AI Cybersecurity

Agentic SOC platforms replacing human analyst tiers

The agentic SOC is now the dominant product archetype in AI cybersecurity, with platforms like Exaforce, Prophet Security, Legion, 7AI, and Artemis all racing to fully automate threat investigation, triage, and remediation workflows. These platforms sit on top of existing toolchains — aggregating signals from SIEM, EDR, and cloud telemetry — and dispatch specialized AI agents to resolve alerts end-to-end, compressing what once required a human analyst tier into sub-minute automated loops. Andreessen Horowitz and Sequoia (both in the top-5 investors by deal count) are actively backing multiple entrants in this category, signaling conviction that autonomous SOC is a durable, not cyclical, market shift. CrowdStrike's resilience, cited by a16z's David Pawlan as evidence that 'security and observability hold up as AI creates greater demand for incumbents,' underscores that the TAM is expanding even as new agentic entrants challenge the incumbent labor model.

Autonomous pentesting has crystallized into a recognized category, with Darkmoon (18 specialized AI agents, 80+ offensive tools across AD, Kubernetes, cloud, APIs), Tenzai, Astra Security, and XBOW all building agentic offensive platforms that deliver publication-ready reports without human red-teamers. The category attracted both early-stage seed capital and strategic interest — XBOW's CEO is a confirmed speaker at CVAI Summit London 2026, signaling institutional legitimacy. The presence of Nvidia (52 deals as a top investor) across infrastructure bets suggests the compute-intensive nature of continuous autonomous pentesting is well understood by the chip-layer incumbents.

Why it matters · Enterprises can now replace point-in-time manual pentests with always-on autonomous adversarial coverage, fundamentally shifting security budgets from professional services to SaaS subscriptions.

As AI agents proliferate across enterprise stacks, machine-to-machine identity — API keys, service accounts, agent tokens — has become the primary attack surface. SailPoint's ~$200M acquisition of Entro Security, Astrix Security's monitoring of non-human identities, Apono's just-in-time cloud access management, Oak's AI-native identity operating system, and Opal's time-bound access governance all address the same structural gap: legacy IAM was built for humans, not for the millions of AI agents now operating autonomously inside enterprise perimeters. Okta's 57% stock appreciation in 2025 as an 'AI infrastructure beneficiary' confirms that identity security is being re-rated as foundational AI infrastructure.

Why it matters · Every enterprise deploying AI agents is simultaneously creating an ungoverned non-human identity sprawl — identity platforms that can govern agent permissions at runtime will capture budget from both legacy IAM and new agentic security lines.

Cylake's on-premises and private-cloud-first architecture for unified threat detection reflects a growing buyer requirement: regulated industries and governments will not route sensitive telemetry through third-party SaaS clouds. Dream Security's sovereign AI and cyber defense platform for governments and critical infrastructure, and Sarvam AI's sovereign AI positioning, reinforce that data residency and sovereignty are becoming procurement prerequisites, not premium add-ons.

Why it matters · Vendors that can deliver full AI cybersecurity capability within sovereign perimeters — without phoning home — will unlock government and critical infrastructure budgets that cloud-native-only competitors cannot access.

Two landmark transactions this cycle — Armis acquired by ServiceNow for $7.8B and Dragos acquired by Accenture for $4.18B — confirm that large platform buyers view AI-native cybersecurity assets as strategic infrastructure, not feature acquisitions. Layerx Security's acquisition by Akamai and SailPoint's acquisition of Entro extend the pattern to mid-market consolidation. With $114.5B of the last 90 days' capital in 'unknown' stage deals and Series C rounds averaging over $1B (21 deals, $21.9B), the capital structure strongly favors companies building toward acquisition-readiness or platform scale.

Why it matters · The exit ramp for AI cybersecurity is wide open for platform-scale builders — strategic acquirers from cloud, networking, and enterprise software are actively paying 10x+ revenue multiples to close capability gaps.