"The attackers are winning": AI hands hackers the advantage, Cyber 60 founders warn

AI now lets attackers scan the entire external attack surface of a Fortune 500 company—more than 10,000 externally facing systems—within hours. Evan Peña, cofounder and chief offensive security officer at startup Armadin, delivered that figure Wednesday onstage at the Cyber 60 event held by Fortune, Lightspeed, and AWS at the New York Stock Exchange, and he did not soften the conclusion.

"I definitely think the attackers are winning right now," Peña said. "Look at the last few weeks: You have Citrix, BeyondTrust, PHP, Node.js, all within a three or four week window. These are unprecedented emerging threats… What you can do in hours would have taken us a year. The scale and speed are just unparalleled."

That compression—from a year of manual reconnaissance to hours of automated scanning—is the core of the argument. One year of human work, replaced by an afternoon of machine work, applied to every Fortune 500 in turn.

What did the Cyber 60 event actually mark?

The gathering coincided with the release of the 2027 Cyber 60, Fortune's annual list of cybersecurity's most innovative startups. The list includes:

• Chainguard, the open source security company that raised a $356 million Series D in April 2025 at a $3.5 billion valuation, according to Fortune's prior reporting
• Irregular, a frontier AI security company and new name on the list
• Jazz, a data loss prevention startup, which received an honorable mention

The founders brought together at the New York Stock Exchange delivered a consistent message: AI is the best tool an attacker could ever hope for. Whether every listed startup can monetize that threat is a separate question the event did not address.

Why do attackers hold the advantage?

Nick Schneider, CEO of cybersecurity unicorn Arctic Wolf, framed the imbalance as structural rather than technological. Defenders must clear internal hurdles that attackers simply bypass.

"The biggest thing is the attackers have no barriers," Schneider said. "An organization has to go through change control. They have to get budgets, convince their teams, convince their boards. Many organizations weren't built AI-native. They weren't built to operate at the speed of bad actors. Bad actors don't care: They'll carry out the attack en masse, and if they don't get anything, no big deal, they move on to the next one."

The economics favor volume. A failed attack costs the attacker nothing but compute; a failed defense costs a company its data, its customers, and often its board's confidence.

How fast is the threat accelerating?

Lior Div, cofounder and CEO of 7AI, said the pace of major security events is tightening on a predictable curve. "We're living in a continuum," Div said on one panel. "The gap between events is going to shrink and shrink and shrink."

The year's headlines support his framing. Fortune's coverage of 2026 has tracked the widely discussed rise of Mythos and OpenAI's technical report on how its own agents hacked Hugging Face—both cases where AI capability outran the defenses built for it.

Div also rejected the foundational assumption of corporate network security. "We're living in a very vulnerable world," he said. "Everything is vulnerable, and you can hack everything. The idea that you have a perimeter that can't be penetrated just isn't true."

If the perimeter is fiction and the attacker's scanning cost approaches zero, the burden shifts from preventing breaches to surviving them. The Cyber 60 list is, in effect, a catalog of companies betting billions on that shift—and on corporate buyers accepting that the attackers are, for now, ahead.