By Members of the DNSFilter Executive Team
In 2027, the most consequential decisions on both sides of the security market will stop being made by people.
On the attackers side, an objective gets handed to an autonomous agent that does the reconnaissance, chains small flaws into a real breach, and rewrites its approach when it hits a wall, a lot faster than any analyst can read the first alert. On the buyer’s side, the research shortlist is increasingly consumed and trusted by people who never visit a website, never read a case study, and never remember a campaign. They’ve trusted an agent to do the heavy lifting.
Below are seven predictions from across the DNSFilter executive team that address how the security industry will evolve next year when it comes to spending, consolidation and AI governance.
1. Security Budgets Will Shift Toward Visibility and Prevention
Ken Carnesi, Chief Executive Officer and Co-Founder
The first wave of AI security spending went to policies, approved tool lists and committees. In 2027, budget will shift toward finding out which AI tools are actually running, as organizations learn within weeks that their approved lists no longer match what employees actually use. Boards will also question why spending is weighted so heavily toward detecting and responding to incidents after they happen. With domains now blocked ten or more days before public threat feeds flag them, prevention will become provable and compete for the same money on equal terms.
2. Buyers Will Consolidate the Stack, Not the Expertise
Kate Trojanowski, Vice President of Product
AI is making consolidation easier by letting one generalist with an AI assistant run what once took three specialists. In 2027, buyers will discover what leaves with the expert: the judgment that notices a domain registered three days ago or questions an allow rule nobody remembers writing. Those gaps are silent, so a generalist stack can look healthy right up until it is not. Buyers will demand products with expert judgment built in, real depth at DNS, where nearly every connection begins, and room to add capabilities without replatforming.
3. For Defenders, AI Agents Are Unmanaged Endpoints at Scale
Kasey Best, VP of Threat Research
In 2027, the largest drivers of traffic will almost certainly no longer be humans. AI agents extend any user’s reach and act at machine speed, so a single lookup a person once ran can become dozens or hundreds of resolutions, each an opening for an attacker, and it only takes one. Much of the security stack still treats agents as legitimate users. Whatever framework or model an agent runs on, it still uses DNS to reach the internet, and as agent traffic grows in 2027, protection at the DNS level will become more valuable than ever.
4. DNS Is Becoming an Identity Layer for Machines
Brian Gillis, Co-Founder
In 2027, early adopters will start publishing agent discovery records in live DNS zones, well ahead of a standard still two to four years away. That call will fall to an engineer, not a security team, even though the records publish an inventory of what an organization can do. The difference between proving who owns a domain and proving an agent is safe will become the central security problem at this layer. The first meaningful incidents will be unsophisticated: squatting and impersonation.
5. Defenders Will Delegate to AI the Way Attackers Already Have
Mikey Pruitt, Head of AI Labs
Attackers have automated for decades, but AI is now capturing the expertise itself, with a human supplying only the intent. In 2027, that means attacks that run their own reconnaissance, chain minor bugs into a real breach and finish before an analyst reads the first alert. Defenders will respond the same way, delegating speed to an architecture that decides at the DNS lookup and learns from every block, so a threat caught at one customer protects all of them. Inside the business, organizations will inventory the AI actually running before sanctioning or blocking anything, then give agents scoped access and supervision matched to earned trust.
6. MSPs Will Become the Security Department for Most of the Economy
Dan Cucchi, Vice President of MSP and Channel Sales
Small and mid-sized businesses will not hire security teams, yet their insurers and regulators increasingly assume one exists. That responsibility already falls to managed service providers, and in 2027 contracts written as IT support agreements will catch up, either deliberately or after an incident. Provider compromise, which gives attackers trusted access to hundreds of clients at once, will become the central risk conversation in the channel. Short on technicians, MSPs will adopt tools that work by default, deploy in minutes and manage every client from one place.
7. Security Will Come Built Into the Brands People Already Use
Rich Scott, Chief Revenue Officer
In 2027, more people will get their security from the router, internet plan, phone or app they already have, rather than shopping for it. Customers will assume protection is included and hold the provider responsible when it fails. More internet providers and device makers will plug into existing protection under their own name rather than spend years building it, then offer it in every plan, as a premium tier or in a bundle.
Conclusion
2027 will reward the organizations that decide earliest. That means seeing what is actually running before writing rules about it, stopping threats before a connection exists, and keeping expert judgment at the layer every request passes through. Whether a request comes from an employee, an MSP’s client, a home router or an AI agent, it still begins with a DNS lookup.
