Who Gets Paid When the Machine Does the Work?

Posted on November 13, 2026 by Simon Roses

Read Time: 22 minutes

TL;DR

I run a security company, and the questions I get now are not about a CVE. They are about the business. Does AI change our industry for good? Will a pentest cost a tenth of what it did? Is a senior with AI worth more than a junior, or more than the AI on its own? And when the tools hand you a thousand findings a week, half of them wrong, who pays to sort the real from the noise? Is the price even real, or is a vendor quietly paying part of your bill until the IPO? Will an auditor ever take a machine’s word over a human’s? And should this data be leaving your building at all? I do not think anyone honest has settled answers yet, so this is not a prediction piece. For each question I will lay out the strongest version of both sides, with the numbers I actually trust, and tell you where I personally land at the end. The short version: AI has collapsed the cost of producing a finding, a test, or a line of code, and has done almost nothing to the cost of trusting it. Everything else follows from that gap. A note on what this is: these are my own views, not forecasts, and although I argue them from my own field, I think the same forces are reshaping every expert profession AI has walked into. Security is simply the one I can speak to honestly, so it is the lens I use throughout.

The one thing that actually changed

Before the seven questions, the single idea they all rotate around. AI made it cheap to produce security work and left the cost of judging it roughly where it was.

A model can write an exploit, enumerate an attack surface, draft a report, or flag an anomaly in seconds. What it cannot do is stand behind the result. Someone still has to decide whether the exploit is real, whether the finding matters for this business, whether the fix is safe to ship, and whether the whole thing is worth a client’s money and reputation. That decision has not gotten cheaper. If anything it has gotten more expensive, because there is now far more output pointed at it.

Hold that thought. It is the reason prices behave strangely, the reason seniority still commands a premium, and the reason “we got more findings” is not the good news it sounds like.

srf_ai_security_economics_map
Figure 1: The whole argument on one page. Every question branches into its strongest case for and against, and all of them rotate around the same gap, AI cut the cost to produce, not the cost to trust. Built for this article and rendered with USecVisLib.

1. Does AI change the industry for good?

The case that it is a real break. In June 2025, an autonomous system from XBOW reached the top of HackerOne’s US bug-bounty leaderboard, the first time a non-human held that spot, after submitting on the order of a thousand vulnerabilities; the company raised $75 million on the back of it. A year later we watched the same capability turn offensive at scale: the Cairn platform was abused to spray more than a hundred companies for roughly fifty dollars each, and Wiz, working with OpenAI, used AI to find PHP2Shell, a decade-old remote-code-execution flaw in the engine behind most of the web. The job market is moving the same way. CyberSN’s analysis of the first three quarters of 2026 shows AI security engineer postings up 268% and cyber data scientist roles up 203%, while overall security job postings fell 26% year over year to a four-year low and penetration tester listings dropped almost 46%. When the demand curve bends that hard in eighteen months, something structural is happening, not a passing fad.

The case that it is the same work, faster. Look closely at what the machines actually did and the picture is more familiar. XBOW’s own numbers are instructive: of roughly 1,060 submissions, about 130 were resolved, 208 were duplicates, and over 200 were marked “informative” or “not applicable.” The successful Cairn break-ins rode in on the boring classics, exposed panels and unrotated credentials. PHP2Shell is a textbook memory-safety bug; the novelty was who found it, not what it was. None of this is a new kind of security problem. It is the old kinds, produced and attacked faster and cheaper. On that reading, AI is a force multiplier laid over an industry whose fundamentals, find the weakness, prove it, fix it, have not moved. The tools change; the work is the work.

Both cases are true at once, which is the uncomfortable part. The volume and speed are genuinely new. The underlying tasks are not. I will let you weigh which half matters more for your corner of the field.

2. Will prices fall because the work is faster?

This is the question I get from buyers and competitors in the same week, from opposite directions.

