Deep Dive: Surveying 100 CISOs on How AI Is Reshaping Enterprise Security Budgets | Yunqi Tech Pi

云启资本云启资本··0·25

AI is rewriting both offense and defense at the same time.

AI is rewriting both sides of the attack-defense equation. Models can now find vulnerabilities on their own and chain together long sequences of exploits. Meanwhile, enterprises are plugging more and more agents into internal documents, source code, and business systems — letting them read files, call APIs, and change configurations with employee-level permissions. The shift is already happening, but one practical question remains largely unanswered: where will enterprise security budgets move as a result.

a16z recently surveyed 100 CISOs at companies with 1,000+ employees, asking about their priorities, budgets, and purchasing plans for 2027. What makes this material worth reading is that the answers come from frontline buyers, not vendors: 87% expect cybersecurity spending to rise, yet security teams are still hiring; AI SOC and code security both cracked the top-five priorities, yet only 18% and 13% are actually running in production; testing frequency is shifting from scheduled checks to CI/CD integration, but remediation remains the bottleneck; and 60% of CISOs plan to let agents autonomously handle low-risk tasks within the next year — raising the question of exactly where permission boundaries should be drawn.

In this episode of Yunqi Tech Pi, we look at how AI is redrawing the boundaries of enterprise security.

The following content is republished with authorization from the WeChat public account Haiwai Dujiaoshou.

By a16z; compiled by Daniel; edited by Siqi

This summer, the incident where an OpenAI agent infiltrated Hugging Face's production system made AI's security challenges vividly concrete: models can not only find vulnerabilities but also obtain permissions, execute attacks, and complete sequences of steps that previously required skilled human attackers.

More recently, OpenAI's "Patch the Planet" initiative helped researchers discover critical vulnerabilities in PHP, bringing the pressure of inspection and emergency patching to more enterprises. AI is helping defenders find problems faster, but whether companies can promptly assess risk and complete fixes afterward is equally determinative of whether systems remain secure.

At the same time, enterprises themselves are deploying growing numbers of agents. These can read internal documents, access source code, and even invoke business systems using employee permissions. Security teams must both leverage AI to process more alerts and test more systems, and figure out what these agents can access, what they've done, and which operations require human approval.

How will these changes reshape the AI security landscape? a16z's latest survey of 100 chief information security officers (CISOs) offers valuable material for understanding shifts in this space. Drawing on real-world AI deployments in production environments, the CISOs discussed their 2027 priorities, budgets, and purchasing plans for enterprise security.

Compared to predictions about technical capabilities, these responses from frontline buyers make it easier to see what problems enterprises are actually facing right now — and what they're willing to pay for.

Below is our compiled translation of the report. We want to use this survey to examine two questions: what specific changes is AI bringing to enterprise security? And as these new needs enter the procurement process, where do opportunities lie for incumbent security platforms versus startups?

01 Why Now

AI Is Shifting the Focus of Enterprise Security

AI has changed the cybersecurity industry before quantum computing has.

The OpenAI agent's infiltration of Hugging Face this summer was a turning point. Since then, AI has successively helped discover vulnerabilities in foundational internet software. Just last week, researchers in OpenAI's "Patch the Planet" program found critical vulnerabilities in PHP that had existed for over a decade. On the same day, it emerged that eMudhra — a certificate authority trusted by all major browsers — was using extremely weak encryption keys, one of which was literally just the number 4.

Patch the Planet is an OpenAI initiative that partners with security research institutions and open-source maintainers, combining AI-assisted vulnerability research with human verification and patch development. Under specific conditions, the PHP vulnerabilities could allow unauthenticated attackers to execute code on servers, with risk cascading through shared software dependencies to affect many enterprises. This PHP incident demonstrates that AI-assisted research can validate the serious consequences of long-standing flaws in widely relied-upon mature software.

Security problems like these have always existed; what's changing is models' improving ability to discover and exploit vulnerabilities. Evaluations by the AI Security Institute reflect this progression: newer models can complete increasingly complex cybersecurity tasks.

