We can't find the internet
Attempting to reconnect
Something went wrong!
Hang in there while we get back on track
Particle bets on cheaper intelligence per task
Suhail launched a new company, Particle. Its first model, particle-1, is the start of a developer-focused series. The company says it matches performance while using about 45% fewer tokens . It is post-trained on DeepSeek V4.1 Flash 1017. The stated long-term goal is "continuous post-training," meaning model improvements that ship as fast as software . OpenRouter relays Particle's claim of 28–52% fewer output tokens than the DeepSeek base across four coding benchmarks . Garry Tan says Particle will be at the frontier for the lowest dollar per unit of intelligence .
The underlying problem is cost per task, not price per token. Two Minute Papers says the new DeepSeek 4.1 Flash 1017 builds much better working software and costs just over $1 per million output tokens. In the host's own tests, though, it took two to three times as many tokens as Claude Opus to finish the same task . Particle's pitch targets exactly that gap: open weights with better token efficiency.
Other model signals from the period:
- Gemini 4 Carbon. Demis Hassabis calls it "SOTA across key benchmarks" but published no figures .
- ViBench 2.0. Replit's new benchmark has agents build a whole product from an empty project, one feature at a time. Even GPT-6.1 Sol, GPT-6 Astra and Opus 5.5 passed every check in only 49–65% of builds . Long-horizon autonomous building still has a lot of room to improve.
- OpenAI and Google TPUs. Reuters, citing The Information, reports that OpenAI plans to buy Google TPUs. No terms were disclosed and neither company commented .
- Cartesia H-Nets. Albert Gu reports that a new version of these byte-level models shows up to 3–5x efficiency gains in controlled scaling-law experiments. At larger scale it matches an open-source model trained on 11T tokens using about 10x less data and compute .
AI security: budgets are rising, but incumbents get the first call
a16z surveyed 100 CISOs at companies with 1,000+ employees. 87% expect security spending to rise, driven mainly by AI-enabled threats and by their own AI deployments . All seven of the most-selected 2027 initiatives involve AI . Production use is still low: 18% run AI SOC tools in production, and 13% run AI offensive security or AI vulnerability remediation. Within 12 months, 45% plan to buy or upgrade internal AI-agent security, 42% offensive security, and 38% AI governance .
The go-to-market picture is less favorable for startups:
- 44% would first look for AI security features from their existing platform; 21% would start with an AI-native vendor. 47% say a capability gap their incumbent can't fill would lead them to pick a startup .
- Some categories have as many as 43 vendors .
- a16z discloses that it led Armadin's Series B. Armadin uses autonomous agents to find exploitable paths through enterprise systems .
Attack capability is the reason for the urgency. In a simulated 32-step network attack, GPT-4o stalled at step 2. Today's top models got about three-quarters of the way through on average, and the best runs completed all 32 steps . Wiz's CTO said the company's Atlas harness, which combines DeepMind, OpenAI and Anthropic models, made its PHP remote-code-execution finding possible. He described the flaw as affecting 12 years of PHP deployments in default configurations . He said most monitored workloads were still unpatched . He told startups to plan for critical vulnerabilities arriving monthly or even weekly, and to build automated patching and infrastructure-as-code while they are still small .
Rounds and launches
- Foundry Robotics raised a $100M Series A led by Marlinspike, with Khosla continuing. It is building a 130,000 sq ft factory in Emeryville and says it already ships to paying customers in energy, telecom, autonomous vehicles and defense .
- Broccoli (YC W22) raised $52M across its Series A and B for AI phone agents that serve plumbing, HVAC and electrical contractors. It has 1,500+ businesses on the platform and has booked 2.5M appointments. The founders knocked on 140 contractor doors, and the plumbing owner who first gave them time is now COO .
- Fragment launched with $56M: a Series A led by 8VC, plus a seed co-led by General Catalyst and A* . It resolves supply-chain exceptions, starting with direct procurement .
- Formation Bio launched a $600M fund to acquire drugs and move them through the clinic, pairing the capital with its AI platform .
- Diode, a PCB design-and-manufacturing company whose Series A a16z led, hired an a16z investor as president .
- Bunkerhill, which builds agents for health systems, says it has grown 12x annualized since January and closed eight figures of ARR in one week .
- FluxCap (YC P26), founded by former DOJ antitrust chiefs, came out of stealth building "Deep Legal Tech" .
Operating data from scaled vertical and defense companies
Hippocratic AI has about 300 employees, has raised about $450M, and launched its product only about 21 months ago. It reports 290M patient interactions and counts five of the top seven payers among its customers . The CEO says it charges about $9–10/hour. Running the same 31-model stack on closed models would cost about $105/hour in compute alone, which is why it uses open weights . Most of its traction comes from "infinite pilot" work, meaning care nobody offered before. In one example, calls to 1,700 patients lost to follow-up led 180 to complete CT scans, which found three cancers .
Stark, a European defense company backed by Sequoia, won billions in contracts within 18 months . It grew from zero to 700 people in two years and plans to invest about €600M in R&D and production capacity over 12–36 months . The founders say European procurement has gone from years to months, and they expect that change to last .
Pressure on incumbent software
SaaStr, citing the WSJ, says about $300B in risky PE-backed loans come due in 2028–29, and roughly a third of that is software . Software loans fell from about 95 to about 85 cents on the dollar after new Anthropic and OpenAI models came out, while other loans held near 96 . Elizabeth Yin argues customers will no longer pay $25,000 for a CRM they can rebuild themselves . She says Hustle Fund runs about 90% of its operations on agents . In her view the lasting value moves to support: maintenance, security and uptime .
Orbital compute
Cowboy Space, led by Robinhood cofounder Baiju Bhatt and backed by Index, unveiled a rocket built to carry five racks of NVIDIA Vera Rubin GPUs into orbit. Its stated aim is space compute that costs the same as compute on the ground . Starcloud, a competitor backed by Benchmark, is valued at $2.3B .
- Cost Plus Drugs grew from 111 generic medicines at launch in 2022 to roughly 4,000 SKUs; its discount card supports local pickup at 17,000 affiliated pharmacies, while its hospital-and-clinic marketplace sells sterile injectables at “cost plus 10 or 12” and claims millions in annual savings, though hospital purchasing teams remain a conversion hurdle. Cuban says incumbents use Cost Plus’s public prices in pricing discussions; one company reportedly was told it was in a large carrier’s network despite having no agreement.
- The company says AI and robotics let its Dallas facility produce drugs in 5,000 square feet and switch production to another drug every four hours; its roughly $20 million, trailer-sized manufacturing pods are configurable for different drugs, and the government was its first customer, with the first pod shipped and a second ordered. Cuban targets hundreds of pods annually within two years and thousands within five, but cited $365,000 plus fees for each generic-drug application as a barrier to scaling U.S. production.
- Cuban’s proposed direct-contract model would trust physicians absent exceptional cases, pay providers on time, assume patients’ out-of-pocket credit risk, and publish employer-provider contracts as reusable templates in return for better prices. The hosts said AI could help startups build full-stack health-plan offerings more quickly; Cuban argued its clearest near-term healthcare value is reviewing employer contracts before signature, since AI cannot undo unfavorable terms after signing. He urges employers to use AI to review existing benefits contracts and argues this could save millions for companies with more than 1,500 members.
- Cuban suggested a startup that uses agents to help patients find and use nonprofit hospitals’ financial-assistance programs; he cited his estimate that 40% of people cannot afford a $400 emergency bill and said some programs may cover families earning up to 600% of the federal poverty level.
- As a longer-term thesis, Cuban predicts that improved models and algorithms could drive the cost of DNA-informed personalized drug design toward zero, starting with over-the-counter medicines; he suggests subscription bundling and pod-based production, while acknowledging initially high costs and DNA privacy concerns. He does not expect personalized medicine to eliminate doctors, arguing clinicians will still be needed for human context and to interpret novel individual data.
- Hypocratic AI builds clinical voice agents for health systems, payers and pharma. At the interview, it reported about 300 employees, $450 million raised, 290 million patient interactions, and customers including five of the top seven payers and seven of the top 20 pharma companies; its product had launched about 21 months earlier.
- The founder says nearly all the company’s success has come from “infinite pilot” use cases—care that was not offered before AI made clinician capacity affordable. In one example, agents contacted 1,700 patients lost to follow-up after prior outreach; 252 scheduled CT scans, 180 completed them, and the scans produced nine significant findings, including three cancers. The founder estimated $1,700 in costs may have generated $2–3 million in revenue.