The case for a price collapse. The raw economics are hard to argue with. A traditional penetration test runs roughly $5,000 to $50,000, with senior consultant day rates of $1,000 to $3,000 and most web or API engagements landing between $10,000 and $35,000. AI-driven and continuous testing is now priced like software rather than consultant-days: on the order of $4,000 to $8,000 per application with retests included, where retesting used to be billed as a fresh engagement near the original price. If a tool does in an afternoon what used to take a consultant a week, the hours you were paying for evaporate, and in a competitive market the price follows the cost. Buyers have noticed, and plenty of vendors are happy to quote the lower number.

The case that the price holds, or splits. Here is where the one thing that changed bites. When you buy a security test you are not really buying hours; you are buying assurance, the signed statement that someone competent looked and is willing to put their name on it. AI lowers the cost of the looking and does nothing for the cost of the standing-behind. So I think the market splits rather than simply falls. The commodity layer, automated scanning with a templated report, races toward the floor and is already near it; a $2,000 quote today usually means exactly that. The assurance layer, a human who scopes the real risk, validates what the machine found, and is accountable for what it missed, holds its price or rises, because now it also has to absorb the flood of machine output and the liability of saying “this one is real.” The same thirty-thousand-dollar engagement increasingly buys less raw testing time and more judgement, triage, and sign-off. Whether your bill goes down depends entirely on which of those two things you were actually paying for.

My honest read for buyers: the number on the invoice may drop, but if it drops because you switched from assurance to automation, you did not get a discount, you changed what you bought.

3. Is the price even real?

There is a question hiding under the last one, and I think it gets ignored most. The AI prices we are all reasoning about are not the real cost of the AI. They are a subsidised cost, and the subsidy has an expiry date.

The case that today’s price is roughly the real one. Inference keeps getting cheaper. Aggregate token prices have fallen hard, driven by real efficiency gains in models and chips, and usage is rising fast enough that providers can plausibly grow into profit on volume. On this view the current cheapness is not a loss-leader, it is something like Moore’s law for tokens, and it continues.

The case that you are being subsidised and the bill comes later. The frontier labs are losing enormous sums to win you. OpenAI is projected to burn around $14 billion in 2026, up from $8 to $9 billion the year before, and Anthropic’s margins swung from deeply negative to positive but under constant pressure from inference costs higher than expected. The cheap consumer tiers are the most heavily subsidised of all. This is the Uber-and-DoorDash playbook: investor money funds artificially low prices until the market consolidates and the IPO clock starts, and then prices rise because, as Writer’s CEO put it, “these LLM companies are going to go public and they’re going to raise prices because they have to.”

Why does this land on security specifically? Because we are rebuilding the pricing of our services, the automated pentest at a fraction of the day rate, the always-on monitoring, the AI SOC, on top of an input cost that is currently fictional. Price a continuous-testing product at a few thousand a year assuming near-free inference, then watch the model you depend on raise its API price the quarter after its IPO, and your margin was never real. I do not know when the music stops, and the per-token price may keep falling even as total spend climbs. But I would not build a business, or sign a long contract, on the assumption that this year’s AI prices are the floor. They may turn out to be the ceiling.

4. A senior with AI, a junior with AI, or just the AI?

This is the one that gets personal in the industry, because it is really a question about whose career survives.

The case that AI lifts the junior and flattens the gap. The best study I know here is the MIT work on generative AI and high-skilled developers, pooling three field experiments across nearly 4,900 engineers. Less experienced people adopted the tools more and gained the most: junior developers improved throughput by roughly 21% to 40%, against 7% to 16% for seniors, and short-tenure staff at Microsoft gained 27% to 39% against 8% to 13% for the long-tenured. On this evidence AI is a great equaliser. It hands a capable junior a floor of competence they used to need years to build, closes much of the visible gap on routine work, and makes the “just give it to the AI” option genuinely viable for a large slice of tasks that used to require a person with scars.

The case that judgement does not transfer, and the machine cannot own the outcome. Then look at the METR randomised trial from mid-2025: experienced open-source developers working in codebases they knew well were about 19% slower with AI, while believing they were faster. The lesson is not that AI is useless to experts; it is that its gains concentrate on work you do not already know how to do well, and it can actively get in the way on the hard, familiar, high-stakes work where expertise lives. Security is disproportionately that second kind of work. Deciding that a finding is a real business risk, that an exploit chain is viable in this specific environment, that a fix will not break production, that the machine’s confident output is quietly wrong: none of that is throughput, and none of it transfers to someone who has not seen it fail before. The AI alone cannot do it, because it cannot be accountable; a junior with AI can produce the artefact but not reliably certify it; a senior with AI produces and certifies, which is why that combination, not the junior and not the machine, is the one I would bet on for anything that matters.