The AI Security Institute (AISI) is a UK government-established research and evaluation body for frontier AI.

This test breaks down a simulated cyberattack into 32 steps. Under equivalent test budgets: GPT-5.4 completed roughly 13 steps on average, while the new Mythos Preview completed about 25 steps on average, with its best attempt completing all 32 steps. This indicates that newer models can chain together more attack stages and advance through longer attack flows.

AISI test. Results are from simulated networks and do not equate to breaching real enterprise networks with defenses in place.

As vulnerabilities multiply, enterprise security teams must make rapid judgments about which pose the greatest risk to their business — and patch them before attackers can exploit them.

Data published by Epoch AI in July shows that enterprises face growing numbers of security vulnerabilities to assess and address: in the chart below, the orange line represents high-severity vulnerabilities, approaching 1,200 as of July 2026; the green line represents critical vulnerabilities, approaching 400.

Meanwhile, the scope of enterprise security teams' attention is also expanding.

As more employees deploy applications built with Vibe Coding, and more agents gain access to company documents, source code, and production systems, each new application or service connection requires security teams to understand how it operates and how to protect it.

These developments also help explain the market cap gains of cybersecurity platforms like Palo Alto Networks and CrowdStrike this year. As of October 28, the two companies' market values had risen approximately 152% and 132% respectively since the start of the year.

But with enterprises facing mounting security risks, a highly practical question arises: how will cybersecurity budgets change?

To understand how security leaders are responding to these pressures, a16z surveyed 100 CISOs about their 2027 priorities, budgets, and purchasing plans. All respondents work at companies with more than 1,000 employees.

Among them, 87% expect cybersecurity spending to increase. The main reasons are twofold:

  • AI introduces new security threats;
  • The deeper enterprises deploy AI, the more applications and systems need protection.

On one hand, much of this additional spending will go toward purchasing AI-related tools. But contrary to the broader "AI replacing white-collar workers" narrative, these respondent companies are not considering downsizing their security teams as a result. In fact, nearly ~50% still expect security team headcount to increase by 2027, another half expect it to stay flat, and only 4% anticipate layoffs.

Why, as AI takes over more coding tasks, are more people still needed? Because teams want to get more done: they still need staff to handle alerts that previously sat in queues, test more applications, and fix vulnerabilities earlier.

CISOs are already running pilots, setting aside budgets, and evaluating which products are reliable enough for production deployment. Many purchasing decisions will be made in the next 12 months, and their top concerns have shifted dramatically from a year ago.

Security industry demand is changing rapidly. In a16z's 2026 CISO survey, the highest priorities were attack surface and vulnerability management, and security information and event management (SIEM). By 2027, CISOs' work and budget priorities have become AI-centric.

When it comes to Top 5 priorities, AI SOC and code security were chosen at nearly identical rates — 49% and 48% respectively. But when asked to pick the single most important one, 22% of surveyed CISOs chose AI SOC.

SOC (Security Operations Center) is the team within an enterprise responsible for day-to-day network security monitoring, attack detection, and incident response.

Priorities vary by organization type. Some rank SOC automation highest, while others prioritize offensive security, vulnerability remediation, or protecting their own deployed AI systems. But the broad consensus is that AI has become an indispensable part of security systems.

Looking at directional shifts compared to 2026, the biggest priority increases were internal AI Agent security (up 28 percentage points), SOC automation (up 26 points), and offensive security (up 24 points). Code security, vulnerability remediation, and AI governance followed closely behind.

Traditional attack surface and vulnerability management dropped 21 points, while AI-powered vulnerability remediation rose 22 points. Demand is tilting toward new capabilities — though this trend reflects shifting cybersecurity priorities more than direct budget allocation changes to specific categories.

Enterprises Are Starting to Buy AI Security Tools

While interest is high, most organizations haven't actually deployed these tools in production yet. Only 18% of respondents are using AI SOC tools in production; AI offensive security tools and AI attack surface and vulnerability remediation tools are both at 13%.

