Mark Cuban has offered a vivid metaphor for one of the fastest-growing risks in corporate cybersecurity. Speaking at a Reuters Total Health event in Nashville on October 23, the entrepreneur and investor compared AI hacking agents to cockroaches. They are too numerous to keep out entirely, he said, but they can be managed with the right defenses.
“It’s like the cockroach thing, right? You build a new house, you get the guys to come out and spray,” Cuban said, according to Reuters. “The one thing I don’t want is cockroaches in my house ever. But the cockroaches find a way to get in because there’s zillions of them, right? And then if there’s one gets in, there’s more that are going to get in, and that’s kind of the way AI works.”
Cuban, who said he is “not a doomer” about AI, argued that companies can use the same technology to fight back. “It’s all brute force acts, and if it’s brute force on that side with the bad guys,” he said, “you can also use brute force with the good guys.” For executives, the remark captures a practical shift in cybersecurity: attacks are becoming automated, persistent and high-volume, and defenses built for human-paced threats may not keep up.
Why the Metaphor Fits
The cockroach comparison points to a change in the economics of cyberattacks. Traditional attacks required skilled human operators, which limited their number and pace. AI agents can automate reconnaissance, credential testing, phishing and vulnerability probing at very low cost per attempt. An attacker no longer needs every attempt to succeed. Scale alone raises the probability that some will.
That changes the defender’s problem. Perimeter defenses designed to stop every intrusion become less realistic when attack volume rises sharply. The more relevant questions become how quickly an intrusion is detected, how far it can spread, and how fast it can be contained. Cuban’s point that “if there’s one gets in, there’s more that are going to get in” reflects this concern: a single successful entry can open the way for automated follow-on attacks.
Security researchers have also shown that AI can speed up the discovery of software vulnerabilities, a capability equally useful to defenders and attackers. The arms race Cuban describes is already under way.
Two Responses: Containment and Counterattack
Cuban’s prescription contrasts with the approach of America’s largest bank. JPMorgan Chase said this month that it would block external AI agents from logging into or acting on retail customers’ accounts, according to The Paypers. Chief executive Jamie Dimon cited the risk of rogue agents operating in large numbers. The bank also warned that customers who give third-party agents their login credentials should understand the risks, including a potential transfer of liability to themselves. Agents can still read some data, such as balances, through authorized data connectors, but cannot move money.
The two positions are less contradictory than they appear. JPMorgan’s decision is about access control: limiting which automated systems can act inside customer accounts. Cuban’s argument is about detection and response: using AI to identify and neutralize malicious automated activity at scale. Most large organizations will need both.
Each approach has costs. Restricting outside agents protects customers and institutions from unauthorized activity, but may frustrate consumers who want AI assistants to manage their finances, and may push innovation toward competitors with looser policies. Deploying defensive AI at scale raises its own risks, including false positives that block legitimate customers, opaque automated decisions, and the possibility that defensive systems themselves become targets.
The Business Stakes
For banks, the AI-agent question is also commercial. Bank stocks came under pressure in September after a consumer AI agent from Meta topped app download charts, amid concern that agents could move customers’ deposits automatically from low-yield accounts to higher-yield alternatives, according to The Paypers. Restricting agent access protects against fraud and also slows that kind of rate-driven deposit movement. Security and competitive considerations are intertwined.
Beyond banking, the implications reach any company with customer accounts, valuable data or internet-facing systems. Retailers, healthcare providers, software companies and public institutions all face rising volumes of automated attacks. Smaller organizations are especially exposed, because they often lack security teams able to monitor and respond around the clock.
Cuban’s own business illustrates the stakes. His Cost Plus Drug Company, which sells medicines at a fixed markup, operates online and handles sensitive health and payment information, the kind of data automated attackers target.
What Effective AI Defense Requires
Using AI defensively is not a single product decision. Effective programs typically combine several elements: automated monitoring that can detect anomalous behavior across systems in real time; identity controls that distinguish legitimate human users, authorized agents and malicious automation; rapid containment that limits how far an intruder can move; and human oversight for high-impact decisions. They also require governance, including clear rules about which internal and external AI agents can access systems, and with what permissions.
The defensive advantage is not guaranteed. Attackers need to find only one weakness, while defenders must protect every system. AI can narrow that imbalance by giving defenders speed and scale, but it does not remove it.
Why This Matters for Business Leaders
Cuban’s metaphor offers a useful operating principle: assume that some automated attacks will get through, and design systems to detect and contain them quickly. That is a shift from security programs focused mainly on keeping attackers out.
For boards, AI-driven cyber risk should be treated as a strategic issue rather than a technical one. Questions to ask include how quickly the organization can detect and contain an intrusion, which AI agents have access to its systems, and whether security investment is keeping pace with the automation of threats.
For customer-facing businesses, the JPMorgan decision signals that policies on third-party AI agents will become a competitive and legal issue. Companies will need to decide whether to permit, restrict or certify agents acting on customers’ behalf, and how to allocate liability when something goes wrong.
Executive Takeaways
What changed: Mark Cuban argued that AI hacking agents, like cockroaches, cannot be kept out entirely but can be countered with defensive AI at similar scale.
Why it matters: Automated attacks are increasing in volume and speed, while major institutions such as JPMorgan are restricting external AI agents’ access to customer accounts.
What leaders should do next: Combine strict access controls for external agents with AI-enabled detection and rapid containment, and assign board-level oversight of AI-driven cyber risk.
The contest between offensive and defensive AI is likely to intensify. Over the next 12 to 24 months, the indicators to watch are regulatory guidance on AI agents in financial services, liability standards for agent-initiated transactions, the share of security budgets devoted to AI-enabled defense, and whether major breaches are attributed to automated agents. Cuban’s comparison may prove apt in one more respect: cockroaches are rarely eliminated, but well-run buildings keep them under control.
Have you read?Billionaire John Paulson Donates $250 Million to Hebrew University.Why AI Leadership Needs a New Operating System Built on Joy.Why Leaders Who Reject Feedback Eventually Lose Employee Trust.Why Clear Communication Matters Most During Difficult Business Decisions.When Psychological Safety Becomes a Cybersecurity Priority.
Note: The views expressed are those
of the authors and do not necessarily reflect those
of CEOWORLD Magazine, its Editorial Board, or
management. Content is provided “as is,” may
contain monetized links, and is not professional
advice. See our
Ethics & Guidelines
for details. Reproduction requires prior written
permission.
Contact
[email protected]
for inquiries or media requests.
Click Here For The Original Source.
——————————————————–
