City Journal argues AI could make basic cyber defence cheaper

AI could help smaller and midsize firms find security flaws without building a large in-house team, argues a new City Journal article. Its author also backs a minimum cyber-security staffing requirement, while warning that AI does not make the underlying costs or trade-offs disappear.

Watch Desk analysis

What happened

In an article published on 27 October, Dario Marino of the Manhattan Institute argues that many firms underinvest in cyber defence because they do not bear the full economic cost of attacks. He cites a paper estimating that midsize firms accounted for 36% of attacks in 2022 despite making up about 1% of firms. Those figures and the paper’s conclusions are reported here as Marino presents them.

Marino favours a requirement for firms to devote 0.2% of their workforce to cybersecurity, rather than post-attack bailouts or government subsidies. He argues that AI could lower the cost of finding software vulnerabilities and make defensive expertise more accessible to firms without specialist teams. He also points to a recent PHP vulnerability as an example of flaw discovery followed by a patch, but that example alone does not establish how broadly AI can improve security.

Why it matters

The argument turns a familiar AI question around: not only how attackers might use these tools, but whether cheaper vulnerability discovery can help under-resourced defenders. If the economics work, smaller firms might identify and fix some weaknesses without hiring a full security department.

The proposed staffing rule is a different matter. A fixed percentage could spread baseline capacity, but it would also impose costs, and Marino warns that setting it too high could hurt productivity or push firms out of the market. AI is part of his case for making the requirement more affordable, not proof that the bill has already come down.

Our read

This is a useful argument about who pays for cyber defence, not a settled blueprint. The practical takeaway is to treat AI-assisted flaw finding as one possible way to stretch limited security capacity, while asking for evidence about real-world cost and results. “AI will help” is a promising start; it is not a security budget.

What to watch

• Whether the cited research and later studies support the claim that midsize firms face a distinctive risk.
• Whether firms report measurable savings or improved vulnerability-fixing from AI-assisted security work.
• How a 0.2% staffing requirement would be defined, enforced and adjusted for different firms.

Discussion spark: Would a minimum cybersecurity staffing requirement make firms safer, or should policy focus on helping them buy and use effective tools, including AI?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.