  • Code security tools lead in actual production deployment, with 26% of surveyed enterprises already using them and 36% running pilots;

  • Detection engineering and threat hunting, while only at 9% in production, have 30% in pilot and 42% planning adoption within the next year.

Many companies remain in pilot mode or expect to move to production within the coming year. Code security and email protection are more widely adopted, but still far from universal.

45% of respondents plan to purchase or upgrade internal AI Agent security products in the next 12 months:

  • 42% plan to buy or upgrade offensive security products;

  • 38% for AI usage management and governance products;

  • AI SOC ranked first most often in the priority survey, but only 31% plan to purchase or upgrade it in the coming year — below the 45% for internal AI agent security.

Enterprises are deciding what to buy while the products themselves keep evolving. Some are expanding existing deployments; others are making first-time purchases and still comparing vendors. So 2027 may be the year when real spending and budget shifts become visible, with every category facing a new round of evaluation and procurement.

Next, drawing on what CISOs told a16z, here's what's changing in the market and where opportunities may emerge.

02 What's New

Higher-Frequency Security Testing

Speed matters enormously in enterprise security.

First, from a workflow perspective, vulnerability remediation is inherently time-consuming because enterprise systems are constantly changing. Teams might spend weeks addressing issues found in penetration tests, but during that period developers are shipping features, employees are onboarding to new services, and permission settings are shifting. By the time one batch of issues is fixed, new vulnerabilities may already need attention.

Moreover, AI enables attackers to launch more attacks faster — and defenders need equivalent capabilities to keep pace. Bain estimates that AI can compress a typical attack chain from roughly four weeks to about 18 hours, leaving enterprises far less time to detect and remediate.

In response, security leaders are prioritizing increased testing frequency. For example, 83% of surveyed CISOs consider more frequent security posture testing important: "With all these new AI threats, we need to find problems before others do."

Armadin, an a16z portfolio company, uses autonomous agents to identify attack paths that adversaries might exploit and helps security teams shut them down.

Meanwhile, security professionals responsible for simulated attacks remain irreplaceable, but limited headcount restricts how many applications and systems they can test. One security team told a16z they're using AI to test more applications and infrastructure without increasing their existing testing budget.

Testing will become increasingly continuous. 18% of respondents said most of their offensive security testing already involves continuous monitoring of production systems and applications; 52% expect to reach that point within a year. Looking five years ahead, 44% anticipate integrating testing into CI/CD pipelines, with tests automatically triggered by code or infrastructure changes.

Chart note | Continuous testing and CI/CD integration represent two distinct phases of change

Combined with the previous testing frequency chart, most respondents want to increase test frequency. The expected transformation happens in stages: in one year, 52% expect continuous testing while 9% expect CI/CD integration; in five years, those figures shift to 39% and 44% respectively. The near-term focus is continuous production environment coverage; longer-term, tests triggered by code and infrastructure changes. These are all respondent projections.

This way, security testing keeps pace with software development and maintenance. Every new release can trigger testing; after patch deployment, remediation can be immediately verified. Teams no longer need to wait for the next scheduled assessment to discover what issues have emerged.

Chart note | Offensive security purchasing leans toward AI-native vendors

In offensive security, 42% plan to purchase from AI-native vendors versus 24% choosing add-on features from existing platforms. For the other nine AI security product categories, the corresponding medians are 24% and 45%. This category's purchasing pattern differs from others, though planned purchases don't equal closed deals.

Faster Vulnerability Discovery, But Remediation Remains the Bottleneck

AI accelerates vulnerability discovery, but remediation inevitably lags: finding the right owner, determining how to fix, then completing testing and deployment. If teams already have a substantial backlog, faster vulnerability discovery alone doesn't fundamentally improve security posture.

So after discovery, AI agents can first test whether an attacker can actually exploit the vulnerability, what systems or data they could access, and even generate tickets.

