By Jeremy Powell, Chief Information Security Officer, Sumo Logic
Prediction season rewards hedging, and I am not going to hedge. Here are five calls for 2027 that I will put my name on: what will happen, why it will happen, and how it will show up in your program.
AI: The agentic SOC goes to production, and supervising machines becomes the job
What will happen: Autonomous agents move from SOC pilots into production. Triage, enrichment, and first-pass investigation become machine work, and the classic Tier 1 analyst role retires. The new entry-level security job is agent operations: supervising, auditing, and tuning a fleet of AI analysts that never sleep and occasionally hallucinate.
Why it will happen: The math broke years ago. Alert volume compounds faster than any hiring plan, adversaries operate at machine speed, and 2026 proved the models can handle bounded investigative work. The gap is operational, not technical: the 2026 SANS SOC Survey found 79 percent of SOC teams using AI tools while only 36 percent had built them into a defined workflow. 2027 is the year that gap closes, because boards will stop asking “what is our AI strategy” and start asking “who is accountable when the AI acts.”
How it will happen: Procurement will demand replayable decision logs for every agent action. Non-human identity management, meaning scoped credentials and least privilege for machines, becomes table stakes. Human-on-the-loop checkpoints will gate containment and response. The winners will not be the teams with the most agents. They will be the teams that can prove what their agents did, and why.
CISOs: The role splits, and the paperwork gets personal
What will happen: The CISO role formally bifurcates into a business-risk executive who owns governance, disclosure, and customer trust, and a technical operator who runs the machinery. More enterprise CISOs will report outside of IT than inside it by the end of 2027. Personal liability protection (indemnification language, D&O coverage, a written charter) becomes a standard negotiating item, as routine as equity.
Why it will happen: The precedents exist. Regulators have shown they will name individuals, and disclosure requirements put a CISO’s signature uncomfortably close to securities law. At the same time, security has quietly become a revenue function: enterprise deals turn on security attestation, and someone has to own that motion with the same accountability a sales leader carries.
How it will happen: Watch for employment agreements with explicit indemnification, board risk committees with the CISO presenting directly, and customer-trust teams landing inside the security organization with revenue metrics attached. CISOs who cannot translate risk into dollars will end up in the operator half of the split, working for the ones who can.
Threat Hunting: Hunting goes continuous, and data economics decide who gets to play
What will happen: Threat hunting stops being an artisanal, when-we-have-time craft and becomes a continuous, machine-scale discipline. AI generates and tests hypotheses across the telemetry around the clock; humans validate the findings and turn them into durable detections. The constraint stops being analyst talent and becomes whether you can afford to retain and query your own data.
Why it will happen: Modern intrusions live off the land and off legitimate identities. They do not trip signatures. They surface as subtle behavior over long time windows, which requires months of high-fidelity telemetry, and telemetry volumes keep compounding. Too many teams already decide what not to collect based on budget, which means a hunting decision is being made by the finance department.
How it will happen: Security data pipelines become a CISO-owned architecture decision in 2027: filter and tier aggressively, keep the long tail queryable, and treat retention as a hunting prerequisite rather than a storage line item. Teams will report hunt coverage alongside detection coverage, and AI-generated hypotheses will be graded the way detections are, on precision rather than volume. The organizations that get this wrong will read about their intrusions in someone else’s report.
Social Engineering: Verifying humans becomes a control, not a courtesy
What will happen: Enterprises deploy formal human-verification controls in 2027: challenge-response procedures, out-of-band callbacks on known-good numbers, and cryptographic identity proofing for privileged actions, because a face and a voice are no longer evidence of identity. The help desk becomes the most defended function in the company.
Why it will happen: Voice cloning takes seconds of reference audio. Real-time video impersonation has moved from research demo to standard criminal tradecraft, and recent survey data shows a majority of organizations experienced a deepfake incident in the past year. The most damaging intrusions of the past two years did not start with an exploit. They started with a convincing phone call to IT support, and Deloitte projects US generative AI fraud losses to reach $40 billion by 2027. The economics favor the attacker until we change the process.
How it will happen: “Verify before you trust” gets written into policy: callback procedures for payments and credential changes, hardened identity proofing before any help desk password or MFA reset, and deepfake drills alongside phishing simulations. None of this is exotic. It is the discipline of assuming the person on the screen might be synthetic, every time, with no exception for the CEO. Especially for the CEO.
Supply Chain: The AI stack is the next supply chain crisis
What will happen: A major 2027 breach will trace back to a compromised AI component: a poisoned model, a hijacked agent integration, or an over-permissioned connector. The industry will respond the way it did to SolarWinds and Log4Shell, with inventory. AI bills of materials join SBOMs, and “what can your agents touch” becomes a standard third-party due diligence question.
Why it will happen: Enterprises wired AI agents into email, code, tickets, and finance faster than anyone inventoried them. Every agent integration is a trust relationship with tool-level permissions, which is classic supply chain exposure with autonomy bolted on. Attackers follow the connective tissue; they always have. The regulatory clock is also running: the EU Cyber Resilience Act’s reporting obligations went live in September 2026, and the full regime, CE marking and SBOMs included, lands on December 11, 2027.
How it will happen: Third-party risk programs extend to models, datasets, agents, and integrations. Security reviews start asking vendors for AI bills of materials and agent permission scopes. Approved registries for AI tools and connectors appear next to software allowlists. And most organizations will make an uncomfortable discovery along the way: they operate more non-human identities with production access than human ones, and nobody onboarded half of them.
Closing Thoughts
None of this requires a crystal ball. It requires watching where the economics, the adversaries, and the regulators are already pointing, and being honest about what that means for how we run security. 2027 will not reward the teams that adopted AI fastest. It will reward the teams that can stand behind what their machines did.
##
ABOUT THE AUTHOR
Jeremy Powell is the Chief Information Security Officer at Sumo Logic. A former public-company CISO with 27 years across cloud infrastructure, datacenter operations, networking, product development, and security, he leads security operations, application security, GRC, and customer trust for the company.
