One Fortune 100 Company Found 21,000 AI Agents Running Without Anyone's Permission.
Market Takeoff: Size, Growth, and Where the Money Concentrates
Cisco's $28 billion acquisition of Splunk in March 2024, as Mordor Intelligence reported, triggered a wave of pilot programs with newer vendors — the clearest signal yet that the legacy SIEM model is fracturing. AI-native security agents are displacing legacy SIEM platforms, creating an autonomous SOC market projected to grow at double-digit rates through 2030 and fundamentally changing the role of security operations.
Four research firms agree on the trajectory: the SIEM market is expanding at double-digit rates even as its legacy architecture shows structural fatigue. Their 2025 baseline figures range from $5.6 billion to $10.8 billion; all project 10–12 percent CAGR through 2030.
| Firm | 2025 Baseline | 2030/31 Projection | CAGR |
|---|---|---|---|
| Mordor Intelligence | $10.67B | $20.78B (2031) | 11.5% |
| Expert Insights | $10.78B | $19.13B (2030) | 12.16% |
| MarketsandMarkets | $8.39B (2026) | $13.67B (2031) | 10.3% |
| The Business Research Company | $5.63B | $9.4B (2030) | 10.7% |
The spread reflects different definitions of what counts as SIEM. The direction is unanimous.
What separates headline growth from the real shift is the segment breakdown. Next-generation SIEM, the category that includes AI-native platforms, grows at 12.2 percent CAGR, outpacing the overall market. Cloud deployment leads at 13.0 percent. Managed services run at 12.03 percent, Mordor Intelligence found. Healthcare and life sciences top vertical growth at 13.8 percent. Asia Pacific leads regions at 12.72 percent, per Mordor Intelligence's figures. Each outpaces the composite figure, signaling that growth is concentrating in architectures built for elastic scale and automated triage.
Mordor Intelligence quantifies the drivers behind that concentration. Exponential telemetry growth adds 2.30 percentage points to the CAGR forecast. Escalating regulatory penalties and audit frequency add 2.10. Accelerated cloud and hybrid adoption adds 1.90. AI and ML analytics improving signal-to-noise ratios add 1.70. Security-data-pipeline layers reducing total cost of ownership add 1.40. Vendor mega-deals triggering refresh cycles add 1.20. Against these tailwinds, high TCO and licensing complexity subtract 1.80 points, the SOC analyst shortage subtracts 1.50, data-sovereignty barriers subtract 0.90, and XDR/SOAR overlap subtracts 0.70. The net result: a market pulled toward automation by forces larger than any single vendor's roadmap.
Telemetry pressure is measurable. Organizations with more than 10,000 employees now ingest over 10 terabytes of log data daily across endpoints, multi-cloud services, SaaS tools, and operational-technology networks. Microsoft reported that events processed by Sentinel surged 150 percent year-over-year during 2025, Mordor Intelligence reported. VPN authentications quintupled between 2024 and 2025, according to Mordor Intelligence. By 2025, roughly 60 percent of enterprise compute had shifted to public cloud, scattering telemetry across AWS, Azure, and Google Cloud APIs. IDC's 2024 survey of 1,004 SIEM users found the median daily ingestion volume at 3.7 TB and the average organization connecting over 100 data sources. The legacy model (index everything, store hot, pay by the gigabyte) breaks economically at this scale.
Regulatory pressure compounds the volume problem. North America generated 41.39 percent of 2025 SIEM revenue, propelled by SEC disclosure mandates forcing near-real-time detection and four-day breach reporting. Europe's overlapping GDPR, NIS2, and DORA frameworks brought more than 160,000 additional entities under NIS2 by late 2024, compelling mid-tier operators to adopt centralized log management despite budget constraints. Asia Pacific's 12.72 percent CAGR reflects India, Indonesia, and Vietnam digitizing payments and enforcing data-localization mandates that require regional SIEM nodes federating to a supervisory dashboard.
The vendor landscape is consolidating in response. Palo Alto Networks purchased IBM's QRadar SaaS assets in November 2024, folding them into Cortex. Microsoft leveraged its Azure base to expand Sentinel workloads 150 percent year-over-year in 2025. CrowdStrike's LogScale crossed $220 million ARR in May 2025, Mordor Intelligence's figures put. SentinelOne enhanced AI-powered SIEM integrations for multicloud in March 2025. Elastic refined cloud SIEM pricing the same month to ease ingestion cost concerns. In 2025 the top five vendors controlled roughly 55 percent of revenue, moderate concentration, but mid-market challengers (Securonix, Exabeam, Devo) are differentiating on data-pipeline efficiency and consumption pricing for organizations ingesting tens rather than hundreds of terabytes daily.
