurement in visible dollar flow (Amazon generators, Meta gas plants, Mitsui LNG, Italy nuclear reversal)
- ✓NEW: a genuinely new non-discretionary enterprise category — agent identity, containment and audit — has a reference architecture, 100+ partner ecosystem and named buyers, which is the strongest mechanism-confirming development of the last quarter
- ○Consumer willingness to pay explicitly remains far below 50% and is now compounded by a 12-year-low confidence print and mandatory bank reimbursement regimes — sub-condition (b) looks close to dead
- ○Sustained >10% enterprise budget growth unproven: CISO benchmarks still mid-single-digit against low-teens vendor-revenue forecasts; the measurement gap is unresolved
- ○Agent governance is at innovators/early-adopter stage with no disclosed revenue line yet — it is a promise of budget, not yet budget
- ○Fiscal capacity for mandated resilience procurement is deteriorating at a 5.33% 10-year and 6% 30-year gilt
- ○No standardized audited trust/certification regime for consumer security vendors
- ○Household resilience goods still event-driven, not budgeted recurring
Scenarios
A systemic, televised event — an AI-orchestrated fraud wave that empties retail accounts at scale, or a multi-day grid/cloud outage traced to state actors — makes protection legally compulsory and emotionally non-negotiable. All three sub-conditions resolve TRUE: enterprise cyber compounds >12% with a floor above 7% even in flat-IT years because it is carved out of IT budgets entirely and funded like insurance; bundled bank/telco/OEM 'protection lines' cross 50% adult penetration as explicitly priced line items (the EMV/airbag path); OECD statutes multiply past five into stockpile and firm-capacity mandates. Security vendors gain pricing power, defense and firm-power backlogs extend past 2035, and convenience/entertainment spend loses share outright in a high-rate, low-real-income regime.
The composite resolves TRUE on (c) plus a contested (a). Resilience statutes are already in force in well over five OECD states and expand; enterprise cyber grows high-single to low-double digits — comfortably faster than total IT but with at least one sub-7% year during the 2027-2029 cost-of-capital squeeze, making (a) a judgment call between vendor-revenue and CISO-budget measurement. Sub-condition (b) FAILS: consumer protection is absorbed into banks, card networks, telcos and device OEMs as a free or invisible feature rather than a majority-paid subscription, exactly as antivirus and credit monitoring were. Net: the thesis is directionally right and economically real, but the value accrues to distributors and compliance-gated incumbents, not to standalone consumer security brands — and much of the enterprise leg is already priced (CRWD 89, PANW 84).
Security follows the antivirus/commoditization path on both legs. Agentic AI defense collapses the cost of adequate protection; hyperscalers and platform vendors bundle baseline security to zero marginal price; consolidation and 'good enough' free tiers cap budget growth at 5-7%, breaking sub-condition (a)'s floor. Mandatory reimbursement regimes make consumer fraud protection a bank liability, killing (b) outright. A 2027-2029 fiscal/consumer recession forces resilience mandates to be delayed or defunded (the post-COVID stockpile pattern: build, then quietly let it expire), and a major vendor trust shock — a second CrowdStrike-scale outage or an identity-provider breach — triggers category-wide churn and multiple compression. Only (c) holds; composite resolves FALSE, and the security trade turns out to have been a 2026 narrative hedge on AI capex rather than a durable wallet-share migration.
