--- title: "a16z New Security Agenda TL;DR: CISO Plans for 2027" description: a16z surveyed 100 CISOs about 2027. Our TL;DR on AI, continuous testing and fixing, plus why associations are especially exposed. image: https://www.vortacity.com/hubfs/Abstract%20AI%20network@1x.png --- [Skip to content](https://www.vortacity.com/vortacity-blog/a16z-new-security-agenda-tldr#main-content) [![](https://www.vortacity.com/hs-fs/hubfs/Vortacity-Cyber-Main-Logo-1.png?width=720&height=144&name=Vortacity-Cyber-Main-Logo-1.png)Homepage](https://vortacity.com/) - [Home](https://www.vortacity.com) - [About](https://www.vortacity.com/about-us) - [Services](https://www.vortacity.com/services) - [Blog](https://www.vortacity.com/vortacity-blog) - [Contact](https://www.vortacity.com/contact-us) - [TrapLine](https://www.vortacity.com/trapline) [Meet with us](https://bookings.cloud.microsoft/book/Consultation@vortacity.com/?ismsaljsauthenabled=true) - [Home](https://www.vortacity.com) - [About](https://www.vortacity.com/about-us) - [Services](https://www.vortacity.com/services) - [Blog](https://www.vortacity.com/vortacity-blog) - [Contact](https://www.vortacity.com/contact-us) - [TrapLine](https://www.vortacity.com/trapline) [Meet with us](https://bookings.cloud.microsoft/book/Consultation@vortacity.com/?ismsaljsauthenabled=true) ![Abstract network graphic representing AI-driven cybersecurity priorities for 2027](https://www.vortacity.com/hs-fs/hubfs/Abstract%20AI%20network@1x.png?width=1200&height=630&name=Abstract%20AI%20network@1x.png) Cybersecurity for Associations Penetration Testing AI Security # TL;DR: a16z's New Security Agenda and What It Means for You ![Eddy, The Vortacity Desk](https://7528315.fs1.hubspotusercontent-na1.net/hub/7528315/hubfs/raw_assets/public/mV0_d-cms-elevate-theme_hubspot/elevate/images/avatar-placeholder.jpg?width=48&height=48&name=avatar-placeholder.jpg) Eddy, The Vortacity Desk November 4, 2026 For years, security teams braced for quantum computing to rewrite the rules. In a new report, Andreessen Horowitz (a16z) argues AI got there first. "The New Security Agenda," by Stephenie Zhang and Owen Colby, is based on a survey of 100 CISOs at companies with more than 1,000 employees. It asks where their money and attention are going in 2027. Here is the short version. ## The TL;DR **Budgets are up, and AI is the reason.** 87% of CISOs expect security spending to rise. The main drivers are AI-enabled threats and the new attack surface from their own AI rollouts. Only 4% expect to cut security headcount. **AI owns the 2027 priority list.** All seven of the most-selected 2027 initiatives involve AI. SOC automation drew the most first-place votes. Internal AI agent security, SOC automation and offensive security grew the most over 2026. **Adoption is still early.** Only 18% run AI SOC tools in production, and 13% use AI offensive security or AI exposure and remediation tools. Within 12 months, 45% plan to buy or upgrade internal AI agent security, 42% offensive security, and 38% AI usage and governance. **Pen testing is going continuous.** Bain estimates AI can shrink a typical attack sequence from roughly four weeks to about 18 hours. Today, 18% of CISOs run most offensive testing continuously against production. 52% expect to within a year, and 44% expect testing to be built into CI/CD within five years. **Finding is easy. Fixing is hard.** Faster discovery can just grow the backlog. 70% want to retest and verify fixes, 67% want to prioritize by validated exploitability, and 57% want fixes or tickets generated automatically. One security executive called the opportunity "a fix it with the find it." **The SOC gets AI help, with guardrails.** Today, 36% are comfortable letting agents take low-risk actions on their own, and 60% expect to be within a year. Only 7% expect to allow autonomous action in most cases. **Your own AI is the new attack surface.** 92% report production use of employee generative AI tools, and 55% have MCP servers or other agent-to-application integrations live. The top worries are employees leaking sensitive data into AI tools (47%) and agents exceeding their permissions or getting compromised (46%). 63% say security is slowing at least some AI adoption. **Social engineering gets sharper.** AI-generated messages, voices and video make impersonation much more convincing. The report highlights phishing and deepfake simulation as a growing category. **Platforms get the first call.** 44% start with features from their existing security platform, versus 21% who go to an AI-native vendor first. But 47% would choose a startup to close a gap their incumbent can't. (a16z has invested in several of the startups in the report, so keep that in mind when reading the vendor examples.) ## Our take The survey covers large enterprises, but the pressure is even greater below that line, on small and midsize organizations that don't have a SOC or a dedicated red team. If attackers can get from a first foothold to real damage in hours, three things follow: 1. **An annual pen test is a snapshot, not a strategy.