Security teams can then use these AI test results to assess actual risk, prioritize remediation, and determine where in the chain to intervene to block attacks.

AI can also assist with remediation itself, then retest afterward to confirm the original attack path has been closed.

SOC Needs to Scale

Faster attacks require SOCs to accelerate alert investigation and response. But analysts handling an alert typically must gather evidence from multiple systems, reconstruct what happened, and confirm whether a real threat exists. By the time this work is done, hours may have passed with remediation still not started.

Therefore, SOCs can have AI agents collect evidence and complete routine checks first, then have analysts investigate complex events and make decisions requiring professional judgment. This way, even with limited headcount, teams can handle more alerts that would otherwise go uninvestigated.

Of course, letting agents conduct investigations doesn't mean they should autonomously decide subsequent actions. Enterprises still need to determine, based on operational risk, which permissions can be delegated to agents.

For now, 36% of respondents are willing to let agents autonomously execute low-risk operations. Looking ahead 12 months, 60% of CISOs expect to accept letting agents independently handle low-risk SOC tasks.

Collecting logs and modifying production systems, for example, carry very different risks. Teams can delegate most investigative work to agents, but retain human approval for remediation actions that could affect business operations.

Cotool offers exactly this kind of tooling. Security teams can configure their existing investigation workflows as agents, set operational permissions and approval requirements, then have the agent call existing tools, triage alerts, and take action within authorized scope. Analysts can review results and continue refining the workflow. Repetitive investigations that previously required step-by-step human execution can be handed off to agents for repeated execution.

Cotool product illustration: The agent first checks application permissions, verifies the publisher, and tracks data access, then requests security team approval to revoke authorization

More Code, More Security Scanning Pressure

Even when a company's own security is solid, vulnerabilities in dependent software can still cause harm. The recent PHP vulnerability illustrates this point.

Code security isn't a new domain. Static Application Security Testing (SAST) and Software Composition Analysis (SCA) tools have long been standard in enterprise security stacks. But as AI enables developers to write and ship more code, it also increases the detection burden on existing security tools — will traditional code security reviews face challenges too?

Accordingly, nearly half of surveyed CISOs rank AI code security among their top five priorities for 2027, up from roughly 25% in 2026. Companies may upgrade to tools like Socket that proactively scan dependency code, or adopt slim container images with continuous rebuilds from source and timely patching; some will use both approaches.

"There are far more engineers writing code than people doing security testing."

— CISO, financial services firm

Can Agents Be Trusted?

AI has entered daily business operations, and security teams must also address risks from these tools and agents themselves:

  • 92% of respondents say generative AI tools for employees are already deployed in at least some production scenarios;

  • 83% of surveyed companies are already using coding copilots/agents in production environments;

  • 55% of surveyed companies have connected agents to business applications via MCP servers or other methods and put them into use.

Security teams need to monitor both what data employees feed into AI tools and what tools agents can call, what actions they can execute. Because these AI systems can not only read source code and retrieve company documents, but also perform operations across multiple applications. A security leader at a restaurant software company voiced a question on many teams' minds: "How can you really know what an agent is actually doing?"

  • 47% of surveyed CISOs rank employees leaking sensitive data to AI tools among their top concerns;

  • 46% worry about agents overstepping permissions or being compromised;

  • Another 29% are concerned about prompt injection attacks against AI applications or data leakage.

These concerns have already slowed AI adoption at many companies. 63% of responses indicated that security requirements have delayed or restricted some AI applications, such as requiring security reviews first, obtaining approvals, or prohibiting certain use cases.

To manage these risks, enterprise security teams need full visibility into: what tools and agents are running, who owns them, what access permissions they have, and what operations they've actually performed. And this information needs continuous updating: software originally approved as ordinary may add agent functionality after an update; employees will add new extensions and integrations; the more work agents take on, the greater permissions they may acquire.

Another challenge is distinguishing whether an operation was initiated by a person or an agent.

