The Business of Fear: How AI Hype Became a Revenue Stream

According to TheRegister.com, MIT Sloan has withdrawn a working paper that claimed 80.83% of ransomware attacks in 2024 were AI-driven after security researcher Kevin Beaumont exposed fundamental flaws in the research methodology. The paper, co-authored by researchers from MIT Sloan and cybersecurity firm Safe Security and completed in April, analyzed over 2,800 ransomware incidents before being removed following Beaumont’s criticism that it described major ransomware groups as using AI “without any evidence.” The research had been cited in MIT Sloan blog posts and even the Financial Times before being replaced with a notice stating the paper was “being updated based on some recent reviews.” This incident reveals deeper issues in how cybersecurity research is being influenced by commercial interests.

The Business Model Behind AI Fear

What we’re witnessing here is the monetization of AI anxiety through what security professionals are calling “cyberslop” – the practice of trusted institutions using baseless claims about AI threats to generate revenue. The financial incentives in this case are particularly concerning given that Safe Security, the commercial entity co-authoring the research, appears to have financial relationships with MIT through board positions. When academic institutions partner with vendors on research that directly promotes those vendors’ services, it creates a fundamental conflict of interest that undermines scientific integrity. The business model is straightforward: generate alarming statistics about emerging threats, then position your company as having the solution.

Why This Matters for CISO Budgets

The real-world impact of such questionable research falls directly on security leaders who must make multi-million dollar investment decisions based on credible threat intelligence. When influential security experts like Beaumont and Marcus Hutchins call out research as “absolutely ridiculous” and “jaw droppingly bad,” it creates noise that makes genuine threat assessment nearly impossible. CISOs are already struggling to separate signal from noise in the crowded cybersecurity market, and incidents like this undermine trust in all vendor-sponsored research. The financial consequences are real – security teams may divert limited resources to address phantom threats while missing actual emerging risks.

The Academic-Industrial Complex

This incident highlights a growing problem in technology research: the blurring line between academic inquiry and corporate marketing. The original working paper and its subsequent withdrawal demonstrate how vendor relationships can compromise academic standards. When universities partner with companies that have financial stakes in research outcomes, the traditional peer review process becomes compromised. The speed with which this paper was disseminated through MIT’s channels before proper vetting suggests that commercial partnerships may be outpacing academic rigor. This isn’t just about one flawed paper – it’s about a systemic issue affecting how technology risk is assessed and communicated.

The Future of AI Security Research

The silver lining in this controversy is that it’s forcing a necessary conversation about standards in AI security research. As even Google’s AI systems questioned the 80% figure, we’re seeing multiple layers of verification emerging in the ecosystem. The security community’s rapid response to flawed research demonstrates that crowd-sourced peer review can serve as an effective check against commercially-driven exaggeration. Moving forward, we need clearer disclosure requirements for academic-commercial partnerships and more robust methodologies for measuring AI’s actual role in cyber threats rather than relying on sensational claims that serve marketing objectives over truth.