[DigitalToday reporter Chi-gyu Hwang] Many expect AI to take a bigger share of corporate security budgets next year. That trend was also reflected in survey results recently posted on the website of Silicon Valley venture capital firm Andreessen Horowitz (a16z).

a16z made the projection based on a survey of 100 chief information security officers (CISOs) at companies with more than 1,000 employees, covering 2027 priorities, budgets and purchasing plans.

The survey found 87 percent of respondents expected security spending to increase. They cited the spread of AI-enabled attacks and a broader attack surface from AI adoption inside companies as key reasons.

At this point, adopting AI-based security technology does not appear likely to reduce security headcount. Nearly half expected security staff to increase, while only 4 percent expected the opposite.

Priorities also shifted sharply over a year. In 2026, vulnerability management and security information and event management (SIEM) systems ranked among the top areas of interest. For 2027, all seven tasks most frequently cited by CISOs were related to AI.

Security operations center (SOC) automation received the most votes. In-house AI agent security and offensive security, which attacks systems from a hacker’s perspective to find weaknesses, also surged in the rankings.

a16z said the spread of AI-driven threats led to the shift in CISO priorities. Consulting firm Bain said AI could cut an attack process that typically took 4 weeks to about 18 hours.

Interest in AI-focused security is high, but the picture changes when it comes to the pace of adoption.

In the a16z survey, 18 percent said they were actually operating AI SOC tools, and only 13 percent had adopted AI-based offensive security or automated vulnerability remediation. Even so, purchase intent was strong. Some 45 percent said they would buy or upgrade in-house AI agent security within 12 months, followed by offensive security at 42 percent and AI use and governance at 38 percent.

a16z said in-house AI agent security rising to the top purchase priority reflects how widely AI is being used inside companies.

The survey found 92 percent used at least some generative AI tools for internal employees, and 83 percent were operating coding assistants or agents. Some 55 percent said they used MCP servers that connect AI agents to in-house applications. Respondents cited two biggest concerns: 47 percent pointed to employees uploading sensitive data to AI tools, and 46 percent to agents exceeding permissions or being compromised.

CISOs ranked fixing vulnerabilities as a more important task than finding them. Some 70 percent said they needed post-remediation revalidation features, and 57 percent said they needed automatic generation of patches or remediation tickets. One fintech company CISO said, “AI tools find vulnerabilities faster, but we can’t patch faster.”

How much authority to grant AI is also a variable. The share saying agents can handle low-risk tasks on their own is expected to rise to 60 percent next year from 36 percent now. Even so, only 7 percent said they would allow autonomous execution in most situations.

Whether interest in AI security will become an opportunity for security startups specialising in AI security remains unclear. When AI security features are needed, 44 percent said they would first look to existing security platforms, far ahead of the 21 percent who would turn to AI-specialist vendors. Another 47 percent said they would choose a startup if it solved problems existing vendors could not.

The intense competition among security vendors could also be a burden for CISOs. a16z said there are as many as 43 vendors in some areas. One global apparel company CISO said that after narrowing 7 to 8 candidates to 3, “verifying them all is humanly impossible.”

a16z said incumbent leaders have not yet caught up in the latest AI areas and it expects important security companies to emerge there. Earlier this month, a16z led a Series B investment in AI offensive security company Armadin and also invested in endpoint agent security company Neo.