Security operations (SecOps) teams struggle to produce metrics that demonstrate process improvement and the value that the security operations center (SOC) delivers for the organization. This research establishes a set of SOC metrics and details a five-step process to operationalize those metrics to improve the SOC and demonstrate value.

Cloud detection and response is the next and most important frontier for security operations teams. However, detection and response on cloud infrastructure differs from traditional infrastructure in fundamental ways that make it challenging for security operations (SecOps) teams. Security leaders can use this report to understand what their security operations teams need to know about detection and response on cloud infrastructure.

In Forrester’s High-Performance IT Survey, 2026 , 58% of technology pros report having comprehensive security operations (SecOps) visibility with adaptive detection, orchestrated response, and closed-loop feedback mechanisms; 28% report partial visibility and 13% limited visibility. Organizations with partial or limited SecOps visibility struggle with a lack of investment and have difficulty maximizing existing investments in technology and other resources. It’s vital to realize the value of existing investments and prioritize those that improve visibility and tailor SecOps to specific business needs. This is a snapshot of Forrester’s data on the current state of detection and response in IT organizations.

Between July 9 and July 13, 2026, an autonomous agent collective with no human operator behind it ran a full intrusion against AI model host Hugging Face, wanting the answers to a benchmark. It executed roughly 17,600 recorded actions in 4.5 days, took cluster-admin across multiple internal clusters in under 13 hours, and left without anyone knowing who was responsible. Hugging Face’s controls performed better than most enterprise environments would, and it still lost every layer that depended on identity. Security leaders can use this report to learn what it’s like defending against that kind of intrusion.

Security vendors are increasingly building AI capabilities into their tools and services, including those that focus on the security aspect of governance, risk, and compliance (GRC). These capabilities differ significantly from vendor to vendor, especially based on the use case and the team using them. Forrester analyzed data from 34 GRC vendor respondents to discover how they are using AI in their products and services, what they perceive as customer value, and the biggest barriers to adoption. Security leaders can use this report to understand the AI features that GRC tools deliver today and how they should think about the value derived from those capabilities.

Security operations teams (SecOps) struggle to identify and manage metrics that demonstrate process improvement and the value the security operations center (SOC) brings to the organization. This tool provides examples of SecOps metrics and a resource to identify and document SOC metrics.

Agentic AI has moved past experiments and into real deployment, which means CISOs must now secure systems that take autonomous actions, chain outputs across tools, and slip past the familiar control points we rely on. This report translates Forrester’s Agentic AI Enterprise Guardrails for Information Security (AEGIS) framework into execution with a clear map of the AEGIS technology ecosystem, aligned to where controls operate. It shows CISOs how to turn AEGIS into an operating model with accountable ownership, a minimum baseline for production, and a 180-day plan. The result is a practical playbook that speeds AI adoption while preserving assurance.

Security vendors are building AI capabilities into their tools and services at a breakneck pace, including capabilities that focus on security operations. These capabilities differ significantly from vendor to vendor, especially based on the use case. We analyzed data from 87 security operations vendor respondents to understand how they’re using AI in their products and services, what they perceive as customer value, and what their biggest barriers to adoption are. Security leaders can use this report to understand what AI features security operations tools deliver today and how they should think about the value derived from those capabilities.

Security vendors are building AI capabilities into their tools and services at a breakneck pace, including capabilities that focus on security leadership. These capabilities differ significantly from vendor to vendor, especially based on use case. Forrester analyzed data from 17 security leadership and strategy vendor respondents to discover how they are using AI in their products and services, what they perceive as customer value, and the biggest barriers to adoption. Security leaders can use this report to understand the AI features security leadership and strategy tools deliver today and how they should think about the value derived from those capabilities.

Security vendors are aggressively building AI capabilities into their tools and services. These capabilities differ significantly from vendor to vendor, especially based on the use case. Forrester analyzed data from 17 security vendor respondents that are focused on securing AI to discover how they are using AI in their products and services, what they perceive as customer value, and the biggest barriers to adoption. The primary use cases of customers include accelerating workflows and increasing productivity. Security leaders can use this report to understand the AI features that tools for securing AI deliver today and how they should think about the value derived from those capabilities.