Restraint factors are real and persistent. IDC found that 35 percent of respondents chose to stay with their current SIEM vendor even after evaluating alternatives, suggesting switching costs (millions invested in custom correlation rules and analyst training) slow migration. The same survey identified dedicated staff requirements as the top challenge (32 percent). ISC2 estimates a global shortfall of 4.8 million cybersecurity professionals as of 2024. Enterprises that budgeted for 500 GB per day in 2024 saw usage balloon past 2 TB by 2025, quadrupling annual spend under pay-by-ingest licensing. Data-sovereignty laws complicate one-size-fits-all strategies. Overlap with XDR and SOAR platforms delays budget approval.
Yet the economic case for migration is hardening. Organizations using security AI and automation extensively to contain breaches saved an average of $1.76 million, Mordor Intelligence's data shows. Roughly 40 percent of SIEM alerts never get investigated — too much noise, too few analysts. The managed SIEM and SOC-as-a-service model, growing at 12.03 percent CAGR, has become standard among Fortune 1000 organizations and is filtering down to mid-market firms. Consumption pricing lets smaller firms experiment without six-figure commitments. Turnkey connectors autoconfigure log sources for M365, Google Workspace, and popular CRM systems, compressing setup timelines from months to days.
The market is not simply growing — it is bifurcating. Legacy platforms retained 48.12 percent revenue share in 2025, yet cloud-native stacks are on track for 11.95 percent CAGR to 2031. On-premises systems held 55.27 percent of deployments in 2025, while cloud implementations advance at 12.84 percent, Mordor Intelligence reported. Platform and software licenses captured 62.79 percent of 2025 value; managed services grow faster. Large enterprises accounted for 65.39 percent of 2025 deployments; SME adoption is projected to rise at 12.28 percent CAGR, Mordor Intelligence's data shows. BFSI led with 27.52 percent revenue; healthcare is poised for the fastest 12.15 percent CAGR, Mordor Intelligence found. Threat detection commanded 43.77 percent of application spend; cloud-workload monitoring accelerates at 12.63 percent, according to Mordor Intelligence.
The autonomous SOC is not a future state. It is the only architecture that scales to the telemetry, regulatory, and talent realities of 2025. The market numbers reflect a platform shift in progress — one that will redefine what security operations looks like, who performs it, and which vendors survive the transition.
Inside the Agentic SOC: From Log Ingestion to Autonomous Response
The legacy SIEM architecture couples storage to compute. Every byte ingested carries a financial penalty, so teams filter, route, and delete — dropping chat logs, video, and months of history. Databricks' Lakewatch flips this: open formats let customers store petabytes in their own cloud storage and spin up serverless compute only when a query runs. The result is years of hot-queryable data instead of weeks. A shared security data layer like Bloommy speaks SPL, XQL, and LogQL simultaneously, so you can point Grafana or Splunk at the same underlying lake without re-ingesting.
Ingestion is no longer the bottleneck. The perception layer normalizes heterogeneous telemetry (kernel logs, container streams, cloud audit trails, identity events) into a common schema such as OCSF. Genie, the agentic layer inside Lakewatch, automates parsing of new log sources, authors net-new detections from threat intelligence, and rewrites existing rules to suppress false positives. Detection logic lives as code: YAML or Python notebooks, backtested against historical data, deployed through CI/CD pipelines. Panther applies the same discipline; its rules are version-controlled, testable, and modifiable by AI without breaking the review gate.
The reasoning engine is where agentic AI diverges from the copilot model. A large language model serves as the primary reasoning core, but effective agentic systems wrap it in structured orchestration, external tools, and persistent memory. Intezer's autonomous investigation makes over 100 distinct LLM calls per alert — recursive reasoning that builds context iteratively rather than issuing a single prompt. The AgentSOC framework formalizes this into four layers: Perception, Agentic Reasoning, Action and Playbook, and Internal Knowledge Store. Its Narrative Counterfactual Engine generates multiple attack hypotheses grounded in MITRE ATT&CK tactics, techniques, and procedures. A Structural Simulation Engine then validates each hypothesis against the enterprise topology, identity privilege graphs, and policy constraints — eliminating infeasible or hallucinated paths before they reach a decision.
Risk scoring closes the loop. The Risk Scoring and Evaluation Module ranks containment options using a composite score: (α × Containment) − (β × Business Impact). Host isolation consistently scores highest, offering 0.92 containment effectiveness with 0.15 operational disruption in the AgentSOC proof-of-concept. The reasoning loop completed in 506 milliseconds end-to-end; LLM hypothesis generation consumed roughly 95 percent of that latency. Sub-second triage is workable because most incidents develop over minutes — but the mean time to exploit has collapsed from 23.2 days in 2025 to 1.6 days in 2026, leaving no margin for human-only workflows.
