CrowdStrike posts fiscal Q2 results after the bell today โ and with the stock hovering near record highs, the cybersecurity giant's report lands at a uniquely charged moment for the AI-security complex. But while Wall Street watches the ticker, the deeper story unfolding across the sector today isn't just quarterly revenue beats. It's a structural reckoning with what AI-powered security actually means, who's funding it, and where the invisible threats are hiding.
The Invisible Threat No Scanner Can See
As CrowdStrike prepares to showcase its numbers, the backdrop for every cybersecurity investor should include an uncomfortable data point that surfaced this month. On August 18, Kyriakos "Rock" Lambros and Steve Wilson โ two leaders of the OWASP Top 10 for LLM Applications project โ published an analysis on arXiv that reframes how the industry thinks about AI-era risk.
Their finding: prompt injection has held the No. 1 spot on the OWASP Top 10 for LLM Applications for three consecutive years. Yet when they tested that expert consensus against 6,639 labeled real-world incidents, prompt injection ranked only No. 12. The gap isn't because the threat is overstated โ it's because vulnerability scanners simply cannot see it.
"A CISO who sees a low CVE count and deprioritizes prompt injection is reading the scoreboard wrong."
- VentureBeat, citing the Lambros & Wilson arXiv analysisThe researchers drew on 7,714 LLM security incidents sourced from CVE, GitHub Security Advisories, OSV, and the AIAAIC AI-harm database โ then applied a Bayesian model that corrects each count for classifier error. The result: no statistically detectable agreement between expert judgment and real-world incident frequency. For any investor pricing AI security platforms on the assumption that current tooling captures the full threat surface, that's a material disclosure.
Private Capital Is Already Voting With Its Checkbook
While public market participants await CrowdStrike's print, private investors are moving fast โ and their bets illuminate where the next wave of AI-adjacent value creation is expected to emerge.
Indian startup Runable, founded in 2025, closed a $21 million Series A on August 26, co-led by Susquehanna Venture Capital and Nexus Venture Partners, with existing investors Together Fund and Array VC participating. The all-equity primary round valued the company at $65 million post-money, according to co-founder and CEO Umesh Kumar. Runable's thesis: as AI makes building websites and apps trivially easy, the next constraint โ and therefore the next dollar โ is in growth, distribution, and customer acquisition for small businesses.
The startup is entering a crowded arena. Kumar acknowledged competition from AI giants including Anthropic and OpenAI, as well as coding platforms such as Cursor, Lovable, and Replit. But Runable is explicitly positioning past the build layer and into the grow layer โ a strategic distinction that matters for anyone mapping the AI value chain.
Also on August 26, hearing tech startup Legato emerged from stealth with $12 million in funding, unveiling its AI hearing glasses โ the Legato Frames โ built with patented hearing-assistance technology integrated directly into eyewear frames. The company was founded by Mehul Trivedi and Steve Romine, both Bose veterans: Trivedi led the creation of Bose Frames; Romine ran Bose's hearing aids division. Legato Frames are expected to launch later this fall, targeting a U.S. market where an estimated 50 million adults experience hearing loss but only around 20% of those with diagnosed hearing loss seek treatment.
What Today's Earnings Actually Signal for AI-Security Equities
CrowdStrike's results today will move markets โ there's no question about that. But sophisticated investors should resist treating tonight's print as a verdict on AI security broadly. The sector is operating on multiple timescales simultaneously.
In the short term, quarterly revenue, ARR growth, and guidance language will drive the immediate reaction in CRWD and its peers. In the medium term, the capital flowing into startups like Runable signals that institutional investors see AI agent platforms as the next compounding infrastructure layer โ the kind of picks-and-shovels play that security platforms have historically benefited from as enterprise software stacks expand.
But the long-term structural issue is the one Lambros and Wilson put on the table on August 18: the threat taxonomy for AI systems is fundamentally misaligned with the tools available to detect and measure those threats. Prompt injection โ sitting at No. 1 on the expert list and No. 12 in the incident record โ represents a category of risk that doesn't show up in CVE counts, doesn't trigger legacy scanners, and almost certainly isn't being priced into today's security valuations with the precision the market believes it is.
The companies that close that gap โ between what the expert community knows is dangerous and what the tooling can actually see โ will define the next generation of security infrastructure value. CrowdStrike has the scale, the platform, and the AI investment to compete for that territory. Whether tonight's earnings show they're executing on it is the only question that matters after the bell.
"The comparison found no statistically detectable agreement between expert judgment" and real-world incident frequency โ a gap that represents both a risk and an opportunity for the next wave of AI security platforms.
- AITechWire analysis, based on Lambros & Wilson arXiv research, August 18, 2026Bottom line: Watch the CrowdStrike print tonight. But keep one eye on the research โ and the other on where the $21M checks are going. The market is pricing a story; the data is writing a different one.
Follow @AITechWireIO for daily coverage.
