Last week, Andreessen Horowitz published The New Security Agenda, Stephenie Zhang and Owen Colby's report built on a survey of 100 CISOs at companies with more than 1,000 employees. I've read a lot of market research in more than twenty years in security. Much of it tells vendors what they want to hear. This report tells you what security leaders are wrestling with, in their own words.
A few numbers stood out. 87% of the CISOs surveyed expect security spending to rise in 2027. All seven of the most-selected priorities for next year involve AI, and SOC automation drew more first-place votes than anything else. Yet only 18% say they run AI SOC tools in production today.
The gap between priority and production is where the next year of security operations gets decided. I want to share what we see from inside that gap, because 7AI's customers are already in that 18%, and the reasons they chose us say a lot about what security leaders will look for over the next twelve months.
I've been on the other side of this
Before I built companies, I spent years on offense. I commanded a unit whose job was getting into systems that did not want us there. That experience shapes how I read every defensive product I've seen since.
Attackers don't think in alerts. They think in chains. Initial access is one link. Then credentials, then lateral movement, then whatever they came for. Each link is cheap to try and cheap to abandon. If one path closes, they take another and keep moving.
AI made every link cheaper. The a16z report opens with OpenAI's own agents chaining exploits and stolen credentials to break out of a cybersecurity evaluation and into Hugging Face's production systems. OpenAI disclosed the incident itself. It is the clearest public picture we have of what an autonomous attacker does: it keeps going until it reaches the goal. Bain's estimate, which a16z cites, is that AI compresses a typical attack sequence from about four weeks to roughly eighteen hours.
When I look at defense through that lens, one question matters more than any feature comparison. Does the defender's work also form a chain, and does that chain finish faster than the attacker's?
Investigation is one link
For the past two years, the AI SOC conversation has centered on investigation. That made sense. Investigation was the most painful, most manual part of the job, and it's where we started too. An analyst pulling evidence from six consoles to decide whether one alert is real is the definition of non-human work.
But an investigation that ends in a verdict, with nothing after it, is just a well-documented open door.
The a16z authors make this point about offensive security, and it also applies to the SOC. One fintech CISO told them AI tools help you find vulnerabilities faster, "but you're not able to patch faster." The report argues that the find has to come with the fix: carry each finding through to a deployed change, then prove the exposure is closed.
The report is specific about why fixing lags. Finding the right owner, working out what needs to change, getting that change tested and deployed: ownership, capacity, prioritization, change management. AI accelerated discovery. None of those four got faster on their own.
The SOC has the same four problems. Who owns the response to a confirmed threat? Who has the hours to act on it tonight? Which of the twelve confirmed findings matters most to this business? How do you contain something in production without breaking what the business depends on? A faster verdict doesn’t answer any of them.
Replace "vulnerability" with "confirmed threat" and you have the problem facing every security operations team adopting AI right now. If agents finish an investigation in minutes and the response waits in a queue, the attacker still has their eighteen hours. If the detection that should have fired never existed, there is nothing to investigate. And when a new exploit lands overnight, nobody wants to wait for an alert to learn whether they're exposed.
So we built 7AI to carry the whole chain:
- Detect. Adaptive Detection Engineering analyzes each environment, finds the gaps and the noisy rules, and writes better detection logic back into the customer's own tools.
- Investigate. Agents work every alert to a conclusion across the SIEM, EDR, identity, cloud, and email tools the customer already owns, and show the evidence and reasoning behind every decision.
- Respond. Conclusions become actions: containment, remediation, and recorded changes in customer systems, inside boundaries each customer sets.
- Hunt. New threat intelligence gets checked against the environment automatically, and any hypothesis an analyst can describe becomes a hunt.
- Learn. What each investigation and hunt teaches feeds back into detection, so the system gets sharper in that specific environment every week.
Investigation sits in the middle of that loop. It was never meant to be the end of it.
What the data says about how CISOs choose
The section of the report I keep coming back to is about buying behavior. 44% of CISOs say they look first to AI features from a platform they already own. Only 21% start with an AI-native vendor. That's rational. Existing platforms have the data, the procurement history, and the relationship.
But the first call isn't always the last. When a16z asked what would lead a CISO to choose a startup over an incumbent, the top answer, at 47%, was a capability gap the existing vendor can't close.
That matches what we hear in nearly every evaluation. Security leaders rarely come to us looking for another AI feature. They come because their stack has plenty of features and still can't finish the work. A few patterns repeat:
- They want the work done, not assisted. Copilots help an analyst move faster through the same queue. Our customers wanted the queue handled, with every alert worked to a conclusion and their people focused on what needs judgment.
- They don't want to rip anything out. 7AI works on data where it already lives. No new sensor, no migration, no requirement to centralize everything before agents can start.
- They're tired of point products. One leader in the survey said he doesn't want to keep buying a new point product for every new problem. Our customers feel the same. Detection, investigation, response, and hunting on one platform is a big part of why they consolidate onto 7AI instead of adding another tool.