Guardrails are architectural, not aspirational. MCP (Model Context Protocol) secures the model-to-tool boundary with capability whitelists, schemas, authentication, and sandboxing. A2A (Agent-to-Agent) security adds typed messages, strong identity, role and permission boundaries, trust scoring, and policy-gated execution. Defense-in-depth layers communication security, capability security, and decision security — the last combining a policy engine, human-in-the-loop checkpoints, and continuous monitoring. UnderDefense's deployment pattern requires callback functions so destructive actions are impossible by design, a PRD-approval gate before any agent receives standing write access, and least-privilege credentials that never persist in production.
The compute architecture mirrors the reasoning pattern: a hot pool sized for the last 30 days of data, always warm for detection queries; an elastic investigation pool that spins up in minutes for deep lookbacks. First query on cold data takes five minutes while indexes build; subsequent queries on the same window return in 200–300 milliseconds. This decoupling (storage from compute, detection from investigation, reasoning from action) makes autonomous response economically viable at petabyte scale.
| Component | Legacy SIEM | AI-Native Agentic Platform |
|---|---|---|
| Storage/compute | Coupled | Decoupled (object storage + serverless) |
| Detection logic | Vendor console, proprietary | Detection-as-code (Python/Sigma/YAML), Git-backed |
| Reasoning | Rule correlation, static playbooks | LLM + orchestration + memory + tools |
| Hypothesis validation | None | Graph-based structural simulation |
| Action guardrails | RBAC only | MCP, A2A, callback functions, PRD gates |
| Triage latency | 2–4 hours/manual | Sub-second to minutes/autonomous |
The architecture works because every layer was rebuilt for the agent, not retrofitted around it. The data lake feeds context. The reasoning engine anticipates. The simulation engine constrains. The risk scorer decides. The guardrails enforce. Remove any layer and the loop breaks — which is why bolting a chatbot onto a legacy SIEM produces a demo, not a production SOC.
Why the Rule-Based SOC Is Breaking
Alert fatigue is the most common way a mature SIEM investment stops delivering security value. The tool works correctly: it generates alerts for every rule match. The problem: the volume of rule matches, most for legitimate activity, has trained analysts to process alerts mechanically rather than investigate them. That observation, from a July 2026 Decryption Digest analysis, captures the operational dead end where rule-based correlation engines finally arrive.
The economics are brutal. Research shows AI-powered threat detection reduces false positives from 45–50 percent down to 8–12 percent. A legacy SIEM producing half noise means every analyst hour spends 30 minutes chasing ghosts. Multiply that across a 24/7 SOC and the labor cost alone justifies replacement. The same research cites escalating ransomware attacks and regulatory mandates (GDPR, CMMC, DORA) as adoption drivers, but the false-positive tax is the line item CFOs actually see.
Architecture compounds the waste. Legacy SIEMs were built on scale-up appliances: proprietary hardware, licensed by events-per-second, with hot storage measured in days. Scale-out architectures based on commodity servers and storage replace the costly scale-up approaches that legacy SIEM required. When log volumes double year over year (cloud workloads, identity telemetry, SaaS audit trails), the appliance model forces a choice: drop data or buy a bigger box. Both lose.
The breaking point isn't theoretical. KPMG's 2024 assessment found security leaders identifying genuine threats through better analysis of false positives and false negatives as a top challenge. Splunk echoed that its own customers are overwhelmed by too many tools and growing AI-driven threats, making the traditional reactive SOC model unsustainable. Industry analysts cataloged the pressure vectors: rising alert volumes, faster cyberattack cycles, expanding cloud security operations, security data lake adoption, analyst workload pressure, and the shift from rule-based detection.
Speed is the metric that exposes the gap. Research shows AI-driven detection with automated response cutting mean response time from 45 minutes to under 30 seconds while achieving 96–97 percent accuracy. A rule-based workflow (alert fires, analyst triages, enrichment queries run, context assembled, decision made) cannot compress to 30 seconds. The physics of human cognition won't allow it.
The rule set itself becomes a liability. Every new detection rule adds marginal signal and linear maintenance burden. Tuning becomes a full-time role. Rule drift, where environmental changes turn valid rules into noise generators, accelerates as infrastructure turns ephemeral. The Decryption Digest piece noted that analysts trained on mechanical processing stop asking "what does this mean?" and start asking "how do I close this ticket?" That cultural shift is the silent killer of detection efficacy.
Enterprises aren't replacing SIEMs because vendors released new features. They're replacing them because the old model consumes budget, headcount, and credibility while the threat landscape accelerates. The economic case writes itself: lower cost per tenant, significantly longer hot retention, and enough economic headroom to introduce AI-driven services. The rule-based SOC didn't fail because it was badly built. It failed because the assumptions it was built on (manageable log volumes, knowable attack patterns, human-scale response windows) no longer hold.