Indicators
- ·Cyber budget line items being moved out of IT budgets into risk/insurance or board-mandated reserves in 10-K/annual-report disclosure
- ·Gartner/IDC security spend growth staying >2x total IT spend growth in a year when total IT grows <2% nominal — the explicit elasticity test
- ·Bank, telco and card-issuer disclosures showing a separately priced 'protection' subscription ARPU line with >20% attach growth
- ·New OECD statutes with procurement-linked enforcement: firm-capacity obligations, strategic stockpile mandates, or CRA-equivalents outside the EU
- ·Defense and firm-power backlog extension (LMT/NOC/GD/LHX book-to-bill >1.2; GEV/VRT/ETN multi-year backlog coverage)
- ·Cyber insurance attach rates and premium growth re-accelerating with control-conditioned underwriting
- ·Enterprise on-prem/sovereign AI deployments growing faster than public-cloud AI inference, indicating security-driven architecture choices
- ·Household backup generation and home standby power unit sales becoming non-event-correlated (sales that do not decay after the last outage)
- ·IANS/CISO benchmark surveys showing another year of sub-7% average security budget growth
- ·Consumer attention data continuing to favor convenience/delegation queries (ai phone assistant, ai agents) with zero security cluster in the movers
- ·Hyperscaler or OS vendor bundling SOC/EDR/identity at zero incremental price (the Defender playbook applied to enterprise)
- ·Extension of mandatory fraud reimbursement to the US/EU, removing the consumer's reason to buy protection
- ·Gen Digital-type consumer security revenue stuck in low single digits with rising churn
- ·Any statutory resilience mandate being delayed, defunded or sunset (the post-COVID stockpile pattern)
- ·A vendor-side trust shock (outage or breach at a major security/identity provider) causing multi-quarter churn
- ·Security vendor revenue growth decelerating while seat/coverage counts rise — evidence of price deflation from platformization and AI automation
- ·Measurement ambiguity: vendor revenue (Gartner/IDC, ~12-15%) versus buyer budget surveys (IANS, ~4-8%) can resolve sub-condition (a) either way — the definition chosen will decide the thesis
- ·Whether consumer protection is priced explicitly (EMV/airbag path, thesis TRUE on b) or bundled to zero (antivirus/credit-monitoring path, thesis FALSE on b)
- ·Whether agentic AI is net-inflationary (new attack surface, more spend) or net-deflationary (automated defense, fewer analysts, cheaper adequate protection) to security budgets
- ·Fiscal capacity under a ~5% risk-free rate and $365tn global debt: resilience mandates are the easiest statutes to pass and the easiest budgets to quietly defer
- ·The next vendor trust shock — a CrowdStrike-scale outage or identity-provider breach re-prices the whole category and delays consolidation
- ·Whether the European threat environment (Russia/NATO proximity) persists or de-escalates, since it underwrites both the defense and civil-preparedness legs
Value pools
| Layer | Emerging need | Opportunity | Becomes | Tickers |
|---|---|---|---|---|
Enterprise security platforms (consolidated, audited, insurable) | Boards need one attestable control plane that satisfies NIS2/DORA/CMMC/SEC disclosure and is acceptable to cyber underwriters | Compliance-gated platform consolidation: fewer vendors, multi-year ELAs, audit-continuity lock-in; revenue durability even when growth decelerates | mandatory infrastructure | |
Identity, attestation and fraud-graph data | Proving a human, a device or an agent is who it claims to be when generative AI makes voice, video and documents unreliable | Data-side network effects: fraud graphs and device reputation compound with scale; becomes the toll booth on every AI-agent transaction | becomes scarce | |
Payments rails as embedded fraud defense | Reimbursement mandates push liability onto issuers and networks, forcing them to buy/build detection rather than sell it to consumers | Networks and issuers capture the consumer security budget invisibly via interchange and premium card fees — they, not security brands, win sub-condition (b)'s economics | gains pricing power | |
Baseline consumer protection (antivirus, credit monitoring, standalone identity subs) | Households want protection but will not sign up for a fourth subscription at 7.45% mortgage rates | Negative: the category commoditizes into free bundles from OS vendors, banks and telcos | becomes abundant | |
Firm power and behind-the-meter resilience | Guaranteed electrons for data centers, hospitals, factories and increasingly households — reliability purchased rather than assumed | Contracted backlog owners of generation, switchgear, thermal management and grid EPC; the highest-conviction and least-priced leg of the resilience trade | becomes scarce | |
Defense and civil preparedness procurement | NATO's 1.5% resilience tranche plus munitions/air-defense restocking creates decade-length statutory demand | Multi-year backlog with sovereign counterparties and inflation escalators; low cyclicality versus consumer discretionary | mandatory infrastructure | |
Sovereign / on-prem AI and data residency | Enterprises restricting frontier model vendors over data handling (NVDA, PLTR, Booz Allen precedent) must run inference where they control the data | Raises the cost per unit of AI adoption and shifts spend from public inference rental to owned/controlled stacks and edge silicon | gains pricing power | |
Risk pricing, underwriting and certification | Someone must price resilience risk and certify controls for insurers, lenders and auditors | Cyber underwriting with control-conditioned coverage; ratings and attestation data become the arbiter of who can transact | becomes scarce | |
Physical security and public-safety technology | Institutions (schools, retail, municipalities) buy sensing, response and evidence infrastructure as a budgeted line, not an event purchase | Recurring software attached to hardware with municipal/statutory procurement cycles | mandatory infrastructure | |