- Hypocratic delayed launch for 18 months and scoped agents to registered-nurse work, excluding diagnosis, prescribing, children under two, high-risk pregnancies and mental health. The founder says it ships only after output testing shows the system is safer than a human nurse; the process uses 7,000 U.S.-licensed nurses, tests each new model and use case, and had cost $40 million.
- The company says healthcare voice agents need both clinical intelligence and roughly 500-millisecond latency, prompting investment in a custom latency stack. Its 31-model product uses open-weight models that have been fine-tuned and reinforcement-trained; the founder estimates equivalent private models would cost about $105 per hour in COGS versus a product charge of roughly $9–10 per hour.
- The founder’s startup advice is to ride major technology shifts, build deep technology and a technically strong team, and assemble enough cofounders to reach the first milestone without hiring risk—even if that means sharing more equity—rather than optimizing for founder ownership. He also cautions that passion alone can lead to a poor business.
- AlphaFold’s database contains 250 million predicted protein structures and is used by more than 4 million researchers. Isomorphic Labs is building beyond protein-structure prediction toward AI-driven drug discovery, but Hassabis says the effort is still preclinical; its goal is to shorten a process that often takes years or about a decade to months or weeks, not a reported result yet.
- Hassabis sees AI systems that combine learned models with search as particularly suited to maths and coding, where answers can be quickly verified and generated synthetic data can feed later training. He says real-world experiments slow progress in natural sciences: one system proposed 200,000 new materials, but only a tiny fraction had been tested; he points to automated labs and simulations as possible ways to ease the bottleneck.
- His vision for the next decade is a hybrid AI stack: general multimodal models handle tasks such as reading literature and proposing hypotheses, then call specialized models such as AlphaFold or AlphaGenome for domain-specific predictions.
- Hassabis says current systems are not AGI, citing inconsistent performance and a lack of true invention; he expects the ability to generate new theories may emerge in two to four years, after a small number of breakthroughs. He also calls for a body to rigorously test frontier AI before public deployment and for international cooperation, with debate on the standards body ongoing.
- PHP exposure and patch lag: Schwarz said patches addressed two critical PHP bugs that could enable unauthenticated remote takeover on externally facing servers, including those using default configurations; he described the affected PHP deployments as spanning 12 years and the web impact as roughly 70%. At the time of the interview, he said a majority of monitored workloads remained unpatched.
- Disclosure bottleneck: A leak led researchers to accelerate the planned coordinated release; some downstream distributions were not ready, and some organizations shut websites while concerned attackers could reverse-engineer released patches.
- AI-assisted security research: Whiz CTO Tor Schwarz said its Atlas harness combines frontier-model capabilities from DeepMind, OpenAI, and Anthropic to explore attack paths; he argued AI enabled the PHP finding while researchers still direct experiments and select promising results, including testing many ideas over a weekend that could take months to pursue manually. He said open-weight models had been effective in past experiments, but the current harness used none and the model mix changes rapidly.
- Startup implications: Schwarz urged new companies to prepare for a possible cadence of critical vulnerabilities arriving monthly or weekly by designing for automated patching, infrastructure-as-code, and continuous deployment—changes he said are easier to make while a company is small. He recommended early in-house security expertise when trust or sensitive personal data is central to the business. He also said AI is changing cybersecurity and underlying IT, leaving the product blueprint unsettled; he advised existing cybersecurity startups to reinvent themselves and new entrants to build around those changes. Schwarz identified prior CTO/cofounder roles at Daz, acquired by Whiz, and Armis, acquired by ServiceNow.
- Andrew Ng argues AI-native teams gain execution speed rather than merely cut costs, and should be redesigned around new bottlenecks: as coding accelerates, deciding what to build becomes the constraint. He suggests roughly one-third of executives being AI-native as a starting point; feedback loops should shift from fast, informal checks at the earliest stage to surveys, A/B tests, and more rigorous evaluations as products mature.
- Ng says data cleaning remains a bottleneck and a shared company data layer can let agents support business decisions; in his experience, about a quarter of agent analyses of Redshift data produced bizarrely wrong conclusions and still needed steering.
- Early-stage founder examples: VocalBridge’s co-founder described a three-person team using dedicated Mac minis with engineer-level access for agents, while he handled specs and feedback from his phone. Ridekick’s founder said production errors trigger a coding-agent session to diagnose and resolve them, and that its internal tools have both human interfaces and CLI/MCP access for agents.
- IrisGo’s co-founder described its knowledge-worker workflow-mining and automation product as shipping through PC OEM partnerships with Acer, Asus, HP, and Dell, with claimed reach to billions of computers.
- Stark, a European defense “neoprime,” says it runs 10–15 programs; its current offering is a relatively inexpensive, software- and AI-driven strike munition, while its broader work includes autonomous maritime and aerial systems, electronic warfare, and software.
- The founders’ execution model combines in-house product development funded with venture capital (crediting Sequoia and others), close iteration with soldiers in Ukraine and European forces, and designing for certification and mass manufacturing rather than a few bespoke systems.
- The interviewers cite billions of dollars in contracts within 18 months; the founder calls this a success while also pointing to a favorable market moment. Stark’s founders say European procurement and certification have compressed from years to months as defense needs meet lower-cost, software- and AI-driven systems, and they believe the change will last.
- Stark was described in the interview as growing from zero to 700 people in two years; its founders said they intend to invest about €600 million over the next 12–36 months in R&D and production capacity.
- Stark says its autonomy stack follows NATO responsible-use principles, with audits and hard-coded safeguards; depending on customer configuration, a system may wait for operator confirmation before engaging a target.
- Kato Networks, founded in 2015, is described as having 4,800 customers and more than $400 million in ARR. Kramer says its converged network-and-security cloud spans more than 100 locations and provides compute for AI-security workloads and agent control.
- The interview describes vulnerability-response windows as shrinking from months to probably minutes; Kramer says agentic threats increase attack scale and velocity, while enterprise GenAI creates a new attack surface. Kato says its agentic defenses can protect the entire install base against a new vulnerability in 45 minutes, without customer work or false positives.
- Kramer's Kato thesis targeted fragmented security stacks—reportedly 60–70 products per CISO—and appliance-based architectures ill-suited to a digital world where location is abstracted. His founder-investor lesson is to pursue fertile problem spaces before outcomes are clear and sustain a contrarian approach long enough to build value.
- Kato acquired AIM for platform alignment and faster time to market, citing three years of development brought by the acquisition; Kramer said a platform should be built, not bought.
- AI Fund’s head of talent says automated mass applications, fake candidates and recruiter spam have flooded recruiting channels; he considers inbound a poor channel for many non-brand-name employers and recommends deliberate outbound based on explicit role criteria and verifiable evidence—such as hackathon results, authored papers or shipped production systems—rather than pedigree alone. Exa can filter candidate lists against such criteria and link to evidence for its claims.
- Mike sees a near-term opportunity to hire top new graduates because competition for them is lower, despite reports of limited opportunities for graduates; he says senior hires still matter for experience handling production issues.
- With coding-agent use treated as a baseline, interviews can change constraints and probe whether candidates critique agent output and explain their decisions. The discussion characterized AI as more reliable on verifiable tasks than on judgment tasks, making reasoning and tradeoffs useful signals beyond a polished output.
Diode, founded by Davide Esnaghi and Lenny Khazan, is addressing slow, fragmented PCB design and manufacturing; the founders previously took hardware from prototype to hundreds of thousands of units and taped out a custom silicon chip. a16z led Diode’s Series A; the announcement says AI advances in hardware design are increasing the value of manufacturing as demand for electrical engineering grows across hardware companies. @zabie_e is joining as Diode’s president and will remain an a16z special advisor; Diode is hiring in New York and San Francisco.