Incumbents Fight Back: Splunk, CrowdStrike, and SentinelOne's Agent Roadmaps
The legacy SIEM vendors are not ceding ground. They are embedding agentic AI into their platforms at speed, each taking a different architectural bet on how much autonomy customers will accept and how fast they can deliver it.
Splunk, now a Cisco property, made its move at RSAC 2026 with six specialized agents baked directly into Enterprise Security. The Detection Builder Agent turns a detection hypothesis into a production rule in minutes, replacing hours of SPL iteration. The SOP Agent ingests written standard operating procedures and converts them into executable response plans. The Triage Agent autonomously enriches, prioritizes, and explains alerts before a human touches them. The Malware Threat Reversing Agent, already shipping in Splunk Attack Analyzer, delivers instant script summaries and step-by-step breakdowns without manual reverse engineering. The Guided Response Agent executes containment actions (quarantine, block, isolate) based on those SOP-defined plans. The Automation Builder Agent translates natural language into tested SOAR playbooks. Splunk calls this "progressive autonomy": agents handle routine, low-complexity tasks first, with analysts retaining control over higher-stakes decisions. Detection Studio (GA) adds a unified workspace for the full detection lifecycle with MITRE ATT&CK coverage maps. Exposure Analytics (GA coming) discovers assets and users from already-ingested data, creating a "Security Truth Layer" with context-rich Entity Risk Scores. The AI Assistant is available now; Agent Launchpad, a no-code custom agent builder, arrives later in 2026. Customers can self-host a selection of open and proprietary models (Cisco Deep Time Series Model, Google Gemma 4, OpenAI GPT-OSS 20B, with NVIDIA Nemotron models coming) and Splunk Agent Observability adds Tokenomics to track agent performance and AI token spend in real time. Cisco's Q4 FY2026 security revenue hit $2.2 billion, up 14 percent year over year, with the company crediting Splunk and core network security for the growth. More than 1,500 customers bought new security products in that quarter alone, pushing cumulative net-new customers past 6,400 since those lines launched. By IDC's 2024 measure, Cisco/Splunk held 28.1 percent of worldwide SIEM revenue against Microsoft's 14.1 percent, and Splunk has led the Gartner Magic Quadrant for SIEM for 11 consecutive years through the 2025 report.
CrowdStrike's counter is Falcon Next-Gen SIEM, positioned at the center of its agentic SOC narrative. The platform unifies Falcon and third-party data, threat intelligence, and workflow automation on what the company calls the definitive AI-native SOC platform. CrowdStrike claims up to 150x faster search performance than legacy SIEMs at up to 80 percent lower total cost of ownership. Custom parsers ingest and normalize any log source, mapping fields to the CrowdStrike Parsing Standard so third-party data becomes searchable alongside native Falcon telemetry. At RSAC 2026 the company advanced the platform with AI-driven UEBA and case management, extending the agentic loop from detection through investigation and response. The pitch is speed and consolidation: one platform, one agent architecture, one search layer.
SentinelOne used RSAC 2026 to push beyond detection into AI governance and testing. Four products reached general availability simultaneously. Prompt AI Agent Security provides real-time agent governance with MCP monitoring. Prompt AI Red Teaming runs continuous AI application testing. Purple AI Auto Investigation delivers one-click agentic SOC triage. AI data pipelines cut SIEM noise by 80 percent. The company is converging on nearly identical positioning to CrowdStrike (AI-native, unified platform, autonomous security), making differentiation a matter of proof points, ecosystem breadth, and execution speed. Both are moving from pure endpoint protection to broader security platforms, leveraging AI to deepen expansion revenue and lock in enterprise customers.
For customers, the incumbent response creates three practical shifts. First, migration risk drops: Splunk's progressive autonomy lets teams adopt agents workflow by workflow without ripping out the SIEM. Second, pricing models are diverging: Microsoft Sentinel leads on transparency with commitment tiers from 100 GB/day to 50,000 GB/day and up to 52 percent savings versus pay-as-you-go, while Cortex XSIAM uses a bundled-with-platform model and Splunk's activity-based pricing arrives fall 2026 without a published rate card. Third, the skill set changes: SPL expertise still matters for Splunk, KQL becomes the de facto standard across Microsoft's stack, and Cortex XSIAM leans hardest into reducing manual query-writing altogether. The vendor you choose now dictates the query language your analysts must master and the autonomy level your governance board must approve.
