Cybersecurity firm Flashpoint has released a new report which examines the challenges shaping enterprise threat intelligence programmes as AI-fueled attacks accelerate, where teams plan to expand coverage, and how they’re approaching agentic AI as they plan for 2027.
The Enterprise Threat Intelligence Report: 2026 shows threat intelligence teams heading into 2027 under growing pressure as the AI threat landscape accelerates faster than their capacity to keep up. Many organisations (50%) are increasing threat intelligence investment in response, with AI-related threats emerging as the leading priority for expanded coverage and new investment. Yet despite the attention surrounding agentic AI, most teams (75%) are still evaluating where it can deliver meaningful value for defenders, balancing the potential to extend analyst capacity with expectations around intelligence quality, control, and human oversight.
“2027 will test whether threat intelligence programmes can scale their reach as fast as AI is reshaping the threat landscape,” says Josh Lefkowitz, co-founder and CEO of Flashpoint. “The opportunity for agentic AI on the defensive side is significant and our research shows security leaders are ready to invest. But they aren’t swayed by the hype. They’re holding agentic AI to a high bar and they want to know where it improves their work, whether they can trust the output, and where human judgment must remain part of the process.”
Key findings from the latest report include:
- AI is expanding the threat landscape and increasing operational pressure on intelligence teams. Alert noise and false positives were the top pain point, cited by 65% of respondents, followed by insufficient analyst bandwidth at 55%, and product integration gaps at 50%.
- Threat intelligence budgets are rising to close the gap. Half of respondents expect budgets to increase over the next 12 months, including 35% anticipating increases of 10% or more. Another 40% expect spending to remain essentially flat, and none anticipate a decrease. Growing budgets are supporting AI-related threat coverage, additional intelligence feeds and modules, and broader programme development.
- AI-related threats are the leading priority for expanded coverage and new investment. Practitioners identified deepfake detection, AI-accelerated vulnerability exploitation, and emerging AI-enabled threat vectors as expanding intelligence requirements.
- Agentic AI adoption is underway, but teams are setting a high bar. Just 25% of organisations are using agentic AI in production today to power their threat intelligence teams, while 20% are piloting it, and 35% plan adoption within 12 to 24 months. As adoption expands, so does scrutiny. Threat intelligence leaders are applying the same investment standards to agents as other technologies: 55% cited demonstrable time savings or the ability to extend analyst reach as an investment requirement, while 35% want real-world evidence through a proof of concept or pilot first. Their no-gos: lack of demonstrable value and unpredictable AI costs were among the most commonly cited barriers to investment.