Prometheus is described as a new company pursuing an “artificial general engineer”: one host’s understanding is that it would apply AI to engineering and building in the physical world, based on the view that LLMs can produce useful knowledge workers but not strong engineering capability. The hosts frame it as a potentially Amazon-scale AI opportunity, while acknowledging they are unsure whether the product would involve robotics, planning tools, or another approach.
- Greylock advises founders to pitch prospective go-to-market hires differently from engineers: lead with customer pain and discovery, demo and customer reception, deals closed, and design partners converting to customers; show traction achieved before hiring a seller, then explain the opportunity’s defensibility, potential market, stickiness, and flywheel.
- Hire for the company’s stage, not a candidate’s prestigious employer or ability to run an established playbook. In Greylock’s example, a seller who had built a major-account sales engine at Zscaler lacked experience in the commercial/SMB motion required by an incubated startup; the fit proved wrong, though the team used the period to improve discovery and positioning before finding the right leader.
- Assess what candidates have built, why they made career moves, and whether they can create outbound prospecting and close deals themselves; a short stint merits probing rather than automatic rejection, since it may reflect a poor environment or a deliberate bet on a new opportunity.
- Two Minute Papers describes a newly available DeepSeek system, identified in the video as “4.1 Flash 1017,” as substantially better at building working software and using a computer terminal; the host says API output costs just over $1 per million tokens, but their tests used two to three times as many tokens as Claude Opus for the same task, so cost per task is less favorable than the per-token comparison suggests, while remaining “quite good.”
- The video says the model weights are free to download but running the model requires expensive hardware, and presents distillation into smaller, cheaper models as a path toward eventual use on a powerful laptop—not a current capability.
- The host reports a major capability improvement about five weeks after the prior version despite no architecture change, and suggests self-feedback—models critiquing their own work—as a possible explanation; this is explicitly an inference from announcement language, not a confirmed mechanism, and the host notes that self-evaluation is difficult.
- In a survey of 100 CISOs at companies with more than 1,000 employees, 87% expected cybersecurity spending to rise, driven mainly by AI-enabled threats and the attack surface created by enterprise AI; nearly half expected security headcount to increase, while only 4% expected cuts. All seven of the most-selected 2027 security initiatives involved AI, but production use remained early: 18% for AI SOC tools and 13% for AI offensive security or exposure-and-vulnerability remediation. Within 12 months, planned purchases or upgrades were highest for internal AI-agent security (45%), offensive security (42%), and AI usage/governance (38%).
- Enterprise AI is already deployed at scale: respondents reported production use of employee generative AI tools (92%), coding assistants or agents (83%), MCP or agent-to-application integrations (55%), and autonomous agents with tool access or write permissions (34%). Top concerns included AI attacks outpacing security teams (55%), employee data leakage into AI tools (47%), and agents exceeding permissions or being compromised (46%).
- Incumbents have a distribution advantage: 44% of CISOs would first seek AI-security features from an existing security platform, versus 21% from an AI-native vendor. Startups can win by filling a capability gap the incumbent cannot address (47%); buyers often add them alongside existing platforms rather than replace them. Competition is crowded, with some AI-security categories containing as many as 43 vendors, and buyers weighing completed work, required follow-up, safe actions, and operating cost.
- a16z highlighted two portfolio bets in these areas: it led Armadin’s Series B for autonomous agents that find exploitable paths through enterprise systems and help close them, and invested in Neo, which tracks agents, extensions, and MCP servers on employee devices and enforces real-time policy.
- In an a16z survey of 100 CISOs at companies with more than 1,000 employees, 87% expect cybersecurity spending to increase in 2027, driven mainly by AI-enabled threats and the attack surface from their own AI deployments. Nearly half expect security headcount to grow and only 4% expect cuts. All seven most-selected 2027 security initiatives involve AI, but production use remains limited: 18% report AI SOC tools in production and 13% report AI offensive security or exposure/vulnerability remediation; 45% plan to buy or upgrade internal AI-agent security and 42% offensive security within 12 months.
- Continuous offensive testing is a near-term use case: 18% say most of their offensive testing already runs continuously against production assets, and 52% expect that within a year; 70% want tools to retest and verify that vulnerabilities have been fixed.
- Startup GTM favors filling gaps alongside incumbents: 44% would first look to an existing security platform for AI security, versus 21% to an AI-native vendor, while 47% say an unmet capability gap could lead them to choose a startup. Competition is a caveat: some AI-security categories have as many as 43 vendors, and buyers report difficulty evaluating them all hands-on. a16z says it led Armadin’s Series B for agents that find exploitable paths through enterprise systems, and invested in Neo, whose endpoint security tracks agents, extensions, and MCP servers and enforces policy in real time.
- Mark Cuban’s AI-workforce thesis is that AI users displace workers who do not use AI . He says healthcare still needs entry-level hires and organizations need people who provide context, remain in the loop, understand consequences, and build implementation history as systems change .
- Cuban says Cost Plus Drugs grew from about 100 to roughly 4,000 generic drugs with a flat 15% markup, which he says pressured incumbents to change prices . He argues AI alone will not fix healthcare’s opaque prices and broken incentives .
Martin Casado linked a Databricks pitch to Snowflake, framing the companies as complementary and proposing that Snowflake source AI tokens through Databricks. The pitch offers access to cheap OSS and frontier models (listed as OAI/Ant/Gemini/Grok) through Unity Gateway, with smart routing, budgets, and access controls; it also says Omnigent works with any harness, including CoCo, and Genie can manage spend. The pitch claims customers cut token spend by about 30% over the last few months while token counts rose; this is a vendor-reported result, not independently substantiated in the post.
- In a simulated 32-step attack on a company network, GPT-4o stalled at step 2; today’s top models averaged roughly three-quarters completion even as they used up to 100M tokens, and the best attempts completed all 32 steps and took over the network.
- In a16z’s survey of 100 CISOs at companies with more than 1,000 employees, 87% expect cybersecurity spending to rise in 2027, primarily because of AI-enabled threats and the attack surface created by their AI deployments; all seven most-selected 2027 initiatives involve AI. Production use still lags: 18% report AI SOC tools in production and 13% report AI offensive security or AI exposure-and-vulnerability remediation in production, while 45% plan to buy or upgrade internal AI-agent security within 12 months.
- Buyer dynamics favor startup capability-gap wedges over broad incumbent replacement: 44% would first look to an existing security platform for AI capabilities versus 21% to an AI-native vendor, while 47% say an incumbent’s inability to solve a capability gap would lead them to choose a startup. Competition and evaluation are hurdles: some categories have as many as 43 vendors, and one CISO said it was not practical to run hands-on proofs of concept for all seven or eight vendors under consideration.
- a16z says it led Armadin’s Series B; the company uses autonomous agents to find exploitable paths through enterprise systems and help close them. a16z also says it invested in Neo, whose endpoint product tracks agents, extensions and MCP servers on employee devices, monitors their access and enforces policy in real time; its founders helped build SentinelOne.
Particle launched as a new company focused on developer models; its first model, particle-1, is claimed to match performance while using about 45% fewer tokens, and is live at particle.ai. Garry Tan says Particle aims to compete at the frontier on intelligence per dollar.
FluxCap (YC P26) came out of stealth; former DOJ antitrust chiefs are building “Deep Legal Tech” intended to let small teams take on difficult cases.
Broccoli (YC W22) raised $52 million across its Series A and Series B. Its AI agents answer calls around the clock for plumbing, HVAC, and electrical companies, book jobs into contractors’ existing scheduling software, and follow up on open estimates. More than 1,500 home-service businesses run on Broccoli; it has handled over 10 million customer conversations and booked 2.5 million appointments. After the founders’ EV startup stalled, Abhishek Jain and Aditya Ketkar knocked on 140 contractor doors, then built Broccoli’s first product in three weeks with a Sacramento plumbing owner who later became the company’s COO.
The New Security Agenda: What CISOs told us about AI, budgets, and the priorities shaping 2027
The New Security Agenda: What CISOs told us about AI, budgets, and the priorities shaping 2027