The Startup Boom: VC-Backed Agents and What They Promise
Venture capital has flooded into agentic AI security at a pace that makes the previous SIEM cycle look orderly. Startups building agentic defenses raised a combined $3.6 billion, while the narrower Model Context Protocol security niche attracted roughly $40 million across four companies — a protocol that, as of December 2025, already counted 10,000-plus active public servers and more than 17,000 total deployments. The concentration is brutal: Cyera alone accounts for $1.7 billion of that $3.6 billion total, and Saviynt has crossed $1 billion in cumulative funding. CB Insights' Mosaic scoring puts the average agentic AI security startup at 768, more than double the 370 average for all private companies in its database. Eight vendors (Cyera, Torq, 7AI, Saviynt, Noma Security, Zenity, WitnessAI, and TrojAI) carry top-100 scores.
Funding velocity accelerated sharply around RSAC 2026. In the two weeks spanning March 10–26, over $392 million in new agentic AI security capital was announced. Momentum Cyber's year-end Almanac tallied $96 billion across 400 transactions for 2025, a 270 percent year-over-year increase in deal value. Eight cybersecurity deals cleared $1 billion. CB Insights recorded 782 AI acquisitions, 1.5 times the 2024 pace. The incumbents are buying: Palo Alto Networks spent roughly $29 billion acquiring three companies in 12 months; ServiceNow deployed $11.6 billion on three more; Alphabet finalized the $32 billion Wiz deal in March 2026, the largest pure-play cybersecurity acquisition on record. CrowdStrike bought Pangea. Cato Networks grabbed Aim Security. F5 acquired CalypsoAI in January 2026. Check Point absorbed Lakera. Proofpoint acquired Acuvity in February 2026 and launched its five-phase Agent Integrity Framework.
| Startup | Latest Round | Valuation | Key Investors | Focus |
|---|---|---|---|---|
| WitnessAI | $58M (Jan 2026) | Undisclosed | Sound Ventures, Fin Capital, Qualcomm Ventures, Samsung Ventures, Forgepoint Capital | Agent activity monitoring, behavioral intent policy control |
| Runlayer | $11M seed (Nov 2025) | Undisclosed | Khosla Ventures (Keith Rabois), Felicis, David Soria Parra (MCP creator) | MCP security, observability, audit |
| Reco | $55M (Sep 2026) | High hundreds of millions | AT&T Ventures, Forestay, Quadrille Capital | Agent discovery, identity governance, data exposure |
| Island | $400M (Sep 2026) | $6.4B | Evolution Equity Partners | Enterprise browser, agent control plane |
| AIR | $50M (Sep 2026) | Undisclosed | Sequoia, Greenoaks | Skills/add-on vetting, continuous re-verification |
| Cymphony | $30M (Sep 2026) | >$100M | Sequoia, SMBC Fin Atlas Beyond Fund | Data access governance, unsanctioned agent detection |
| Glow | $180M Series A (Jul 2026) | $1.2B | Sequoia, Cyberstarts, Greenoaks, Redpoint | Endpoint security for AI agents, malicious package detection |
| Oasis Security | $120M Series B (Mar 2026) | Undisclosed | Craft Ventures, Sequoia, Accel | Non-human identity, agentic access governance |
| XBOW | $120M Series C (Mar 2026) | $1B+ | Undisclosed | Autonomous offensive security |
| Zenity | $125M Series C (Aug 2026) | Undisclosed | Undisclosed | Agent security, governance |
| Noma Security | $100M Series B (2025) | Undisclosed | Undisclosed | Agent security platform |
The startups are not chasing the same wedge. WitnessAI, which raised $58 million led by Sound Ventures in January 2026, positions itself as a confidence layer for enterprise AI adoption — monitoring which agents are active, what MCP servers and tools they access, and what data they share, while extending AI application protection from models to agents. Runlayer, founded by third-time founder Andrew Berman (Nanit, Vowel sold to Zapier), launched from stealth in November 2025 with $11 million from Khosla Ventures' Keith Rabois and Felicis, plus MCP creator David Soria Parra as angel and advisor. Berman said the protocol itself lacks security out of the box, creating blind spots in observability and audit that make enterprise rollout risky. In four months, Runlayer signed dozens of customers, including eight unicorns or public companies such as Gusto, dbt Labs, Instacart, and Opendoor.
Reco, which raised $55 million in September 2026 atop a $30 million Series B from February (total $140 million), focuses on agent discovery and identity governance. At one Fortune 100 customer, Reco's platform found 21,000 agents the company didn't know about. It also identified an agent set up by an ex-employee that could access Salesforce and share data with an unknown domain. Klein, Reco's CEO, said valuation has more than doubled since February into the high hundreds of millions, with annual recurring revenue in the double-digit millions and expectations to triple this year. Financial services accounts for about 40 percent of Reco's 100-plus customers.