There is a nasty second-order problem underneath this, and both sides should worry about it. The Barracuda skills-gap reporting this autumn found 56% of organisations had already cut security roles in connection with AI, split evenly between entry-level and senior. If you automate away the junior tasks, you also automate away the apprenticeship that turns juniors into seniors. The judgement premium I just defended is produced by people doing years of the unglamorous work AI is now eating. Cut that ladder and the senior-with-AI advantage is real today and structurally endangered in a decade. I do not have a clean answer to that, and I distrust anyone who says they do.

5. The findings economy: who pays for valid and false alike?

This is the question I think the industry has thought about least, and it is the one AI makes most acute. When producing a finding costs almost nothing, you get a lot of findings. Volume is not value.

The case that more findings is progress. More eyes, human and synthetic, on more of the attack surface, continuously, has to beat the old model of one annual test and silence for the other fifty-one weeks. AI triage genuinely helps: CSA’s benchmark work found AI-assisted analysts closed escalated investigations 45% to 61% faster than manual ones. Catch more, catch it sooner, close it faster. On paper the finding factory is a win, and for genuinely under-tested organisations it often is.

The case that volume is a tax, not a gift. Now the numbers that keep me up. In one 2026 dataset of 16.9 million SOC alerts, the AI-related subset was 94% noise from legitimate use and 0.02% confirmed attacks. Microsoft and Omdia put false positives at 46% of all alerts, with 42% never investigated at all; the SANS 2025 survey found 73% of organisations rank false positives as their single biggest detection-and-response problem. The bug-bounty world is the canary: curl shut down its programme in early 2026, with Daniel Stenberg saying the point was “to remove the incentive for people to submit crap,” and Google paused new submissions to its open-source bounty this October under a flood of invalid, AI-generated reports. Even XBOW’s leaderboard run carried hundreds of duplicate and “informative” submissions alongside the real bugs. Every one of those false or low-value findings costs a human the time to read it, judge it, and dismiss it. That time is the most expensive resource in security, and AI is spending it faster than ever.

So how does a company actually pay for this? Three models are fighting it out, and the incentives matter enormously. Pay per finding, and you have just paid the machine to generate noise; the vendor’s interest is volume, yours is the opposite. Pay for validated, triaged signal, findings someone has already confirmed and ranked, and you are paying for exactly the judgement layer that did not get cheaper, which is honest but not cheap. Pay for outcomes, reduced real risk over time rather than counts, and you align incentives correctly but take on the hard problem of measuring something nobody measures well. My own bias, and the thing I have built toward at VULNEX, is that validation is becoming the product. The scan is a commodity; knowing which twelve of the thousand findings are real, exploitable here, and worth acting on this week is the thing worth paying for. That is the same argument I made in the MCP connector audit: the tool that produces the list is not the hard part anymore; the triage is.

6. Will compliance take the machine’s word?

Here the cost of trust stops being a metaphor and becomes a written requirement.

The case that AI walks straight into compliance work. Most of what an auditor consumes is evidence, and a machine produces evidence beautifully: scan results, findings, severity scores, retest logs, faster and more completely than a tired human. The frameworks are adapting. ISO 27001 was always risk-based rather than prescriptive about who holds the tools, SOC 2 can be satisfied in various ways, and new standards like ISO 42001 are emerging specifically to govern AI systems. Nothing in principle stops an AI-assisted test from generating the artefacts an audit needs.

The case that the human signature is load-bearing, and legally so. The frameworks that matter most are explicit that a person stands behind the result. PCI DSS 4.0 is blunt: “automated tools can support penetration testing, but do not replace the need for manual, skilled testing,” and, the line I keep quoting, “being able to operate a tool is not the same as being a qualified penetration tester.” It demands a qualified tester and documented attestation on retests. SOC 2 is a formal attestation signed by a licensed firm, and in practice most Type II auditors still expect manual exploitation evidence and will question an autonomous-only report. The pattern is identical across all of them, and a CREST assessor put it better than I can: “assurance still depends on who is willing to stand behind the result.” Autonomous tools produce evidence; human assessors provide assurance; compliance is in the business of buying assurance.