By @OwenColby and @Steph_Zhang
For years, the industry prepared for quantum computing to rewrite the rules of cybersecurity. Then AI got there first.

This summer, OpenAI’s agents broke out of a cybersecurity evaluation and breached Hugging Face’s production systems. They exploited vulnerabilities, used stolen credentials, and worked their way into another company’s infrastructure, all to get the answers to their tests. OpenAI’s incident report (opens in new tab) describes how the models chained together the steps to get there.
This was just a preview. Since then, AI has helped uncover weaknesses in software that much of the internet depends on. Just last week, companies were scrambling to patch critical flaws in PHP (opens in new tab), which powers roughly 70% of websites. The flaws had been sitting there for more than a decade before researchers working through OpenAI’s Patch the Planet initiative (opens in new tab) helped uncover them. That same day, eMudhra (opens in new tab), a certificate authority trusted by every major browser, was found to have used encryption keys so weak that one of them was just the number 4.
Mistakes like that have always existed, but models are getting better at finding weaknesses and figuring out how to exploit them. The progress is visible in the AI Security Institute’s evaluations (opens in new tab), where newer models can complete increasingly complex cyber tasks.

More serious vulnerabilities are also being reported (opens in new tab). With the growing volume confronting companies, security teams have to determine which weaknesses pose the greatest risk to their business and get them fixed before someone exploits them.