** Test more often, and always retest after you fix. 2. **Prioritize what is actually exploitable.** A validated attack path beats a thousand-line scanner report. 3. **Inventory your AI.** Know which AI tools your people use, what each agent and integration can reach, and what data flows into them. ## Why associations should pay close attention This part isn't in the a16z report. It's our translation, based on what we see in the association world. Associations sit in the same sub-enterprise zone as small and midsize businesses: valuable data, a growing attack surface and lean IT teams. But they hold something most SMBs don't, and that's the trust of an entire community. Members open the renewal notice, click the conference registration link and pay the invoice because it comes from their association. That trust is exactly what attackers want to borrow. A compromised association hands over member records and payment data, plus a trusted voice for sending AI-polished phishing to thousands of people with every reason to believe it. Most associations also aren't watching trends like the ones in this report. Their attention is on members, programs and events, which is where it should be. But it means the shift a16z describes is happening without them. And associations are creatures of cadence, not habit. The work runs on cycles: the annual meeting, renewal season, the budget year, the board calendar. Security tends to get the same treatment. A single pen test happens, often prompted by an audit, an insurance questionnaire or a board request, and then it's checked off until the next cycle comes around, if it does. That made more sense when attacks took weeks to unfold. It doesn't when they take hours. The attack surface changes every time a new AMS integration, event platform or AI tool goes live, and a once-a-year snapshot can't keep up. In our view, high trust, lean teams and point-in-time testing combine to make associations one of the most vulnerable targets below the enterprise level. The answer is to turn security from a cadence into a habit: an annual engagement, not an annual event. That means continuous scanning, regular pen tests with retesting built in, and deception running at all times, so an intruder trips an alarm early instead of quietly working through member data. That always-on layer is the thinking behind TrapLine, our deception-based early warning platform. [Talk to us about an annual security program](https://www.vortacity.com/contact-us) Or email info@vortacity.com. **Read the full report:** [The New Security Agenda (a16z)](https://a16z.com/the-new-security-agenda/) ## Sources - Stephenie Zhang and Owen Colby, ["The New Security Agenda"](https://a16z.com/the-new-security-agenda/), Andreessen Horowitz, October 28, 2026. All survey figures and the Bain estimate come from this report. ## Share this post [mailto:https%3A%2F%2Fwww.vortacity.com%2Fvortacity-blog%2Fa16z-new-security-agenda-tldr](mailto:https%3A%2F%2Fwww.vortacity.com%2Fvortacity-blog%2Fa16z-new-security-agenda-tldr) ## Keep reading ### [![](https://www.vortacity.com/hs-fs/hubfs/Untitled%20design%20(59).png?width=2240&height=1260&name=Untitled%20design%20(59).png) Cybersecurity for Associations Cybersecurity Impossible Travel: The Microsoft Security Detection Associations Should Know About](https://www.vortacity.com/vortacity-blog/impossible-travel-the-microsoft-security-detection-associations-should-know-about) ### [![](https://www.vortacity.com/hs-fs/hubfs/Untitled%20design%20(58).png?width=2240&height=1260&name=Untitled%20design%20(58).png) Cybersecurity for Associations Cybersecurity Principle of Least Privilege (PoLP): A Cybersecurity Principle Every Association and Nonprofit Leader Should Know](https://www.vortacity.com/vortacity-blog/principle-of-least-privilege-polp-a-cybersecurity-principle-every-association-and-nonprofit-leader-should-know) [![Vortacity-Cyber-White-Gray-Logo](https://www.vortacity.com/hs-fs/hubfs/Vortacity-Cyber-White-Gray-Logo.png?width=720&height=144&name=Vortacity-Cyber-White-Gray-Logo.png "Vortacity-Cyber-White-Gray-Logo")](https://vortacity.com/) - Home - Products - Pricing - Blog - Company --- Privacy Policy · Legal · © 2026. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Eddy, The Vortacity Desk", "url" : "https://www.vortacity.com/vortacity-blog/author/eddy" }, "dateModified" : "2026-11-04T13:30:00.685Z", "datePublished" : "2026-11-04T13:30:00.000Z", "headline" : "a16z New Security Agenda TL;DR: CISO Plans for 2027", "image" : [ "https://www.vortacity.com/hubfs/Abstract%20AI%20network@1x.png" ], "mainEntityOfPage" : { "@id" : "https://www.vortacity.com/vortacity-blog/a16z-new-security-agenda-tldr", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.vortacity.com/hubfs/Vortacity-Cyber-Main-Logo-1.png" } } } ```