When agents run on employee devices using the employee's own permissions, their behavior — reading files or calling APIs — can be difficult to distinguish from the employee acting directly. This creates difficulties for existing Endpoint Detection and Response (EDR), Data Loss Prevention (DLP), and zero-trust mechanisms in identifying and constraining agent behavior.

Neo, backed by a16z, is trying to solve this problem. Neo's founder previously co-founded SentinelOne. Neo identifies agents, extensions, and MCP servers on employee devices, tracks their access permissions, distinguishes whether operations were initiated by a person or an agent, and enforces security policies in real time. For example, an agent may be permitted to investigate issues in production systems, but modifying the system still requires approval.

Neo interface example: Setting file access rules for Claude Code and Codex. The image shows an escalation rule for reading the .ssh directory, generating a high-severity issue and notifying the user

AI Makes Social Engineering Harder to Spot

Attackers use deepfakes to mimic team members' voices or faces, convincing employees they're speaking with someone they know, then tricking them into transferring funds or handing over account credentials. This approach — exploiting human trust to induce dangerous actions — is social engineering.

Such attacks don't necessarily require deepfakes. Phishing emails impersonating colleagues, fake login pages — these also exploit human trust. In a SANS Institute survey, 80% of responding organizations ranked social engineering as their top human-related risk. AI makes it easier for attackers to forge convincing messages, voices, and videos. Previously, employees could spot some scams through spelling errors or suspicious phrasing; now, even if the voice sounds like the person and a familiar face appears on video, that doesn't make the request trustworthy.

This means security training and simulations need updating too. Adaptive uses AI to simulate phishing emails, voice impersonations, and deepfake videos, letting employees practice spotting these scams and verifying identities when encountering suspicious requests.

Beyond identity impersonation, AI enables attackers to mass-generate fake executive accounts, spoofed domains, and fraudulent websites. For this type of problem, companies like Doppel help businesses discover these impersonation accounts and sites and push for their takedown, reducing the manual work of security teams hunting and handling each one individually.

03 Who Gets the Opportunity

To compete for the new AI security budgets enterprises will allocate, a large number of AI security vendors have already entered the market.

From the Black Hat 2026 vendor landscape, there are 43 in AI SOC/SecOps, 35 in agent security/governance, and 34 in application and code security. Yet these vendors describe their capabilities in remarkably similar terms: let systems do more work automatically, investigate issues faster, reduce manual operations.

To decide what to buy, companies first need to actually evaluate: how much work can the product do for the team, which steps still require human follow-up, which operations can be delegated to it, and what it costs. These evaluations themselves require time and people from the security team.

A CISO at a global apparel company said they narrowed eight or nine vendors down to three for actual testing. In his words: "We don't have the people to run proof-of-concepts with all eight or nine."

As new vendors keep emerging, existing products are also evolving alongside underlying model capabilities. The comparison target keeps shifting, making purchasing decisions even harder.

Another security leader explained his hesitation: "I don't want to buy yet another point product every day for a new problem." His approach was to sign a short-term contract with one tool while continuing to evaluate others.

AI Security Purchasing: Enterprises Still Prioritize Existing Platforms

From a16z's research, when selecting vendors, companies typically first check whether their existing security platforms can meet the need:

  • 44% of respondents prioritize features from their current security platforms, while only 21% would first look to AI-native vendors;

  • 25% say they would not purchase from startups.

The reasons for prioritizing existing platforms are straightforward: these suppliers are already protecting endpoints, processing security data, and have already passed procurement reviews — so companies naturally think of them first.

If existing platforms can't solve new problems, companies will consider startups. In the survey, 47% of respondents listed "addressing needs that current vendors can't meet" as an important condition for choosing a startup. Performance, speed of innovation, price, and whether it can integrate with existing systems also influence purchasing decisions.

While the addressable space for startup teams appears narrow right now and the bar for winning customers extremely high, the security variables introduced by AI remain unknown. AI security will quickly become indispensable to business operations, and this wave of technological transformation will certainly give rise to a new generation of important security companies.