Household hard-asset self-defense | Sovereign borrowing-cost anxiety and $365tn global debt push savers toward non-counterparty stores of value | Gold and hard assets as the household-level resilience allocation — currently penalized by a hawkish Fed but structurally on the same behavioral axis | new risk | |
Attention and convenience wallet share | None — this is the funding source; recurring protection and utility bills crowd out optional entertainment/leisure subscriptions | Negative: churn risk in ad-funded and subscription entertainment, and in travel/leisure discretionary | loses pricing power |
The first-order trade (buy cybersecurity) is already the market's reflexive hedge on AI capex risk and is priced accordingly — CRWD at 89 and PANW at 84 on internal pricing scores are the theme being right and the entry being wrong. The second-order insight is that security will follow the seatbelt/airbag/EMV path, not the subscription path: protection wins by disappearing into products people already buy, which means the consumer leg of this thesis (sub-condition b) most likely fails as a measured survey outcome while the economics of it accrue entirely to distributors — card networks, issuers, telcos, device OEMs and banks — who capture a fraud-defense rent inside interchange and premium fees without ever selling a security product. Third-order: mandatory reimbursement and free bundling mean the marginal dollar of consumer resilience spend does not go to identity subscriptions at all, it goes to electrons and hard assets — the backup generator, the heat pump, the gold, the stay-put renovation — which is precisely where the attention data says the market has not marked it (LOW, HD, SHW, EOG all in the not-priced bucket). Fourth-order: agentic AI is the bidirectional wildcard. It industrializes fraud (inflationary to defense budgets) and it automates defense (deflationary to defense revenue), so enterprise security coverage can expand while vendor dollars compress — meaning the durable exposure is not the software vendor but the compliance gate (attestation, ratings, insurance) and the physical chokepoint (firm capacity, switchgear, munitions, skilled trades) whose supply cannot be automated away. The single highest-asymmetry expression of this thesis is therefore NOT cyber software; it is contracted-backlog owners of resilience hardware and power, bought while the narrative score (power demand 85, grid 77) runs 40+ points ahead of the pricing score (34, 55).
- ·Standalone consumer security and identity-protection brands — bundled to zero by OS vendors, banks and telcos, exactly as antivirus was by Microsoft Defender
- ·Point-product cybersecurity vendors without a platform: consolidation into audited, insurable suites strips their pricing power and renewal economics
- ·Per-seat-priced software generally — enterprises now pay for measurable labour substitution and compliance outcomes, not headcount licenses (Adobe's soft guidance is the template)
- ·Subscription entertainment and attention platforms competing for the same crowded household wallet at 7.45% mortgage rates (NFLX, DIS, RBLX, TTD, APP)
- ·Discretionary travel, cruise, lodging and timeshare exposure as recurring resilience and utility costs ratchet up (RCL, ABNB, MAR, TNL, BKNG)
- ·Homebuilders and turnover-linked consumption: 7.45% mortgages plus resilience-driven stay-put behaviour freeze transaction volume (LEN, DHI, PHM, TOL)
- ·Long-duration, low-cap-rate real estate whose moat was cheap capital against a 5.4% long bond (O, SPG, and net-lease roll-ups broadly)
- ·Pure equity-funded compute landlords and second-tier AI capex — the drawdown, when it comes, is a financing event and they carry no contracted backlog
- ·Consumer-facing fintechs relying on fee income from optional protection add-ons as mandatory reimbursement regimes make the service free at point of use
- ·Governments and firms that defer resilience mandates for fiscal reasons — they absorb the tail risk the spenders transferred away, and pay for it in a single non-linear event
Probability history
Updates log
| Date | Before | After | Δ | New | Retired | What changed | Should change mind? | |
|---|---|---|---|---|---|---|---|---|
| 2026-10-01 | 81.4% | → | 76.3% | -5.1 | 8 | 1 |
| Modestly up — roughly +2 points, from 81.4 to ~83 — and the reasoning is asymmetric information value rather than a preponderance of new support. Most of the new contradicting evidence (entertainment attention surge, collapsing consumer confidence, student-loan defaults) bears on sub-condition (b), which the model already treats as likely to fail; piling on against a leg already priced near zero is nearly non-diagnostic. The new evidence that *is* diagnostic bears on sub-condition (a), the live hinge, and it points up: agent governance is a genuinely new, AI-capex-attached, liability-driven budget category with a reference architecture and a 100+ partner ecosystem built in under a quarter, which is exactly the kind of incremental non-discretionary line the >10% CAGR floor needs — and it is additive to, not substitutive for, legacy security spend. Against that, two real negatives are logged: the term-premium shock meaningfully raises the odds that resilience mandates are passed and then defunded, and the US choosing a voluntary AI accord over statute means the agent-governance budget rests on private standards and insurer pressure rather than law, which is softer than the mechanism assumes. I am also wary that agent governance is currently a vendor narrative with zero disclosed revenue — it is a promise of budget. Net: small upward move, with the caveat that if the next earnings cycle shows agent safety bundled free into platform renewals, that single fact should take the probability down by more than this month's update took it up. |