Meanwhile, the environment they’re protecting keeps growing. Employees are shipping applications they couldn’t have built a year ago. Agents are getting access to company documents, source code, and production systems. Every new application and connection gives security another thing to understand and protect.
That helps explain why we’ve seen the market caps of cybersecurity platforms like @PaloAltoNtwks and @CrowdStrike take off this year.

There is more to secure. And enterprise budgets are following.
To understand how security leaders are responding to these pressures, we surveyed 100 CISOs at companies with more than 1,000 employees about their priorities, budgets, and buying plans for 2027.
Unsurprisingly, a large majority (87%) expect cybersecurity spending to increase, driven primarily by AI-enabled threats and the expanding attack surface created by their own AI deployments.

Most of the additional spending is headed for tools. What stands out, though, is that it isn’t coming at the expense of people. Despite AI handling more of the work, nearly half expect security headcount to increase in 2027, another half expect it to stay flat, and only 4% expect to cut.

Why? The ambition is to cover more ground: investigate alerts that might otherwise wait, test more applications, and close vulnerabilities sooner.
CISOs are already running pilots, setting aside budget, and deciding which products they trust to put into production. Many of those buying decisions will play out over the next twelve months. And the priorities look quite different from a year ago…
AI Rewrites the Priority List
A year is a long time in security right now. When we asked leaders to recall their 2026 priorities, exposure and vulnerability management and SIEM topped the list. For 2027, all seven of the most-selected initiatives involve AI.
What becomes P0 varies by organization. SOC automation gets the most first-place votes, while other teams put offensive security, remediation, or securing their own AI deployments first. Where buyers start depends on where the pressure is greatest, but there is broad agreement that AI capabilities are core to their security stack.

The movement from recalled 2026 priorities shows how quickly the agenda is changing. Internal AI agent security, SOC automation, and offensive security make the largest gains. Code security, remediation, and AI governance follow closely.