Cymphony, emerging with $30 million in September 2026 ($25 million Series A co-led by Sequoia and SMBC Fin Atlas Beyond Fund), found 85,000 files accessible to AI tools and agents at one U.S. public company — exposed by an external collaborator's unsanctioned Anthropic Claude instance. Cymphony helped close the exposure and verified no access occurred through those systems. CEO Shy Dekel frames the problem bluntly: enterprise security was designed for human employees, but independent entities are now joining the workforce without being people.
AIR raised $50 million across two seed rounds (Sequoia, then Greenoaks) to vet the skills and add-ons agents use. Its platform filters out roughly 27 percent of the add-ons and skills it finds online. Saban, AIR's founder, draws a parallel to kernel driver signing: the same mechanism, the same lesson, but unsigned. Sequoia partner Bogomil Balkansky calls it a continuous re-verification problem, not a scanning problem.
Glow emerged from stealth in July 2026 with a $180 million all-equity Series A at a $1.2 billion valuation (Sequoia, Cyberstarts, Greenoaks, Redpoint). CEO Roi Tiger notes the endpoint shift: everything moved to cloud and SaaS for a decade, then AI landed on the endpoint in a way never seen before. Glow's platform has already prevented malicious npm packages from installing in customer environments, identified AI agents attempting to pull such software, and detected devices where endpoint detection and response tools were missing or degraded. Typical deployments span tens of thousands of employee devices globally.
Oasis Security raised $120 million Series B (total $195 million) for non-human identity and agentic access governance. XBOW secured $120 million Series C at a $1 billion-plus valuation for autonomous offensive security, counting Moderna among 100-plus customers. Surf AI launched with $57 million. RunSybil closed $40 million, founded by OpenAI's first security hire. Qevlar AI raised $30 million. Eclypsium pulled in $25 million. Zenity added $125 million Series C in August. Noma raised $100 million Series B last year.
The market map is still being drawn, but the contours are clear: $3.6 billion in startup funding, $96 billion in M&A, 20-plus vendors across four layers, and three critical gaps waiting to be filled — MCP security, agent behavioral baselines, and cross-system identity correlation. No major vendor has shipped an agent behavioral baseline. Identity events, gateway logs, runtime telemetry, and governance policies sit in separate systems. The question of how one agent verifies another's integrity remains unanswered; A2A protocol provides communication standards, not trust verification.
Regulatory pressure accelerates. The EU AI Act high-risk obligations take effect August 2026; the Colorado AI Act hits June 2026. Both will force every enterprise deploying agents to demonstrate governance capabilities. Vendors with compliance automation, especially Geordie AI (RSAC Innovation Sandbox winner, $5 million SAFE from Crosspoint Capital) and Proofpoint, will see demand spikes. Platform consolidation continues: expect at least two more acquisitions of agent security startups by incumbents before year-end. The identity layer is ripe — Oasis Security at $195 million total funding and 5x ARR growth is a natural target for CyberArk, Okta, or Microsoft.
Seed-funded companies building mission-critical infrastructure for a protocol still maturing will hit scaling walls that $11 million cannot solve. Some will be acquired before Series A. Others will run out of runway. CISOs evaluating them should build contingency plans for both outcomes.
What This Means for Security Engineers: New Roles, Skills, and Workflows
The shift to AI-native security operations is not just a tool upgrade — it is a workforce restructuring. As autonomous agents take over triage, correlation, and first-response containment, the human role moves up the stack: from alert processor to agent orchestrator, from rule writer to risk governor. NIST's preliminary Cyber AI Profile frames the new landscape in three overlapping lanes: securing AI systems, conducting AI-enabled cyber defense, and thwarting AI-enabled attacks. That taxonomy now maps directly to job descriptions.
The title "AI security engineer" barely existed two years ago. Today it splits into distinct specializations: AI application security engineer, LLM security engineer, AI red team engineer, AI security architect, and the newest variant — AI agent security engineer. The last one emerged because production agents handle real data, money, and decisions, widening the attack surface beyond what traditional application security covers. In 2025, over 60% of enterprises deploying AI agents reported at least one security incident involving their autonomous systems, according to a Gartner survey. That incident rate is the hiring signal.
Core responsibilities now read like a new discipline. Day to day, these engineers secure AI applications, copilots, and agents before deployment; review prompts, tool permissions, plugins, connectors, and data flows; harden model-serving environments, inference endpoints, and APIs; reduce exposure to prompt injection, jailbreaks, poisoning, and data exfiltration; design monitoring and alerting for AI-specific threats; work with cloud security posture tools for AI workloads; support red teaming, validation, and secure design reviews; help incident response teams investigate AI-related security events; and translate new AI risks into cloud, identity, application, and data controls. Prompt injection is the defining problem — an assistant that only answers questions leaks information at worst, but an agent with database write access, email sending, and a payment API can be manipulated into doing real damage, and the manipulation may arrive in a calendar invite.
