Cyber Stocks Have a 'Mythos' Line on the Chart. The Hackers Are Less Scary Than You Think.

One date, one line on a chart

Joe Weisenthal summed up the cybersecurity sector in a single sentence: "The Red Line is the day that Anthropic introduced Mythos." Marginal Revolution reposted it under the title "Cybersecurity ETF." An ETF, or exchange-traded fund, is a basket of stocks that trades under a single ticker.

The interesting part is who drew the line. Anthropic is an AI company, not a security vendor. Weisenthal still treats its launch as the before-and-after moment for listed security stocks. That tells you something even if you never trade this ETF. AI announcements have become events that move other industries, and investors in software and security now have to watch what AI labs ship, not only what their own companies report.

"In cybercrime we're dealing with a lower-skill demographic," not the "implicit MIT graduates" the security world tends to imagine.

What we actually know, and what we don't

The post doesn't say how far the ETF moved, or even which direction it went. I won't guess at either. Keep that in mind before anyone tells you the market has "priced in" anything.

The more substantial material comes from a separate Oct. 24 post. Tyler Cowen excerpted security researcher Joshua Saxe under the headline "Why are cybersecurity losses not worse?" Saxe's model puts about 720,000 people in the online criminal economy. Around 90% of them work in scam and fraud call centers, and some of those workers were trafficked into the job. About 76,000 are real hackers, and "the vast majority work for governments." That leaves "a few thousand" criminal hackers, mostly in ransomware.

Saxe's explanation is mostly about labor. Gangs have to recruit people willing to give up steadier, legal work. That pushes the gangs into lower-income countries with cheap labor and few legitimate jobs. Picture an illegal call center in a small Nigerian city, or kids in Belarus's informal economy. It's a long way from the "implicit MIT graduates" the security world tends to imagine. In other words, the bad guys are mostly poorly paid, and that caps how good they are.

Why it matters: the threat may not match the hype

There are two simple ways to read AI's effect on these stocks.

**The bull case:** AI makes attackers more dangerous, so companies spend more on defense, and vendors collect. **The bear case:** AI can do some of what security products do, such as spotting vulnerabilities or sorting alerts. That shrinks the vendors' moats, meaning the things that stop customers from switching or building the tool themselves.

Saxe's numbers cut into both cases. If criminal hacking is a small, low-skill trade, then today's threat may be smaller than the bull case's spending story needs. That same low-skill crowd is also the group with the most to gain from a tool that supplies skill on demand. The labor limits Saxe describes, including recruiting, low pay, and the need to operate from poorer countries, don't vanish because the software got better. Better tools, though, could make each low-paid worker more effective.

Cowen adds a one-line note: "There are bottlenecks on the down side too." He doesn't explain it in the excerpt, so don't build a trade on it.

For investors, the practical point is this. A chart line tells you when sentiment shifted. It doesn't tell you whether customer budgets or attacker capabilities have changed. Those show up in revenue and loss data, which come out much more slowly.

The bigger picture: what to watch

**Earnings calls.** Guidance is a company's forecast for revenue and profit in coming quarters, and it's where stories meet numbers. If a vendor raises its outlook and credits AI-driven demand, that supports the bull case. Mentions of pricing pressure, slower sales cycles, or customers building tools in-house point to moat erosion. Vague AI enthusiasm with no numbers attached counts for neither.

**Loss data, not headlines.** Saxe's framework says losses stay limited because the criminal workforce is limited. Track whether ransomware and fraud losses actually start rising. If they don't, any sector story built on AI-powered attackers is getting ahead of the evidence.

**Who the serious hackers work for.** Saxe says most skilled hackers work for governments. Defending against nation-states is a different market from stopping ransomware gangs, with different buyers and budgets. A sector ETF puts both businesses in one basket. If you want to know who wins, look at the companies one by one.