- They need to trust it before they let it act. Today, 36% of the leaders surveyed are comfortable letting agents act on their own for low-risk actions. 60% expect to be within a year. That shift only happens with transparency. Every 7AI investigation shows its work, and each customer decides where agents act on their own and where a person approves.
- They need proof in their own environment, fast. One CISO in the survey described cutting seven or eight vendors down to three because testing all of them was impossible. We take that burden off the customer. Our team owns deployment, it takes about a week, and we would rather run side by side with an incumbent on the same alerts than argue on slides.
A year ago, I underestimated how much that last point would matter. I believed the technology would sell itself once people saw it. It didn't. What won customers was our people sitting with their teams until the results were undeniable in their own environment.
Capacity was always the limit
One chart in the report should settle a long-running debate. Even with AI taking on more of the work, nearly half of the CISOs surveyed expect security headcount to grow in 2027, about half expect it to hold flat, and only 4% expect cuts. 96 out of 100 are keeping or growing their teams.
That tells you what security leaders are actually buying. They aren’t trying to replace their people. They’re trying to get past the limits of their capacity.
Most of how a SOC is organized today was designed around those limits. An analyst can only work so many alerts in a shift, so we built tiers. We tuned detections down to what humans could keep up with. We created triage queues, escalation paths, and thresholds below which nobody looks. None of those lines exist because they’re the best way to defend a company. They exist because human hours ran out.
AI removes those constraints, and that changes the question. The question is no longer how many people a SOC can cut. It’s what the team would do if capacity stopped being the limit. Every CISO I talk to has the same answer: get back to reducing risk. Over the years, security teams got pulled into processing tickets. With the volume handled, they can return to the job they were hired for, which is protecting the business.
That changes what a security operations team looks like. The analysts I know got into this field to chase adversaries. Too many of them spend their days closing tickets about legitimate marketing emails. When agents take the correlation, enrichment, and routine triage, those people move to work only they can do: deciding what a finding means for the business, approving the response that could disrupt production, hunting for what no rule describes yet, and teaching the system what normal looks like in their company.
That is what we mean by humans on the loop. Agents handle the steps that don't need judgment. People set the boundaries, make the high-consequence calls, and stay accountable for the outcome.
Our people matter as much as our agents
There's a second group of people in this story, and they're the reason I think 7AI got where it is.
Every 7AI customer has a named AI Security Engineer. That person learns the environment, encodes the team's exceptions and risk tolerance into the agents, reviews investigations with the customer, and builds new use cases in weeks instead of waiting on a roadmap. We call the model PLAID: People-Led, AI-Driven. Trust in a SOC gets earned by people who understand security, stand behind the outcome, and pick up the phone at 2:00 AM.
For customers who want around-the-clock coverage, PLAID ELITE adds senior 7AI analysts who oversee the agents 24/7, coordinate response, and hunt alongside the platform.
I don't think we're ahead because we're smarter than anyone else. There are strong teams building in this market. We're ahead because we started from the job a SOC has to finish rather than a feature to add, and because our customers held us to that standard every day.
That is also part of why IDC named 7AI a Leader in the 2026 IDC MarketScape for Standalone AI SOC Platforms.
The next twelve months
The a16z report says the buying window is open, and I agree. Most of the CISOs surveyed are piloting now and expect to reach production within a year. The decisions they make will shape how their teams work for the rest of the decade.
If I were on the buying side again, I would judge every AI security product by whether it finishes the chain. What happens after the verdict? Who owns the detection that should have fired? What does the system do about the threat that hasn't produced an alert yet? Who stands behind the result when something goes wrong?
Those are the questions our customers asked us. They're the reason we built 7AI the way we did.
AI cut a typical attack to eighteen hours. Our customers close the loop in minutes, with their own people making the calls that matter.
Frequently asked questions
What did a16z's survey of 100 CISOs find about AI SOC?
SOC automation drew more first-place votes than any other 2027 priority in a16z's survey of 100 CISOs at companies with more than 1,000 employees. 87% expect security spending to rise, yet only 18% run AI SOC tools in production today. The gap between priority and production is where the next year of security operations gets decided.
Why is investigation alone not enough for an AI SOC?
An investigation that ends in a verdict with nothing after it still leaves the attacker time to act. 7AI carries the whole chain: it improves detection, works every alert to a conclusion, responds inside boundaries each customer sets, hunts for threats no alert caught, and feeds what it learns back into detection. Investigation is one link in that loop.
Will AI agents replace security analysts?
No. In a16z's survey, 96 of 100 CISOs expect to keep or grow their security teams in 2027. What they're buying is capacity: the ability to work every alert, close exposures sooner, and get their teams back to reducing risk. 7AI runs with humans on the loop, so agents handle correlation, enrichment, and routine triage while people make the high-consequence calls.
Why do CISOs choose 7AI?
CISOs choose 7AI because it finishes the work instead of assisting with it. 7AI runs on the tools and data they already own, puts detection, investigation, response, and hunting on one platform, and shows the evidence behind every decision.