The skill set reflects that shift. Technical requirements now include a working understanding of how attackers target LLMs grounded in the OWASP Top 10 for LLM Applications; adversarial attack techniques that use small input changes to fool models; detecting data poisoning where corrupted training data degrades accuracy; securing applied AI across NLP, computer vision, and autonomous systems; mapping AI-specific risk with MITRE ATLAS; and systems programming proficiency in Python plus at least one systems language: Rust, Go, or C++. Soft skills are weighted differently: collaboration, critical thinking, problem solving, creativity, the ability to ask tough questions, and being assertive about process understanding now appear in job specs alongside kernel debugging.
Certifications are formalizing fast. Microsoft's SC-500 (Cloud and AI Security Engineer Associate), ISACA's AAISM, ISC2's AI Security Certificate, and the Certified AI Security Professional (CAISP) have become the recognized stack. A practical 12-month roadmap circulating in the community suggests: months 1–3 strengthening cloud security and identity fundamentals; months 4–6 learning AI system architecture; months 7–9 building hands-on proof; months 10–12 adding a role-aligned certification and targeting jobs with AI security overlap. The entry path stays open to conventional security engineers: detection engineers, SOC analysts, cloud security engineers, and application security engineers are all crossing over.
Compensation reflects scarcity. The average U.S. AI security engineer salary sits around $152,773 as of June 2026 (ZipRecruiter), but the distribution is wide. Mid-career roles cluster between $110,000 and $160,000; senior, platform-lead, or manager-track roles move higher. Information security analysts already earn a median near $120,000 (BLS), and securing AI systems pays a premium on top — compensation closer to a $165,000 median with a high ceiling for true specialists. Reported averages for AI/ML security engineers reach $169,700; junior to mid-level (one to five years) $150,000–$220,000; senior (five to eight years) $220,000–$320,000; LLM security architects $200,000–$280,000+; staff and principal at frontier labs $450,000+. The premium over traditional security engineering runs 30–50% at equivalent experience levels. Engineers focused on agentic AI safety command an additional 20–30% premium over hires who only cover LLM application security.
Demand signals are explosive. Job postings referencing "agent orchestration" jumped 1,721% year over year, making it one of the most sought-after technical skills in finance per Draup's analysis of public listings. References to LangGraph rose 679%, LlamaIndex 291%, and retrieval-augmented generation (RAG) 259%. Governance-related skills now account for more than 16,000 references in the Draup data, nearly twice the roughly 8,400 tied to training, deploying, and running models. "Responsible AI" mentions surged 657%, AI governance 394%, AI risk management 359%. Banks including JPMorgan Chase, Citigroup, and Capital One posted 139,819 AI-related roles, up 49% from 2025. JPMorgan CEO Jamie Dimon has spoken of "huge redeployment plans" as AI takes over more work. Major banks are leaning heavily into internal reskilling to bridge the gap.
The workflow itself is changing. Army Cyber Command now trains AI agents in defined "work roles" (developers, data engineers, host analysts, exploitation analysts), each JQR-approved and trained to the same standard as humans. Agents check in with human counterparts who verify the work before sending the agent back on task. As Lt. Gen. Christopher Eubank said: "We have not turned any agents loose to assume risk on their own behalf. But this is a monumental point as we operate, secure, defend, and attack the network." That human-in-the-loop governance model is becoming the default SOC pattern: agents execute at machine speed; humans authorize risk.
On the hiring boards, the roles are concrete. Databricks lists a Sr. Staff Security Software Engineer - Agentic Security Engineering (Remote - California) at USD 229K–314K/yr and a Sr. Security Engineer, Enterprise Security at USD 168K–231K/yr. Anthropic advertises a Staff+ Fullstack Software Engineer, Safeguards Engineering (San Francisco, CA | New York City, NY) at USD 405K–485K/yr and a Cybersecurity Sales Specialist at USD 380K–450K/yr. OpenAI seeks a Researcher, Safety - Frontier Assurance (San Francisco, USD 380K–500K/yr). These are not research positions — they are production engineering roles shipping agentic defenses today.
The methodology is hardening into doctrine: assume prompt injection will succeed; enforce permissions at the tool, never in the prompt; treat model output as untrusted input; separate trust levels in the context window; re-test after every model change; gate consequential actions on a human. Security engineers who internalize that playbook are no longer just hardening infrastructure — they are defining the boundary conditions for autonomous decision-making in the enterprise. The next hire you make for the SOC may not be an analyst. It may be an engineer who builds the analyst.
