a16z Survey of 100 CISOs: AI Security Priorities Completely Rewritten, but Production Deployment Far Lags Procurement Intent
a16z released a survey of 100 CISOs at companies with more than 1,000 employees in October 2026. 87% expect cybersecurity spending to increase in 2027, and all seven top priorities for 2027 involve AI (in 2026, the top priority was exposure and vulnerability management and SIEM). However, only 18% of enterprises report production use of AI SOC tools, while 45% plan to procure internal AI agent security within 12 months. 44% of buyers first look to existing platforms, and 47% are willing to choose startups if they can address capability gaps that existing vendors cannot solve. a16z holds portfolio interests in several categories covered by the survey.
The security priority list has been completely rewritten in one year. A survey by a16z of 100 CISOs at companies with more than 1,000 employees shows that when asked to recall their 2026 priorities, exposure and vulnerability management and SIEM ranked at the top; whereas all seven highest-ranked initiatives for 2027 involve AI. Internal AI agent security, SOC automation, and offensive security saw the largest gains, followed closely by code security, remediation, and AI governance.
Two factors are driving this shift: enterprises need to protect the AI that employees and customers are already using, and they also want to apply AI internally within security teams—to help investigate attacks, test systems, and fix discovered issues.
Budget directions align with outside expectations. 87% of surveyed CISOs expect an increase in cybersecurity spending in 2027, primarily driven by AI-enabled threats and the expanded attack surface resulting from their own AI deployments. Most additional spending flows into tools, but not at the expense of headcount: nearly half expect security team sizes to increase, another half expect them to remain flat, and only 4% expect cuts. The survey interprets this choice as a coverage requirement—teams want to investigate alerts that would otherwise backlog, test more applications, and close vulnerabilities earlier.
However, there is a significant gap between intent and production. Only 18% of enterprises report that AI SOC tools have entered production environments, and 13% report that AI offensive security or AI exposure remediation has gone live. Most enterprises are still piloting or expect to reach production within the next year. Procurement plans are more urgent: 45% plan new purchases or upgrades for internal AI agent security within twelve months, 42% for offensive security, and 38% for AI usage and governance.
Offensive security is shifting from periodic assessment to a continuous capability. a16z notes in its article that Bain & Company estimates AI can compress a typical attack sequence from about four weeks to about eighteen hours, significantly shortening the time defenders have to find and fix exposures. 83% of respondents consider more frequent security posture testing important, with 54% considering it very important. Currently, 18% of enterprises say most of their offensive testing runs continuously against production assets, and 52% expect to reach this state within a year; five years out, 44% expect testing to be embedded in CI/CD processes, triggered by code or infrastructure changes.
Discovering vulnerabilities is the fast part; fixing them is the bottleneck. A fintech CISO stated, 'These AI tools allow you to find vulnerabilities faster, but not patch them faster.' 70% of respondents want to retest and verify that vulnerabilities have been fixed, 67% want to prioritize remediation using validated exploitability, and 57% want automated generation of remediation tickets. An executive at a large cybersecurity platform described the opportunity as 'find it, fix it'—tracking from discovery to deployable changes, then rerunning attacks to confirm the exposure is closed.
The core constraint of SOC automation is analyst time. Processing an alert still requires pulling evidence from multiple systems, reconstructing the event, and determining if there is a real threat; by the time the full picture is assembled, hours have passed and the response has not even started. AI SOC tools can handle evidence collection and routine checks, allowing analysts to focus on complex cases requiring judgment. However, the degree of authorization is an independent decision: today, 36% of respondents accept agents acting autonomously on low-risk actions, and this proportion is expected to rise to 60% in 12 months, with only 7% expecting to allow autonomous action in most cases.
The proliferation of internal enterprise AI is equally astonishing. 92% report at least limited production use of employee generative AI tools, 83% report coding assistants or agents are in production, and 55% have MCP servers or other agent-to-application integrations in production. These systems can access source code, retrieve company documents, and execute operations across applications. 47% cite employees leaking sensitive data to AI tools as one of their biggest concerns, 46% mention agents exceeding permissions or being hijacked, and 29% worry about prompt injection or data leakage through AI applications. 63% of responses describe security slowing down at least some AI adoption, including review, approval requirements, and restrictions on specific uses.
A structural dilemma lies in the fact that agents run on employee devices using the user's own permissions; therefore, for endpoint security tools built over the past decade, an agent reading a file or calling an API is indistinguishable from the employee doing it. EDR, DLP, and Zero Trust fail at this level.
In procurement decisions, existing platforms still get the first call. 44% of respondents said they first look for AI capabilities within existing security platforms, compared to only 21% who start with AI-native vendors. But the first call does not equal the last: 47% said they would consider choosing a startup if it could solve capability gaps that existing vendors cannot cover. One respondent bluntly stated, 'I don't want to buy another point product every time a new problem arises.'
Market noise is another obstacle. a16z cites Jake Black Hat 2026 vendor landscape, pointing out that some categories have up to 43 vendors. Buyers need to understand how much work each product completes, how much follow-up the team still handles, which operations can be safely executed, and what the running costs are—and these answers require time spent by the people the product is supposed to help. A CISO at a global apparel company described narrowing down seven or eight vendors to three for hands-on testing: 'Doing proof of concepts for all seven or eight is humanly impossible.'
a16z holds portfolio interests in several categories covered by the survey, including offensive security company Armadin, endpoint AI security company Neo, SOC automation tool Cotool, code security company Socket, social engineering simulation company Adaptive Security, and brand impersonation detection company Doppel. Armadin's Series B was co-led by a16z and Kevin Mandia; Neo's founding team previously participated in building SentinelOne. The survey conclusions have interest associations with these investment directions, and readers should evaluate their analytical stance accordingly.