Two jobs are driving the shift:
Enterprises need to secure the AI their employees and customers are already using.
They also want to put AI to work inside security, helping teams investigate attacks, test systems, and fix what they find.
The Next Buying Window Is Already Open
While interest is high, most enterprises have yet to put these capabilities into production. Only 18% report production use of AI SOC tools, and 13% report production use of either AI offensive security or AI exposure and vulnerability remediation.
Many are already piloting, however, or expect to reach production within the next year. Code security and email defense are further along, but even there, production adoption remains far from universal.

The purchase plans are more immediate. 45% plan a new purchase or upgrade for internal AI agent security within twelve months, followed by offensive security at 42% and AI usage and governance at 38%.

Buyers are making decisions as the products themselves keep changing. Some are expanding an initial deployment, while others are comparing vendors for capabilities they’ve never bought before. Across categories, the next year will bring a wave of evaluation and purchasing.
Here is where CISOs told us the market is heading, and where we see opportunities.
Offensive Security Becomes a Continuous Capability
Earlier this month, we partnered with Kevin Mandia and led Armadin’s Series B (opens in new tab) because we believe it’s critical for defenders to leverage the same speed and scale that AI is giving attackers. @ArmadinSecurity uses autonomous agents to find exploitable paths through enterprise systems and help security teams close them.
That speed matters because the environment doesn’t stand still. A team can spend weeks working through its pentest findings while developers keep shipping features, employees connect new services, and permissions change. By the time those issues are fixed, there may already be another set of weaknesses to investigate.
AI makes that gap more consequential. Bain estimates (opens in new tab) that it can compress a typical attack sequence from roughly four weeks to about eighteen hours, leaving much less time to find an exposure and get it fixed.

Security leaders want to test more often. 83% rate more frequent security posture testing as important, including 54% who call it very important.
“With all the new AI threats, we need to find things before others do.” -CISO at a Global Manufacturer

Human pentesters bring expertise that companies still need, but there are only so many applications and systems they can cover. One security team described keeping its testing budget intact and using AI to cover more applications and infrastructure.
Buyers also expect testing to become much more frequent. Today, 18% say most of their offensive testing runs continuously against production assets; 52% expect it to within a year. Looking five years out, 44% expect testing to be embedded in CI/CD, triggered by code or infrastructure changes.

That brings security testing into the process of building and maintaining software. A release can trigger a new test, and a fix can be checked as soon as it is deployed. Teams can check for new weaknesses as they ship, rather than waiting until the next scheduled assessment to find out what changed.

Finding Is Great, but Fixing Is Key
Finding a vulnerability can be the fast part. Getting it fixed means finding the right owner, working out what needs to change, and getting that change tested and deployed. For a team already sitting on a backlog, faster discovery can leave it with even more work to finish.
“With a lot of these AI tools, you’re able to find vulnerabilities faster, but you’re not able to patch faster.” -Fintech CISO
A validated attack path helps teams prioritize that work by showing what an attacker can actually reach and which changes would stop the attack. Buyers also want help making those changes and checking that they worked. In our survey, 70% want to retest and verify that vulnerabilities have been fixed, 67% want to prioritize remediation using validated exploitability, and 57% want fixes or remediation tickets generated automatically.

An executive at a large cybersecurity platform described the opportunity as building “a fix it with the find it.” That means following a finding through to a change the team can deploy, then rerunning the attack to make sure the exposure is closed. The team gets help resolving the issue and evidence that the fix actually worked.
The SOC Gets More Capacity, One Action at a Time
As attacks move faster, security teams need to investigate and respond faster. Their ability to keep up depends on a limited resource: analyst time. To work through an alert, an analyst still has to pull evidence from several systems, reconstruct what happened, and determine whether there is a real threat. By the time they have the full picture, hours are gone, and the response has not started.
AI SOC tools can take on more of that work. Agents can pull the relevant evidence and run routine checks, leaving analysts more time to investigate complex cases and work on decisions that need their judgment. For teams already stretched thin, that can mean getting to threats that would otherwise sit in the queue.
How much authority to give those agents is a separate decision, though. Today, 36% of respondents are comfortable letting agents act autonomously on low-risk actions. Looking 12 months ahead, 60% expect to be comfortable with that level of autonomy. Only 7% expect to allow autonomous action in most cases.

Gathering logs is different from changing a production system. Teams can delegate much of an investigation while retaining approval for a response that could disrupt the business.
@Cotoolai lets security teams turn their own investigation processes into agents that work across existing tools, triage alerts, and take action within permissions they define. Analysts can review the results, refine the process, and choose where approval is required. An investigation the team knows how to run can then happen repeatedly without someone having to work through every step by hand.
Securing the AI Inside the Enterprise
AI is already embedded in enterprise work. 92% report at least limited production use of employee generative AI tools, 83% report production use of coding assistants or agents, and 55% have MCP servers or other agent-to-application integrations in production.

These systems can reach source code, retrieve company documents, and take actions across applications. A security leader at a restaurant software company asked the question many teams are confronting: “How do you really know what the agents are really doing?”
The concerns are concrete. 47% include employees leaking sensitive data into AI tools among their biggest worries, and 46% cite agents exceeding their permissions or being compromised. Another 29% worry about prompt injection or data leakage through AI applications.

