AI-native security operations
AI security tools are starting to take concrete recovery actions. Commvault's August integration with CrowdStrike can restrict access, preserve backups and restore assets into an isolated environment for investigation, and it is generally available to joint customers. Being available does not mean many firms run it autonomously. Look at permissions, wrong actions and recoverability in real deployments.
Research snapshot · updated Nov 12, 2026
State of the art (2026)
Security vendors are adding AI agents that sort alerts and take response actions. In August 2026 Commvault made an integration with CrowdStrike generally available to joint customers. It can restrict access, preserve backups and restore assets into an isolated environment for investigation. A product being available does not mean many security teams let it act without a person approving. We do not have reliable figures for how many organisations run such agents in production. ISC2's 2025 workforce study gave no estimate of the global shortage of security staff and focused on the skills teams need.
Explore the deeper analysis in CanaryIQ
Explore what is covered below. These previews show the structure; log in to read the full analysis.
Signal stack
Evidence stacked leading → lagging
9 signals
Signal stack
Evidence stacked leading → lagging
Technology-native KPIs
Metrics that predict trajectory, tracked over time
3 tracked
Technology-native KPIs
Metrics that predict trajectory, tracked over time
Landscape map
Who builds what, and who depends on whom
108 players · 5 layers
Landscape map
Who builds what, and who depends on whom
Catalyst calendar
Dated events that will move the position
4 ahead
Catalyst calendar
Dated events that will move the position
Technology roadmap
Milestones on the path to maturity
7 milestones
Technology roadmap
Milestones on the path to maturity
Watchlists
Companies, people and papers, each with a condition for removing it
20 · 20
Watchlists
Companies, people and papers, each with a condition for removing it
Decision frameworks
What our view means for your job
Locked
Decision frameworks
What our view means for your job
Thesis changelog
When our view changed, and why
8 updates
Thesis changelog
When our view changed, and why
Change our mind
3 disconfirming conditions
You've read the verdict. The file is much deeper.
The full signal stack, technology-native KPIs tracked over time, the landscape of who depends on whom, the dated catalyst calendar, decision frameworks for every desk, live watchlists and a record of every time our view on AI-native security operations has changed. All of it is in CanaryIQ.