The most important number here is one the survey could not ask for, and it sits right next to the fintech CISO quote.
Discovery and remediation live in different budgets and different teams. The 87% spending increase, the 83% who want more frequent posture testing and the 70% who want automated retest are all demand from the people who find problems. Capacity to fix sits in engineering, under a different P&L, and nothing in a CISO budget cycle moves it. So the operative metric is not findings per week. It is closed over opened per week. Below one, every improvement in discovery lengthens the average exposure window rather than shortening it, because the queue grows faster than it drains. The dashboard shows more red while the posture is genuinely worse.
Two of your numbers also sit awkwardly together. Bain's compression from four weeks to eighteen hours, against 36% comfortable with autonomous action on low risk items today, 60% in twelve months, and only 7% ever expecting it in most cases. If the attacker cycle is eighteen hours and the defender still needs a human approval on anything touching production, defensive cycle time is set by the on-call rota, not by the tooling. AI in the SOC then buys detection speed and leaves response speed where it was. Still worth buying. Just a different purchase from the one most of these budgets are justified with.
The follow-up worth running on the same 100 next year is one line: what share of the 2027 increase is earmarked for engineering time to fix, rather than tools to find. My guess is close to zero, and that split predicts whether any of the rest shows up as reduced risk.
The gap that matters most is between buying and actually running this stuff: 45% plan a new purchase or upgrade for internal AI agent security, yet only 18% report AI SOC tools in production. That is not a demand problem, it is a deployment problem. And the human-risk section is the part small teams should not skip — 80% rank social engineering as the top human-related risk, and AI impersonation makes the old “check the sender” advice almost useless. If your agent can read source code and pull documents, the question is not whether to give it a job, it is which actions still need a human in the loop before it touches production.
For internal agents, a lot of the risk changes outside CI. Someone connects a new tool or widens an OAuth scope, no code ships, and the agent can suddenly reach systems nobody tested. Triggering the offensive run on connector and scope changes too would cover that gap.
The number I would not bury under the market-cap paragraph is the production gap: 45% of these CISOs plan to buy or upgrade internal AI agent security within twelve months, but only 18% report AI SOC tools in production and 13% report AI offensive security or remediation in production. I would want to know what those 100 leaders count as production for an agent that can read source and production systems, because a pilot that still needs a human on every action is a different control than standing credentials. The 4% who expect to cut headcount also fits: if spend rises for 87% and almost nobody shrinks the team, the bottleneck is still who decides which finding is actually the business risk.
Steph, Owen, thanks for this. The line that stuck with me: an analyst still has to "pull evidence from several systems, reconstruct what happened" before response even starts. That's the real SOC bottleneck, and one more agent per tool won't fix it. The bigger shift is an interactive SOC: evidence unified across tools, AI correlating the signals into one incident, and analysts steering the investigation and approving the risky actions. Your 36% to 60% autonomy numbers fit that model. Delegate the gathering and keep people on the decisions. (Full disclosure: I'm at Stellar Cyber, so I think about this a lot.)
The most important number here is one the survey could not ask for, and it sits right next to the fintech CISO quote.
Discovery and remediation live in different budgets and different teams. The 87% spending increase, the 83% who want more frequent posture testing and the 70% who want automated retest are all demand from the people who find problems. Capacity to fix sits in engineering, under a different P&L, and nothing in a CISO budget cycle moves it. So the operative metric is not findings per week. It is closed over opened per week. Below one, every improvement in discovery lengthens the average exposure window rather than shortening it, because the queue grows faster than it drains. The dashboard shows more red while the posture is genuinely worse.
Two of your numbers also sit awkwardly together. Bain's compression from four weeks to eighteen hours, against 36% comfortable with autonomous action on low risk items today, 60% in twelve months, and only 7% ever expecting it in most cases. If the attacker cycle is eighteen hours and the defender still needs a human approval on anything touching production, defensive cycle time is set by the on-call rota, not by the tooling. AI in the SOC then buys detection speed and leaves response speed where it was. Still worth buying. Just a different purchase from the one most of these budgets are justified with.
The follow-up worth running on the same 100 next year is one line: what share of the 2027 increase is earmarked for engineering time to fix, rather than tools to find. My guess is close to zero, and that split predicts whether any of the rest shows up as reduced risk.
The gap that matters most is between buying and actually running this stuff: 45% plan a new purchase or upgrade for internal AI agent security, yet only 18% report AI SOC tools in production. That is not a demand problem, it is a deployment problem. And the human-risk section is the part small teams should not skip — 80% rank social engineering as the top human-related risk, and AI impersonation makes the old “check the sender” advice almost useless. If your agent can read source code and pull documents, the question is not whether to give it a job, it is which actions still need a human in the loop before it touches production.
For internal agents, a lot of the risk changes outside CI. Someone connects a new tool or widens an OAuth scope, no code ships, and the agent can suddenly reach systems nobody tested. Triggering the offensive run on connector and scope changes too would cover that gap.
The number I would not bury under the market-cap paragraph is the production gap: 45% of these CISOs plan to buy or upgrade internal AI agent security within twelve months, but only 18% report AI SOC tools in production and 13% report AI offensive security or remediation in production. I would want to know what those 100 leaders count as production for an agent that can read source and production systems, because a pilot that still needs a human on every action is a different control than standing credentials. The 4% who expect to cut headcount also fits: if spend rises for 87% and almost nobody shrinks the team, the bottleneck is still who decides which finding is actually the business risk.
Steph, Owen, thanks for this. The line that stuck with me: an analyst still has to "pull evidence from several systems, reconstruct what happened" before response even starts. That's the real SOC bottleneck, and one more agent per tool won't fix it. The bigger shift is an interactive SOC: evidence unified across tools, AI correlating the signals into one incident, and analysts steering the investigation and approving the risky actions. Your 36% to 60% autonomy numbers fit that model. Delegate the gathering and keep people on the decisions. (Full disclosure: I'm at Stellar Cyber, so I think about this a lot.)