For many enterprises, these questions are already slowing deployment. 63% of responses describe security slowing at least some AI adoption, including reviews, approval requirements, and restrictions on particular uses.
Security teams need to know which tools and agents are running, who owns them, what they can access, and what they actually do. And the answers keep changing. Software approved as an ordinary application gains agentic capabilities with its next update, employees add extensions and integrations, and an agent’s permissions expand as it takes on more work.
Keeping up is harder than it sounds. Agents run on employee devices with the user’s own permissions, so to the tools built for the last decade of endpoint security, an agent reading a file or calling an API looks exactly like the employee doing it. EDR, DLP and Zero Trust all break at that point.
That’s why we invested in Neo (opens in new tab). @neo_ai_security’s founders helped build SentinelOne and are now rebuilding the endpoint layer for a world where agents act continuously and often outnumber the people they serve. Neo tracks the agents, extensions and MCP servers on employee devices and what each can access. It checks whether a person or an agent is behind an action and enforces policy in real time. An agent might be allowed to investigate a production issue but need approval to change the system.
Human Risk Gets an AI Upgrade
Even with the rise of increasingly sophisticated attacks, the human side of security remains a major risk (the password on a sticky note is, unfortunately, still with us). 80% of organizations surveyed by SANS rank social engineering as their top human-related risk (opens in new tab). Ultimately, simply convincing an employee to do something is often the easiest way in, and AI is making those requests far more convincing.
A message can sound like a colleague. A voice can sound like a manager. A video can look like someone you know.
When @BrianCLong from @AdaptiveSec came in to pitch, he showed us these two photos of Elon Musk and asked us to pick the real one.

Most of us got it wrong.
Impersonation now goes well beyond misspelled emails and suspicious text messages. Even a careful employee could be caught off guard by a request that appears to come from someone they know and trust.
That moment reinforced how much training and simulations need to evolve. Adaptive runs AI-powered phishing and deepfake simulations across email, voice, and messaging so employees learn to recognize the attacks they will actually face, not the ones from five years ago.
Not only do these impersonations look more real, but there are a lot more of them too. AI makes it easy to keep spinning up fake executive profiles, spoofed domains, and fraudulent sites. Security teams can no longer keep up with finding and taking each one down by hand, so they’re turning to tools like @DoppelHQ to automate that work.
More Code, a Higher Bar for Security
You can feel good about your own security and still inherit a serious problem from the software you depend on. The recentPHP vulnerabilities (opens in new tab) brought that home.
Code security is hardly a new category. Companies have been buying SAST and SCA tools for years. But AI is helping developers ship more code, putting more and more pressure on the existing security tools companies have relied on for years.
And that’s why nearly half of the CISOs we surveyed put AI code security among their top five priorities for 2027, up from about 25% in 2026 - that can mean upgrading to tools like @SocketSecurity that actively scan dependency code themselves and/or using minimal container images that are continuously rebuilt from source with the latest security patches.
“We have way more engineers developing than we have security people testing.” -CISO at a financial services company
More Demand, but Platforms Get the First Call
Even as priorities shift and new buying cycles open, existing platforms often get the first call.
When asked where they would look first for AI security capabilities, 44% default to features from an existing security platform, compared to 21% who start with an AI-native security vendor. A company that already protects a buyer’s endpoints, holds its security data, and has been through procurement has a real head start.
As one leader put it: “I trust CrowdStrike. It has the brand. It has the credibility.”
But the first call is not always the last one. When we asked what would lead them to choose a startup over their incumbent, 47% said solving a capability gap their existing vendor cannot address. Better performance, faster innovation, pricing, and integration with the existing stack also factor in, but the primary door opener is a problem the platform simply does not solve.

