100 CISOs ranked their 2027 priorities for a16z: AI SOC takes #1

Andreessen Horowitz (a16z), one of the world's biggest venture capital firm, published last week The New Security Agenda, a survey of 100 CISOs at companies with more than 1,000 employees. Each of them ranked their top five security priorities for 2027. AI SOC came first.

On first-place votes, it wasn't close. AI SOC got twice as many as the next initiative on the list. Most of these CISOs also expect their security budgets to grow in 2027.

We think they're right, and the rest of the survey helps explain why.

The shift from SIEM to SOC automation

Their priorities changed a lot in a year. For 2026, these same CISOs had exposure and vulnerability management and SIEM at the top of their lists. For 2027, all seven of their most-selected initiatives involve AI, and SOC automation gained more ground than almost anything else. a16z traces the shift to two jobs: securing the AI that employees and customers already use, and putting AI to work inside security to investigate attacks, test systems and fix what they find. The AI SOC is the clearest case of the second, so for buyers the real decision is which AI SOC to trust.

Attacks now move faster than most SOCs can

Attackers are using AI to get faster and stealthier. Bain estimates that with AI, a typical attack that used to take about four weeks can now play out in about eighteen hours, a figure a16z cites in its report. Attackers also log in with valid credentials and use the company's own admin tools, so a lot of what they do looks like normal work and shows up as low-severity alerts. CISOs feel it: 55% list AI-accelerated attacks outpacing their team's ability to respond among their biggest worries.

Most SOCs still work at the speed of their analysts. According to a16z, handling a single alert means pulling evidence from several systems, piecing together what happened and deciding whether it's a real threat. That can take hours before anyone starts to respond. And because teams work the queue by severity, low-severity alerts sit and wait, and many never get looked at.

An AI SOC closes that gap because it works at machine speed and scale, the same way the attackers do. CISOs aren't treating it as a way to cut staff, either. Nearly half actually expect their security teams to grow in 2027, about half expect them to stay the same size, and only 4% plan cuts. What they want is coverage, starting with the alerts that would otherwise wait.

Why AI SOC is the right place to start

Every initiative on the a16z list matters. If we had to pick where to start, though, we'd pick the SOC, and not just because we build one.

Most of the other initiatives add work. Securing internal AI agents, governing how employees use AI and checking AI-written code all matter, but each one lands on a team that's already stretched. An AI SOC is one of the few that gives time back. It takes on the alert volume, so analysts can spend their days on threat hunting, detection engineering and the hard investigations that need a person's judgment.

It also helps the other investments pay off. New controls for AI agents, cloud and identity all produce alerts, and those alerts end up in the SOC queue. If nobody has time to investigate them, each new tool just makes the backlog longer.

The results are easy to measure, too. A CISO can track how many alerts were investigated, how long each one took to reach a verdict, how many still needed a person and how many detection rules were fixed or added, then bring those numbers to the board.

Autonomy can grow as trust does. Today, 36% of CISOs are comfortable letting AI agents act on their own for low-risk actions, and 60% expect to be within a year. Only 7% expect to let agents act alone in most cases. A good AI SOC fits that pace. It can take over the investigation completely, while any response that could disrupt the business stays within your policy and waits for approval where you want it.

Not every AI SOC is a safe bet

The market is crowded. a16z points to a vendor map with as many as 43 companies in a single AI security category, and many of their pitches sound alike. One CISO told a16z they cut seven or eight vendors down to three for hands-on testing, because running a proof of concept with all of them was "not humanly possible."

a16z says buyers need answers to four questions before they commit. Here's how Intezer answers each one.

In the end, a CISO has to stand behind every verdict, and that's hard to do with AI SOCs that rely on LLMs alone. They reason over logs and the conclusions of other security tools, with no forensic evidence of their own. Their answers can change from one run to the next, and costs rise with every token.

Intezer works differently. As an AI SOC with forensic depth, it fuses AI reasoning with deterministic forensic tools, including reverse engineering, endpoint forensics and memory analysis. Every alert is investigated in depth before anything is escalated, and every verdict rests on evidence Intezer produced itself. Context comes from your SIEM, identity provider and more, and from OrgBrain, Intezer's organizational context layer, which learns how your environment works from past cases and live data.

Each verdict feeds back into your detections. Because Intezer triages every alert your rules fire, it can see which rules catch real threats and which only create noise. Broken and noisy rules get fixed, and missing ones get added. As your team's trust grows, you decide when people can step back from approving each response.

Most teams haven't chosen yet

Only 18% of the CISOs a16z surveyed run AI SOC tools in production today. Many of the others are running pilots and deciding which products they can trust, so for most security teams, this decision is being made now. The teams that choose well will catch hidden threats sooner and free their analysts for the work that needs a person.

Intezer is built for that decision. Every alert gets a verdict in about a minute on average, with 98% verdict accuracy, and less than 2% ever reach a person. When one does, it arrives as a single case with the evidence attached, so your team can act on it immediately. That's how Intezer transforms your security operations for the agentic era, so you can face AI threats with certainty. 

See what an AI SOC with forensic depth finds in your alerts. Book a demo.

Survey data in this post comes from a16z, The New Security Agenda (28 Oct 2026), based on a survey of 100 CISOs at companies with more than 1,000 employees. The survey charts are by a16z and shown as published.

‍

‍

‍

‍