In a single year, AI has rewritten the security priority list for CISOs. Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses. There's also more to protect, with employees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems. In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI. The biggest jumps since 2026: - Internal AI agent security (+28 pts) - AI SOC (+26 pts) - AI offensive security (+24 pts) - AI code security (+23 pts) - AI vulnerability remediation (+22 pts) Last year's staples: - Exposure & vulnerability management (-21 pts) - SIEM / security data (-18 pts) - Privileged access management (-18 pts) From a16z's @OwenColby and @steph_zhang on The New Security Agenda: https://www.a16z.news/p/the-new-security-agenda