For many buyers, adopting a startup means adding a capability alongside the platform they already use, not replacing it. A new vendor earns a place by solving a priority problem their current tools leave unresolved and proving that it works in their environment.
A Noisy Market Makes It Harder to Know What to Buy
Across AI security categories, dozens of vendors are promising more autonomous security, faster investigations, and less manual work. Their descriptions can sound remarkably alike.
Jake’s Black Hat 2026 vendor landscape (opens in new tab) laid it out well. Some categories have as many as 43 vendors - that’s a lot of companies for a buyer to have to sort through.
Buyers need to understand how much work each product completes, how much follow-up their team still handles, which actions it can take safely, and what it costs to run. Getting those answers takes time from the same people the product is supposed to help.
A CISO at a global apparel company described narrowing seven or eight vendors to three for hands-on testing. As he put it, “It is not humanly possible to do the proof of concept for all seven or eight.”
And the comparison keeps changing. New vendors enter, products expand, and improvements in the underlying models can change what is possible during the evaluation itself. That makes committing harder.
Another security leader explained his hesitation: “I do not want to keep buying point products over and over again ad hoc, just to solve each new problem every day.” He’d signed a short-term contract for one tool and was still evaluating others.
That caution can coexist with real demand. Teams are requesting budget, running pilots, and putting initial products to work while deciding what to deploy more broadly. They want to address the problems in front of them without adding another product every time a new one appears.
Looking Forward
AI has rewritten the security agenda faster than any shift in recent memory. Budgets are rising, teams are growing, and CISOs are evaluating capabilities that looked very different just a year ago. They are already running pilots and putting AI to work across use cases like offensive security, SOC automation, and the protection of their own AI deployments.
And they are looking beyond their existing platforms.
That is where startups come in. In the newest AI categories, the incumbents have not caught up, and security leaders are bringing in whoever can solve the problem in front of them. Startups have been the ones to see what these changes require and build for them.
We expect this next wave to produce important security companies, built around capabilities that enterprises are only beginning to need and will soon find difficult to operate without.
Special thanks to @zanelackey, @YODELAGARZA and @DavidGeorge83 for their contributions to this piece.
Full article in the a16z newsletter: https://www.a16z.news/p/the-new-security-agenda (opens in new tab)
- In a survey of 100 CISOs at companies with more than 1,000 employees, 87% expected cybersecurity spending to rise, driven mainly by AI-enabled threats and the attack surface created by enterprise AI; nearly half expected security headcount to increase, while only 4% expected cuts. All seven of the most-selected 2027 security initiatives involved AI, but production use remained early: 18% for AI SOC tools and 13% for AI offensive security or exposure-and-vulnerability remediation. Within 12 months, planned purchases or upgrades were highest for internal AI-agent security (45%), offensive security (42%), and AI usage/governance (38%).
- Enterprise AI is already deployed at scale: respondents reported production use of employee generative AI tools (92%), coding assistants or agents (83%), MCP or agent-to-application integrations (55%), and autonomous agents with tool access or write permissions (34%). Top concerns included AI attacks outpacing security teams (55%), employee data leakage into AI tools (47%), and agents exceeding permissions or being compromised (46%).
- Incumbents have a distribution advantage: 44% of CISOs would first seek AI-security features from an existing security platform, versus 21% from an AI-native vendor. Startups can win by filling a capability gap the incumbent cannot address (47%); buyers often add them alongside existing platforms rather than replace them. Competition is crowded, with some AI-security categories containing as many as 43 vendors, and buyers weighing completed work, required follow-up, safe actions, and operating cost.
- a16z highlighted two portfolio bets in these areas: it led Armadin’s Series B for autonomous agents that find exploitable paths through enterprise systems and help close them, and invested in Neo, which tracks agents, extensions, and MCP servers on employee devices and enforces real-time policy.
- In an a16z survey of 100 CISOs at companies with more than 1,000 employees, 87% expect cybersecurity spending to increase in 2027, driven mainly by AI-enabled threats and the attack surface from their own AI deployments. Nearly half expect security headcount to grow and only 4% expect cuts. All seven most-selected 2027 security initiatives involve AI, but production use remains limited: 18% report AI SOC tools in production and 13% report AI offensive security or exposure/vulnerability remediation; 45% plan to buy or upgrade internal AI-agent security and 42% offensive security within 12 months.
- Continuous offensive testing is a near-term use case: 18% say most of their offensive testing already runs continuously against production assets, and 52% expect that within a year; 70% want tools to retest and verify that vulnerabilities have been fixed.
- Startup GTM favors filling gaps alongside incumbents: 44% would first look to an existing security platform for AI security, versus 21% to an AI-native vendor, while 47% say an unmet capability gap could lead them to choose a startup. Competition is a caveat: some AI-security categories have as many as 43 vendors, and buyers report difficulty evaluating them all hands-on. a16z says it led Armadin’s Series B for agents that find exploitable paths through enterprise systems, and invested in Neo, whose endpoint security tracks agents, extensions, and MCP servers and enforces policy in real time.
- In a simulated 32-step attack on a company network, GPT-4o stalled at step 2; today’s top models averaged roughly three-quarters completion even as they used up to 100M tokens, and the best attempts completed all 32 steps and took over the network.
- In a16z’s survey of 100 CISOs at companies with more than 1,000 employees, 87% expect cybersecurity spending to rise in 2027, primarily because of AI-enabled threats and the attack surface created by their AI deployments; all seven most-selected 2027 initiatives involve AI. Production use still lags: 18% report AI SOC tools in production and 13% report AI offensive security or AI exposure-and-vulnerability remediation in production, while 45% plan to buy or upgrade internal AI-agent security within 12 months.
- Buyer dynamics favor startup capability-gap wedges over broad incumbent replacement: 44% would first look to an existing security platform for AI capabilities versus 21% to an AI-native vendor, while 47% say an incumbent’s inability to solve a capability gap would lead them to choose a startup. Competition and evaluation are hurdles: some categories have as many as 43 vendors, and one CISO said it was not practical to run hands-on proofs of concept for all seven or eight vendors under consideration.
- a16z says it led Armadin’s Series B; the company uses autonomous agents to find exploitable paths through enterprise systems and help close them. a16z also says it invested in Neo, whose endpoint product tracks agents, extensions and MCP servers on employee devices, monitors their access and enforces policy in real time; its founders helped build SentinelOne.
- In a16z’s survey of 100 CISOs at companies with 1,000+ employees, 87% expect cybersecurity spending to rise in 2027, and all seven of the most-selected priorities involve AI. The biggest gains since 2026 were internal AI-agent security (+28 points), AI SOC (+26), AI offensive security (+24), AI code security (+23), and AI vulnerability remediation (+22).
- Adoption is still early: 18% reported production use of AI SOC tools and 13% reported production use of AI offensive security or AI exposure and vulnerability remediation. Yet, 45% plan an internal AI-agent security purchase or upgrade within 12 months, 42% plan one for offensive security, and 38% for AI usage and governance. Buyers are more likely to start with an existing security platform than an AI-native vendor (44% vs. 21%); the leading reason to choose a startup is filling a capability gap an incumbent does not address (47%).
- a16z says it led Armadin’s Series B; the company uses autonomous agents to find exploitable paths through enterprise systems and help close them. a16z also says it invested in Neo, which tracks agents, extensions, and MCP servers on employee devices and enforces policy based on what they can access.
- Market caveat: some AI-security categories have as many as 43 vendors, while CISOs describe the burden of evaluating multiple products and reluctance to keep adding point solutions.