The Road to 2030: LLM Integration, Reinforcement Learning, and the Autonomous SOC
The trajectory is clear: security operations are moving from analyst-assisted to agent-driven, and the next five years will be defined by how fast reinforcement learning closes the gap between simulation and production. Research published in April 2026 introduced the Causal Multi-Agent Decision Framework (C-MADF), which learns a Structural Causal Model from historical telemetry, compiles it into an investigation-level Directed Acyclic Graph, and then runs a dual-agent RL system (a threat-optimizing Blue-Team policy counterbalanced by a conservatively shaped Red-Team policy) to make response decisions within structurally constrained action space. On the CICIoT2023 dataset, that architecture cut false-positive rates from 8–11% in prior baselines to 1.8% while hitting 0.997 precision and 0.961 recall. Six months later, a separate team showed that LLM guidance can be compressed into training-time reward shaping: their "Ask the Expert" framework summarizes hard cyber-defense states, queries an LLM for host-level recommendations via a constrained action interface, transforms those into tiered reward shaping for PPO, then discards the LLM entirely — deployment is a pure RL policy with no inference-time latency or trust dependency. Across TTCP CAGE benchmarks, the approach improved sample efficiency over vanilla PPO and outperformed potential-based reward-shaping baselines while retaining the strongest terminal mean reward.
Meanwhile, the attack surface is mutating. Deloitte's 2026 Tech Trends report frames the next phase as autonomous cyber warfare (AI-versus-AI combat at machine speed without human intervention) and lists swarm attack coordination, adaptive persistent threats, geopolitical dimensions, and economic warfare risks as emerging capabilities. As AI proliferates across power grids, water treatment, transportation, healthcare, and commercial space infrastructure (every satellite is a computer), the convergence of AI and physical systems creates attack surfaces that could produce unprecedented disruption. Quantum communication channels promise theoretically unbreakable encryption but also threaten to render current methods obsolete. The window for reactive architectures is closing; Deloitte argues that building adaptable security architectures today is the only way to establish organizational resilience for the threat landscape of 2030.
Three hard problems remain unsolved. First, data scarcity: labeled cyber-attack datasets are thin, and public corpora such as CICIDS2017 and UNSW-NB15 cannot support complex multi-agent experiments in realistic network topologies. Second, explainability at speed: transformer-based sequential models and graph anomaly detection are not yet applied efficiently enough to meet real-time constraints while satisfying compliance mandates in healthcare and finance that require decision-process transparency. Third, agent governance: as autonomous agents spin up their own sub-agents, enterprises need real-time monitoring of decision-making patterns and inter-agent communication, dynamic privilege management, and lifecycle controls analogous to HR for digital workers — creation, modification, deactivation, succession. The Policy Divergence Score and Explainability-Transparency Score proposed in C-MADF are early attempts to quantify inter-policy disagreement and surface escalation signals to human operators, but no unified framework incorporates adaptive deception, explainability, and behavioral modeling simultaneously.
The workforce signal is already visible. As previously noted, Databricks, Anthropic, and OpenAI are hiring for the roles described above. These roles don't exist in a rule-based SOC; they are the first hires of the autonomous era.
By 2030, the SOC that still relies on static correlation rules will be as defensible as a perimeter firewall in a zero-trust network. The winners will be the teams that treat RL policy training, causal constraint modeling, and agent governance as core engineering disciplines — not bolt-on features. The engineer who builds the analyst has already reported for duty.
Key Questions Answered in the Report
How fast is the Security Information and Event Management market expected to grow to 2031?
The market is forecast to expand from USD 12.06 billion in 2026, Mordor Intelligence found, to USD 20.78 billion by 2031, Mordor Intelligence's data shows, reflecting an 11.50% CAGR.
Which deployment model is expanding the quickest?
Cloud-based SIEM is the fastest, advancing at a 12.84% CAGR as buyers shift away from capital-intensive hardware.
Why are healthcare organizations increasing SIEM spending?
A 128% jump in ransomware incidents against electronic health record systems is driving hospitals to adopt real-time correlation and automated response.
What is the chief cost challenge for SIEM buyers?
Pay-by-ingest licensing combined with multi-year log-retention requirements can quadruple budgets when telemetry volumes surge.
How are regulations influencing SIEM adoption in Europe?
NIS2, DORA, and GDPR impose strict log-retention and rapid incident-reporting mandates, compelling thousands of additional entities to deploy modern SIEM tools.
What role does AI play in modern SIEM platforms?
Generative AI assistants summarize alerts, answer natural-language queries, and recommend remediation actions, reducing analyst workload and speeding response times.
Working in AI? Zero G Talent tracks the openings: see every open Databricks role, browse AI jobs, openings at OpenAI and Anthropic, and the people building the field.