The Motley Fool's Jake Lerch predicts Robinhood, Charles Schwab, and SoFi could be among 2027's best-performing financial stocks, if they execute their strategies and markets cooperate. Robinhood's third-quarter revenue rose 12% to $1.42 billion, and Gold subscribers rose 34% to 5.2 million. Schwab's revenue rose 17% to $7.2 billion, with net income up 23% to $2.9 billion. SoFi's revenue climbed 44% to $1.39 billion, and net income rose 73% to $241 million. Products per member reached 1.56, from 1.47 a year earlier. SoFi is the cheapest at a price-to-sales ratio of 3.9; Robinhood's 15.3 is the highest. Risks include market declines, a trading slowdown, and weaker borrowers.

Brokerage platforms posted strong third-quarter results as regulators weigh longer trading hours. Robinhood reported net revenues of $1.42 billion, up 12%, while net income fell 14% to $476 million. Charles Schwab posted record net revenues of $7.2 billion, up 17%, and net income of $2.9 billion. Interactive Brokers reported net revenues of $1.91 billion and raised its quarterly dividend to $0.15 per share from $0.0875. SoFi's net revenue rose 44% to a record $1.4 billion, and it raised its full-year guidance. Nasdaq expects a 23-hour trading day to start on December 6, 2026, pending Securities and Exchange Commission approval. The Commodity Futures Trading Commission will hold a roundtable on 24/7 derivatives trading on December 15.

How AI attack Agents work, and how defenders should respond. A former Charles Schwab CISO explains how AI attack agents work, what they cost, and how to prioritize fixes by exploitability. Six short lessons with video clips. Here's what you'll learn. * How AI attack agents coordinate, and why one failed attempt doesn't stop them * What a large automated attack costs to run today * What "hyper defense" means, and why it starts with exploitability * How to split fixes into "now" and "on schedule" * Why the biggest security gains come from the application itself Your guide is Bashar Abouseido, President of Tenex.ai and former SVP and CISO at Charles Schwab. He started his career as a developer. He spoke with Christine Bevilacqua of apisec University at apisec|con 2026. Two terms come up throughout. A vulnerability is a weakness in software. It is exploitable when an attacker can actually use it to do harm, and it is validated when someone has confirmed that by testing it. Lesson 1: AI attack agents work like ant colonies. An AI agent is software that uses an AI model to decide its next action on its own. Bashar explained how swarms of them attack: "Agents don't communicate to each other. They use the framework to leave evidence of progress, and other agents come in and just pick up that progress and keep finding ways and path and creating a graph to exploitation." (07:29) The "framework" is an open pen-testing toolkit (pen testing means simulating an attack to find weaknesses). Many of these toolkits are freely available on GitHub. Each agent leaves a trace, the next continues from there, and together they map a path to a successful attack. Takeaway: a single blocked attempt doesn't end the attack. Progress accumulates. Lesson 2: Large attacks are now cheap. "26,000 agents for 48 hours, the total cost was about $15,000." (06:59) Bashar expects that cost to keep dropping as GPUs (the chips AI models run on) and open-source models become easier to get. Open-weight models are AI models anyone can download and run on their own hardware. Takeaway: sustained, automated attacks are no longer limited to big, well-funded groups. Lesson 3: Hyper offense needs hyper defense. Bashar calls this new kind of attack "hyper offense": thousands of agents in parallel at machine speed. His answer: "Hyper offense will require hyper defense. Hyper defense meaning I need to use AI at scale agentically to detect. I need to focus on exploitability and validation." (29:06) "Agentically" means using AI agents on defense too, so detection keeps pace with attackers. He also wants every finding judged in business context. Is this application revenue-generating? Do APIsec University has enough controls? How much time do APIsec University has? Takeaway: defenders need automation at the same scale, pointed at what really matters. Lesson 4: Fix what's exploitable, not everything at once. Security teams often try to patch every finding faster. Bashar disagrees: "You don't need to patch faster necessarily. I really don't think so. But what I think we need to do is defend smarter, and that includes how we focus on what I consider to be the highest risk, the validated risk, which is exploitability." (30:10) A scanner can report thousands of findings. Most are theoretical. Ask two questions of each one: can an attacker actually use it, and has that been confirmed? For example, a scanner may flag an outdated library. If your code never calls the vulnerable function, it's a real finding but a low priority. A broken access check on a public API endpoint, confirmed exploitable by a test, goes to the top. Takeaway: validated, exploitable issues go first. Lesson 5: two tracks for fixing. Bashar splits fixes into two tracks. Track one is validated, exploitable issues. They go to developers immediately, and the detection team adds a compensating control while the fix ships. That's a temporary protection, such as a WAF (web application firewall) rule that blocks the vulnerable request. Track two is everything else, which stays on the normal schedule: "Maybe it is okay to stay with the cadence of 30 days or 35 days, whatever the cadence is within an organization." (14:58) Takeaway: rushing every fix creates new risk. Prioritize, protect, then patch. Lesson 6: The biggest gains come from the application. A CISO (chief information security officer) runs an organization's security program. Bashar says most come from infrastructure, so they invest in networks and firewalls and leave application security to developers. Many companies try to close that gap with a security champions program: developers who take on security duties inside their own teams. Bashar sees that handoff as part of why application security has lagged: "If you wanna reduce risk the most, you need to start with applications first." (18:44) Takeaway: if you're building a career in security, application and API security skills are where the biggest risk reduction happens. Try it yourself. Only practice on systems you own, or on labs built to be attacked, such as OWASP crAPI or OWASP Juice Shop. Never test systems without permission. * Triage like a defender. Run a free scanner against one of these labs. Sort the findings into two lists: "exploitable and confirmed" and "theoretical." For each confirmed one, write down how you proved it. * Plan a compensating control. For one confirmed issue, describe a temporary protection, such as a WAF rule that blocks the bad request, and then the real code fix. * Map the attack surface. List every API endpoint the lab exposes, from its API documentation or its traffic. Mark which ones work without logging in. Those are where attackers start. To map a real codebase, try the free, open-source apisec Surface tools.