This is the clearest place the whole argument surfaces. The regulator has effectively written “the cost of trust does not fall” into law. You can automate the entire production of a security assessment and still need a qualified, named, accountable human to sign it, and no amount of AI changes that until the liability regime itself changes. For firms like mine, that is not a threat, it is the moat.

7. Where does your data actually go?

Every efficiency above assumes you are comfortable sending your data to someone else’s model. A lot of security teams are realising they are not.

The case for the frontier. The best models are dramatically more capable than anything most of us can run in-house, and for finding a subtle bug, reasoning about an attack chain, or triaging a flood of findings, capability is much of the game. The vendors know the nervousness and compete on it: through 2026 both OpenAI and Anthropic rolled out zero-data-retention options for enterprises, including keeping data in the customer’s own cloud, and hyperscaler routes like Amazon Bedrock let you use many models without the provider seeing your data, part of why Bedrock adoption ran near 80% of the Fortune 100. For most organisations, a reputable frontier vendor under a real enterprise agreement is a perfectly defensible place for the data to live.

The case for keeping it in the building. In security, the data in question is uniquely sensitive: your vulnerabilities, your architecture, a credential sitting in a log, a client’s crown jewels. Shipping all of that to a model you do not control is close to handing an attacker’s shopping list to a third party, and trust is fragile. When Anthropic moved to a 30-day retention requirement on its most powerful models in mid-2026, the enterprise reaction was, in one adviser’s words, an “almost allergic” rejection, and some firms reportedly restricted use overnight. That nervousness is pushing real money toward sovereign AI and open-weight models run on-premises, where the data never leaves and you trade some capability for control. As one CISO put it, “you’re trading control for responsibility.” It is exactly why I keep returning to open-weight models on this blog: they are weaker, they are more work, and for plenty of security use cases they are the only option you can actually defend to a client.

Where you land is really a question of what you fear more: missing a bug because your local model was not clever enough, or leaking the bug to a model you do not own. I do not think there is one right answer, but I notice that the more sensitive the client, the more that second fear wins, and the more the industry is quietly rebuilding on models it can hold in its own hands.

Where I land

I was asked to lay out the cases and let you decide, and I have tried to. But you can probably hear my thumb on the scale, so here it is plainly, as opinion and not prophecy.

AI has permanently lowered the cost of producing security work and left the cost of trusting it almost untouched, and nearly everything strange about the current market comes from that one gap. Prices will fall for the commodity and hold for the assurance, so the invoice going down is not automatically a saving. The senior with AI beats the junior with AI and beats the machine alone for anything that carries real consequence, not because seniors are faster but because they can be accountable, and the industry is quietly dismantling the ladder that produces them. And the finding factory is only a gift if someone is paid, and has the time, to throw most of its output away; the triage is the job now, not the scan.

The three questions I added only sharpen the same point. Today’s AI prices are partly paid by a vendor burning investor money, so I would treat them as a ceiling and not a floor. Compliance has written the cost of trust straight into law, because an auditor still needs a named human to sign. And the more sensitive the work, the more the data wants to stay in the building, which is why the industry keeps drifting back toward models it can actually hold. Produce with the machine, trust with a person, and own what you can.

None of this is settled, and I would rather be corrected than confident. If you think I have weighted one of these wrong, tell me. The one thing I am sure of is that “AI will make security cheaper” and “AI will make security better” are different claims, they do not automatically travel together, and knowing which one a vendor is selling you is itself a security skill now. And if you work in some other expert field watching AI arrive, I suspect you are about to have this same argument with yourself; those of us in security are just a little further into it.

Stay sharp, and trust the output a little less than it asks you to.

Further Reading:

Questions or feedback? Reach out via:

Contact: info@vulnex.com

This entry was posted in AI, Security, Technology and tagged , , . Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.