At the RSAC Conference, the race to dominate AI security looked less like a leaderboard and more like a constantly shifting target.

Why it matters: Cybersecurity is already pretty diversified, making it difficult for companies to stand out from the crowd.

• Now, the constant waves of AI innovation are eroding any sense of hierarchy — making it harder for security executives to determine where to spend their dollars, for governments to find the best intelligence, and for investors to get a return on their bets.

Reality check: "There will be no such thing as legacy companies in the next six months," Jeetu Patel, Cisco's president and chief product officer, told Axios. "The reason for that is because coding has completely gotten automated."

• Patel argues legacy vendors have persisted largely because their underlying code is difficult to update. Now, AI coding agents can create and democratize the ability to constantly refactor underlying code in a fraction of the time.
• Cisco has already rolled out one product built entirely with AI-generated code, Patel said. By the end of the year, the company will ship five more.

The big picture: Advances in AI agents are lowering the barriers to building new security features — and even entire companies — adding new velocity to an already crowded market.

• New AI-native startups are popping up across dozens of countries, with product cycles compressed from months to days, Dave DeWalt, founder and CEO of NightDragon, said during an RSAC panel I moderated on Thursday.
• "AI has flattened the world," DeWalt said. "Innovation can happen anywhere."

Between the lines: Investors who are funding this wave told me on that same panel that they don't know which AI disruptions will stick.

• Instead, they're preparing for a world where specific security categories — think endpoint security, network security and cloud — collapse into broader platforms.
• Some of the best bets are companies tackling long-standing "pain-point" areas, like identity and data loss prevention, that AI could finally fix, said Kobi Samboursky, founder and managing partner at Glilot Capital.

At the same time, investors are anticipating faster company lifecycles.

• DeWalt estimated that 99% of the companies on the expo floor at RSAC this year "will die" because of how quickly competitors can now replicate features.
• Startups that can quickly win customers and build strong go-to-market strategies are more likely to stand out, he added.
• That volatility is also changing how investors deploy capital: Richard Seewald, founder and managing partner of Evolution Equity Partners, said on the panel that his firm has been shifting to smaller initial checks and reserving larger investments for follow-on rounds after companies prove traction.

Zoom in: Major security companies and customers are taking different strategies for bringing these AI-native capabilities into their own environments.

• Dell, for instance, has shifted from building tools in-house to a "buy-first" approach, leaning on partners and third-party vendors to move faster as AI reshapes the threat landscape, John Roese, global chief technology officer and chief AI officer at Dell Technologies, told Axios.
• Cisco, Patel said, is doubling down on building its core products in-house, while using acquisitions to bring in talent and accelerate development — showing that incumbents can also now move as fast as startups in an AI-driven market.

Yes, but: Despite the chaos, some investors still believe a new market leader will emerge from the rubble, similar to how CrowdStrike and SentinelOne came to dominate endpoint security.

• "There's going to be three or four or five of them dominating these sectors," DeWalt said.

The intrigue: This year's Innovation Sandbox, the flagship startup competition at RSAC, reflected that shift.

• The winner, Geordie AI, is building an agentic AI platform, a category that barely existed a year ago.
• The runner-up, Glide Security, is rethinking identity verification — a long-standing problem now being reshaped for AI-driven systems.

What to watch: Whether the volatility reshaping the broader software market spreads further into cybersecurity — and whether clear winners can still emerge in an industry that's becoming harder to define.