Is AI the Next Zero Trust?
As the global economy remains rocky, venture capital (VC) firms continue to make tentative and calculated investment decisions. The first quarter of 2023 saw $76 billion in global investments across all categories, which is a staggering 53% decline, year over year, from the first quarter of 2022 and a nearly 54% decline from Q4 2022.1
Nonetheless, in some specific sectors, all is not doom and gloom. Seed rounds for early-stage artificial intelligence (AI) companies have increased by 2.5%, and Series A rounds are up more than 58% since Q4 2022.
What does it mean? Is AI the utopia we’ve been reading about and watching on screens for decades? Are we finally there? Or is this interest and investment in AI akin to other “hugely promising” tech trends such as zero trust circa 2016-2018?
In the last year, several AI or AI-reliant companies have inked record-breaking funding deals. In early 2023, OpenAI landed a “multi-year, multi-billion” dollar deal with Microsoft, guess-timated (based on previous investments and market estimates) to total $10 billion. Defense technology company, Anduril Industries, which leverages AI and machine learning to power its technology, closed a $1.48 billion Series F. Anthropic, a pure play AI research company which runs “Claude AI,” raised ~$704 million in 2022 and another $300 million in 2023. So, while non-AI tech companies have been losing ground in the funding arena, AI companies have been picking up some of their slack.
Furthermore, the data also show that early-stage AI companies are raising more cash —a median of between 10-23% more — than their non-AI tech counterparts.
Suffice it to say, now is a good time to be an AI startup, or, more specifically, a generative AI startup. Even startups that leverage AI in a significant way such that it dramatically changes or improves the product — they’re reaping financial benefits, too. More capital is funneling into AI and AI-based startups than other companies, especially in the US.
Still, we’re not talking about an endless stream of financing for AI product and service vendors. CB Insights published Q1 2023 results that show a tempering effect in the VC community. According to the recent report, global AI funding fell 43% from the fourth quarter of 2022. Looking at the larger quarter-on-quarter results over the last 2 two years, AI venture funding went from a high of 972 AI companies receiving funding in Q3 2021 to 554 deals in Q1 2023. As written in the article, “This is the lowest quarterly total [in AI funding] since Q1’18.”
There’s little argument that macro market trends are catching up, even in AI, and causing investors to hold back — despite the media buzz and despite the promised efficiency gains proffered by AI. The longer we’re in an economic slump, all sectors will be impacted at some level.
Generative AI seems to be the one exception. Because it’s super hot right now. With the launch of ChatGPT in November 2022, the average human could easily see how much progress is being made in the space. They could test it out — and test it out people did! With ChatGPT, AI went from a “man behind the curtain” capability to something more accessible by laypeople. The excitement, the fear, the doubt, the hopes for AI all came to the surface with general availability of ChatGPT.
And the VC market responded; three generative AI companies achieved unicorn status in Q1 2023, in contrast to the greater tech market where unicorns are losing their horns (or, as my friend Tyler Shields calls them, “Zombiecorns”).
Deja zero all over again?
We’ve seen this before, most notably, in the 2016-2018 era of zero trust, a term introduced nearly a decade before every cybersecurity company slapped the term “zero trust” on their RSA Conference booth and found a way to retrofit the concept into their product or service. The promises of zero trust, like AI or generative AI today, were massive (at least according to vendors). Companies guaranteed that, by implementing their solution, the customer would immediately and automatically conform to zero trust principles and therefore be hardened to all flavors of cyberattack. And VCs took the bait. Cash flowed into startups that could demonstrate they had baked some of the requirements of zero trust into their offerings.
By all measures, today in 2023, the zero trust market is still growing. However, it has noticeably slowed to a rate of anywhere between 14-18% year-on-year, depending on which market outlook measurement source you read. The hype is largely gone. While you see “zero trust” in vendors’ marketing materials, it’s not driving as many deals as it was. Because it went from a “silver bullet” to a framework, as it was always intended to be.
With AI, though, things are different. Cybersecurity product and service companies have been plastering the term all over their collateral for several years, essentially calling the ability of machines to perform very fast math “artificial intelligence.” Some smarter companies stopped at “machine learning,” recognizing that a computer’s compute power does not include sentience. Machine learning (ML), in fact, is a tremendous benefit in technology, but conflating it with AI doesn’t make it actual AI.
Savvy investors saw this coming; despite the precipice facing the global economy, VCs turned to the “next big thing,” that is, AI. They’d seen the presentations, quizzed enterprising entrepreneurs, and put their weight into what could — potentially — help them ride the wave of sustainable investment. Hence the billions of dollars being poured into this sector. Investors are hitching their wagons to the one thing that shines bright in an otherwise very grim market at the moment.
Where’s the beef?
Does this mean AI is all hype, no substance? Of course not. I, personally, believe that we have not yet come close to reaching the full extent of machine-based processing power. Research seems to back up this theory. Research also suggests that we humans have to be much more careful with real AI (versus purported “AI” that’s actually ML in an AI wrapper…and the bulk of what's used/marketed today).
Just like with machine learning, we have to be deliberate with the training data used in AI learning models. Even the large language models (LLM) that drive generative AI. Bad data in; bad data out. Disinformation in; disinformation out. After all, the output of machine-automated anything is only as good as the data machines ingest. Technology researchers and executives are issuing warnings about the dangers of AI, if it’s left unchecked and used as a marketing stunt.
However, these warnings don’t seem to be stopping vendor companies from trying to find ways to incorporate AI (often, really ML) into their products and then message them to the market as AI tech. It feels oddly reminiscent of the zero trust craze: 1. Take elements of the approach. 2. Find a way to tweak the product slightly. 3. Message that the product/service is based on the approach and will help customers achieve better results/greater efficiency/improved security outcomes.
In truth, incorporating machine learning for efficiency and accuracy’s sake is becoming table stakes in the cybersecurity product market. However, let’s be really careful not to:
Conflate ML with AI
Overuse the term to sell products
Think the technology is “there” yet
We still have a long way to go before AI is really AI, in most scenarios. So while investors are placing their bets on AI being the next big thing, remember that part of investors’ calculations involve predicting humans’ procurement behaviors and decisions. In other words, they’re not necessarily saying that AI is the remedy for every cyber problem on the planet. What they’re (partially) saying is that this trend is bound to be big, just like Beanie Babies, Google Glass, and Windows Vista — all now-defunct products.
AI will be big — very big. However, at least as of today, the industry still has a lot of work to do, despite the investments. Hopefully some of the funding will help AI companies and AI-powered companies achieve great things. But just because we’re seeing advancement and investment, that doesn’t mean every company should shim their offering to include “AI” (or, again, what’s really ML) so that they can say they’re part of the trend. The market will shake out, just like zero trust did. We have several years to go, though, before the excitement dies down.