Will the Anthropic Shock Kill Cybersecurity Companies? — Intelligence in Bits vs. Walls of Atoms

I previously wrote about how the rise of AI agents is bringing the traditional SaaS business model to an end. Now, that same wave is crashing into what many considered the “last stronghold” — cybersecurity.

Anthropic recently unveiled a new tool called Claude Code Security, and it sent shockwaves through the market.

Anthropic’s New Security Tool Sends Cyber Stocks Reeling (The Information)

A New Form of Defense

This tool is not just another vulnerability scanner.

• Autonomous researcher: It reads and reasons through code much like a human security researcher, identifying complex vulnerabilities that traditional static analysis tools miss entirely.
• Self-healing: It doesn’t just find holes — it writes the patches to fix them.

The premise is straightforward: if attackers are using AI, defenders should fight back with AI that rewrites the code itself. This approach challenges the very foundation of checklist-style legacy security software. The result? Major stocks — CrowdStrike, Okta, and Cloudflare — plunged 7–9% in a single day, in what the market is calling the “Anthropic Shock.”

Intelligence Cannot Overcome Distance and Physics

However, I believe the market’s reaction is an overreaction. In particular, lumping infrastructure companies like Cloudflare together with pure-play security software vendors is a fundamental mistake.

Anthropic’s AI excels at defending the software (logic) layer. Cloudflare, on the other hand, dominates the hardware and infrastructure (physical) layer.

• A physical moat: Cloudflare operates its own servers across 300+ cities worldwide, controlling everything from IP addresses to fiber optic cables at OSI Layers 3–4. No matter how intelligent AI becomes, you cannot replicate a decade of physically deploying edge servers around the globe overnight.
• A physical shield against DDoS: AI can fix code bugs, but stopping a physical flood of traffic (DDoS attacks) requires a massive, globally distributed network — a “physical dam” of bandwidth that no software alone can provide.

Not Full Competition, but the Ultimate Division of Labor

Going forward, I expect AI and existing infrastructure to settle into complementary roles.

• Anthropic (upper layer): Perfecting application code by eliminating vulnerabilities and building robust, secure codebases.
• Cloudflare (lower layer): Physically protecting the “building” (infrastructure) and “roads” (network) where that code runs, while delivering ultra-low-latency processing at the edge.

Edge server environments are fundamentally different from general-purpose computing, and Cloudflare’s accumulated expertise in securing these environments is not easily replicated.

Conclusion: Infrastructure Owners Stand to Gain from AI

This episode does pose an existential challenge for software-only security companies. But for companies like Cloudflare — those with the formidable moat of physical data centers spanning the globe — the explosion of AI agent traffic should actually increase the value of their infrastructure.

In the age of AI, “intelligence” will become universally accessible. “Physical infrastructure” will not. I see this sell-off as an opportunity to identify the true infrastructure winners of the AI era.