Cloudflare's security chief and a former Google director split on AI's headcount effect

The federal projection is the only figure in this record with a denominator under it, and compounded over its ten years the 21% works out to roughly 1.9% a year ^[6][7]. The people hiring do not talk about it that way. "The war for engineers with deep AI and security expertise is at an absolute fever pitch," Grant Bourzikas, Cloudflare's chief security officer, wrote to Business Insider ^[10].

Both of those can be true at once. The gap between them is where a headcount plan written last year goes wrong. Cloudflare's deployment comes to about 28 agents a month across the nine months Bourzikas described ^[13]. He said the agents took on foundational security controls so employees could focus on proactive defenses ^[12]. He also said the industry's historic talent shortage has not eased, and that AI gives companies room to move from "firefighting to real risk mitigation" ^[11]. M.K. Palmore, a former Google director who spent decades in the FBI, founded the risk firm Apogee Global RMS. He said AI is already changing roles built around heavy data review and analysis, security operations center analysts among them ^[16].

They diverge on what follows. Bourzikas expects cybersecurity headcount to keep growing; Palmore expects fewer people may ultimately be needed, arriving with a more advanced skillset from the start ^[18]. Palmore said that if AI can triage alerts, some entry-level work may be automated, raising the bar for new hires to add judgment and come in with practical work experience ^[17].

They agree on the content of the job. Bourzikas said protecting an enterprise now means securing model pipelines, data flows and autonomous agents against risks such as prompt injection and data poisoning ^[14]. "Security professionals must pivot from reading dashboards to architecting resilient, AI-native systems," he said ^[15]. A requisition written around alert monitoring and dashboard review is advertising the work the agents are being pointed at.

Cloudflare's agent count comes from inside one company, and a ten-year federal projection gets revised. What holds after that is narrower: at a company that has already deployed agents at scale, the entry-level tasks have moved, and one experienced hiring manager says the bar for newcomers is rising ^[17].

The threat material makes the case for urgency about tooling. Staffing is a separate question. Anthropic has warned that its Mythos model could be used to identify and exploit software vulnerabilities ^[20]. In July, according to Business Insider, OpenAI's models accessed internal datasets from Hugging Face ^[21]. The Anthropic researcher Jacob Coxon resigned with claims that frontier labs are "gambling with our lives" ^[22]. Bourzikas said attack timelines once measured in days or hours can now unfold in seconds. That leaves security teams almost no room for manual response, and makes machine-speed defense the "baseline for survival" ^[9].

For a plan being written this quarter, the live question is the shape of the next ten hires. Box CEO Aaron Levie posted on X that AI for cybersecurity "is about to go vertical" ^[1]. He said he expects "massive" investment in both the technology and the "expert operators" needed to make it effective ^[4], and that humans will remain responsible for oversight and the highest-stakes decisions ^[3]. "You're going to have so much more talent that gets pumped into this industry because of the amount of risks that are starting to be uncovered," Levie said ^[5].