Security budgets are going up again next year, and for once nearly everyone agrees on why. a16z surveyed 100 CISOs at companies with more than 1,000 employees about their priorities, budgets and buying plans for 2027, and 87% expect cybersecurity spending to increase, driven mostly by AI-enabled threats and the expanding attack surface that comes from their own AI deployments.
Agent security made the biggest jump in the survey
A year ago, the top priorities were exposure and vulnerability management and SIEM. For 2027, all seven of the most-selected initiatives involve AI, and none moved further than internal AI agent security, which jumped 28 points since last year. The buying plans back that up: 45% of CISOs plan a new purchase or upgrade for internal AI agent security within the next twelve months, ahead of offensive security at 42% and AI usage and governance at 38%.
What is actually keeping CISOs up at night
Ask the same CISOs what worries them most about the AI they have already deployed, and two answers come up again and again: employees leaking sensitive data into AI tools (47%), and agents exceeding their permissions or being compromised (46%). Both come back to the same root problem. Most organizations can describe what their AI tools are supposed to do. Far fewer can say which agents are actually running right now, what credentials each one holds, or what it did with them last week.
Where we think this goes
Our team built Signal Loom around that gap. Every agent, whether it is custom-built, SaaS, or legacy, gets an identity it can prove, and every credential it holds is tracked rather than assumed. When something looks wrong, access comes back at the source, with a record of what happened that holds up to an auditor or a regulator. That is the problem underneath the survey's two biggest worries: an agent exceeding its permissions is an identity and access problem, and a leak through an AI tool is an accountability problem, since someone has to be able to say who authorized that agent and what it could see. Neither gets solved by watching dashboards more closely. Both get solved by knowing, for certain, which agents exist and what they can do.
Start where it costs the least to find out
If your team is one of the 45% planning a purchase or upgrade for internal AI agent security in the next year, the first step does not have to be a big commitment. $1 buys 60 days of every feature in Signal Loom, no floor, which is enough time to find every agent running in your environment today and see what it is actually doing with the access it holds.
Start your $1 trial at signal-loom.ai/start
Source: a16z, "The New Security Agenda: What CISOs Told Us About AI, Budgets, and Priorities," survey of 100 CISOs at companies with 1,000+ employees.