Last week, Andreessen Horowitz published The New Security Agenda, Stephenie Zhang and Owen Colby's report built on a survey of 100 CISOs at companies with more than 1,000 employees. I've read a lot of market research in more than twenty years in security. Much of it tells vendors what they want to hear. This report tells you what security leaders are wrestling with, in their own words.
A few numbers stood out. 87% of the CISOs surveyed expect security spending to rise in 2027. All seven of the most-selected priorities for next year involve AI, and SOC automation drew more first-place votes than anything else. Yet only 18% say they run AI SOC tools in production today.
The gap between priority and production is where the next year of security operations gets decided. I want to share what we see from inside that gap, because 7AI's customers are already in that 18%, and the reasons they chose us say a lot about what security leaders will look for over the next twelve months.
Before I built companies, I spent years on offense. I commanded a unit whose job was getting into systems that did not want us there. That experience shapes how I read every defensive product I've seen since.
Attackers don't think in alerts. They think in chains. Initial access is one link. Then credentials, then lateral movement, then whatever they came for. Each link is cheap to try and cheap to abandon. If one path closes, they take another and keep moving.
AI made every link cheaper. The a16z report opens with OpenAI's own agents chaining exploits and stolen credentials to break out of a cybersecurity evaluation and into Hugging Face's production systems. OpenAI disclosed the incident itself. It is the clearest public picture we have of what an autonomous attacker does: it keeps going until it reaches the goal. Bain's estimate, which a16z cites, is that AI compresses a typical attack sequence from about four weeks to roughly eighteen hours.
When I look at defense through that lens, one question matters more than any feature comparison. Does the defender's work also form a chain, and does that chain finish faster than the attacker's?
For the past two years, the AI SOC conversation has centered on investigation. That made sense. Investigation was the most painful, most manual part of the job, and it's where we started too. An analyst pulling evidence from six consoles to decide whether one alert is real is the definition of non-human work.
But an investigation that ends in a verdict, with nothing after it, is just a well-documented open door.
The a16z authors make this point about offensive security, and it also applies to the SOC. One fintech CISO told them AI tools help you find vulnerabilities faster, "but you're not able to patch faster." The report argues that the find has to come with the fix: carry each finding through to a deployed change, then prove the exposure is closed.
The report is specific about why fixing lags. Finding the right owner, working out what needs to change, getting that change tested and deployed: ownership, capacity, prioritization, change management. AI accelerated discovery. None of those four got faster on their own.
The SOC has the same four problems. Who owns the response to a confirmed threat? Who has the hours to act on it tonight? Which of the twelve confirmed findings matters most to this business? How do you contain something in production without breaking what the business depends on? A faster verdict doesn’t answer any of them.
Replace "vulnerability" with "confirmed threat" and you have the problem facing every security operations team adopting AI right now. If agents finish an investigation in minutes and the response waits in a queue, the attacker still has their eighteen hours. If the detection that should have fired never existed, there is nothing to investigate. And when a new exploit lands overnight, nobody wants to wait for an alert to learn whether they're exposed.
So we built 7AI to carry the whole chain:
The section of the report I keep coming back to is about buying behavior. 44% of CISOs say they look first to AI features from a platform they already own. Only 21% start with an AI-native vendor. That's rational. Existing platforms have the data, the procurement history, and the relationship.
But the first call isn't always the last. When a16z asked what would lead a CISO to choose a startup over an incumbent, the top answer, at 47%, was a capability gap the existing vendor can't close.
That matches what we hear in nearly every evaluation. Security leaders rarely come to us looking for another AI feature. They come because their stack has plenty of features and still can't finish the work. A few patterns repeat:
One chart in the report should settle a long-running debate. Even with AI taking on more of the work, nearly half of the CISOs surveyed expect security headcount to grow in 2027, about half expect it to hold flat, and only 4% expect cuts. 96 out of 100 are keeping or growing their teams.
That tells you what security leaders are actually buying. They aren’t trying to replace their people. They’re trying to get past the limits of their capacity.
Most of how a SOC is organized today was designed around those limits. An analyst can only work so many alerts in a shift, so we built tiers. We tuned detections down to what humans could keep up with. We created triage queues, escalation paths, and thresholds below which nobody looks. None of those lines exist because they’re the best way to defend a company. They exist because human hours ran out.
AI removes those constraints, and that changes the question. The question is no longer how many people a SOC can cut. It’s what the team would do if capacity stopped being the limit. Every CISO I talk to has the same answer: get back to reducing risk. Over the years, security teams got pulled into processing tickets. With the volume handled, they can return to the job they were hired for, which is protecting the business.
That changes what a security operations team looks like. The analysts I know got into this field to chase adversaries. Too many of them spend their days closing tickets about legitimate marketing emails. When agents take the correlation, enrichment, and routine triage, those people move to work only they can do: deciding what a finding means for the business, approving the response that could disrupt production, hunting for what no rule describes yet, and teaching the system what normal looks like in their company.
That is what we mean by humans on the loop. Agents handle the steps that don't need judgment. People set the boundaries, make the high-consequence calls, and stay accountable for the outcome.
There's a second group of people in this story, and they're the reason I think 7AI got where it is.
Every 7AI customer has a named AI Security Engineer. That person learns the environment, encodes the team's exceptions and risk tolerance into the agents, reviews investigations with the customer, and builds new use cases in weeks instead of waiting on a roadmap. We call the model PLAID: People-Led, AI-Driven. Trust in a SOC gets earned by people who understand security, stand behind the outcome, and pick up the phone at 2:00 AM.
For customers who want around-the-clock coverage, PLAID ELITE adds senior 7AI analysts who oversee the agents 24/7, coordinate response, and hunt alongside the platform.
I don't think we're ahead because we're smarter than anyone else. There are strong teams building in this market. We're ahead because we started from the job a SOC has to finish rather than a feature to add, and because our customers held us to that standard every day.
That is also part of why IDC named 7AI a Leader in the 2026 IDC MarketScape for Standalone AI SOC Platforms.
The a16z report says the buying window is open, and I agree. Most of the CISOs surveyed are piloting now and expect to reach production within a year. The decisions they make will shape how their teams work for the rest of the decade.
If I were on the buying side again, I would judge every AI security product by whether it finishes the chain. What happens after the verdict? Who owns the detection that should have fired? What does the system do about the threat that hasn't produced an alert yet? Who stands behind the result when something goes wrong?
Those are the questions our customers asked us. They're the reason we built 7AI the way we did.
AI cut a typical attack to eighteen hours. Our customers close the loop in minutes, with their own people making the calls that matter.
SOC automation drew more first-place votes than any other 2027 priority in a16z's survey of 100 CISOs at companies with more than 1,000 employees. 87% expect security spending to rise, yet only 18% run AI SOC tools in production today. The gap between priority and production is where the next year of security operations gets decided.
An investigation that ends in a verdict with nothing after it still leaves the attacker time to act. 7AI carries the whole chain: it improves detection, works every alert to a conclusion, responds inside boundaries each customer sets, hunts for threats no alert caught, and feeds what it learns back into detection. Investigation is one link in that loop.
No. In a16z's survey, 96 of 100 CISOs expect to keep or grow their security teams in 2027. What they're buying is capacity: the ability to work every alert, close exposures sooner, and get their teams back to reducing risk. 7AI runs with humans on the loop, so agents handle correlation, enrichment, and routine triage while people make the high-consequence calls.
CISOs choose 7AI because it finishes the work instead of assisting with it. 7AI runs on the tools and data they already own, puts detection, investigation, response, and hunting on one platform, and shows the evidence behind every decision.