Tomasz Tunguz recently argued that cybersecurity may become AI’s third major product-market fit, after coding and customer support. I think he is right, but his data points to something even more important for security teams: AI is arriving across parts of security operations that have traditionally been treated as separate disciplines.
Tunguz’s analysis shows security spending across the SOC, SIEM and log ingestion, penetration testing, threat intelligence, and vulnerability management, alongside the AI token intensity of each. His point is about the growing role of AI across all five. My takeaway is architectural: these functions increasingly need to work together.
AI Needs Evidence, Not More Data
Security teams already have enormous amounts of telemetry from endpoints, networks, identities, firewalls, SaaS applications, cloud infrastructure, vulnerability scanners, and threat intelligence. The problem is no longer simply collecting more data. The problem is turning that data into evidence that an analyst—or an AI system—can use to make a decision.
Consider a suspicious identity. To understand what actually happened, an investigation may need to connect an unusual login with workload access, endpoint activity, network behavior, vulnerabilities, and threat intelligence. If those signals remain trapped in different tools and data models, AI inherits the same problem analysts have struggled with for years: it has to reconstruct the attack one system at a time.
That is why the AI SOC is fundamentally an architecture problem.
Different Problems Require Different AI
Security operations cannot depend on one form of AI. Machine learning can identify unusual behavior across large datasets. Graph analytics can connect users, assets, alerts, and activity. Large language models can interpret evidence and help analysts understand it. Agentic AI can investigate observables, test hypotheses, and recommend or execute approved actions.
At Stellar Cyber, we call this Multi-Layer AI. What matters, however, is not how many AI techniques you can name. What matters is whether they work from the same evidence and within the same security workflow.
Detection cannot remain separate from investigation, and investigation cannot remain separate from response. The evidence that produced a decision must follow that decision through the process. This is the architectural premise behind the Integrated Security Operations Center, or ISOC.
AI Changes the SOC Operating Model
Tunguz makes another important observation: attackers can use AI to parallelize their efforts. Defenders need to do the same.
That does not mean putting another AI agent inside every security product. It means enabling AI to work across identity, endpoint, network, cloud, vulnerabilities, and threat intelligence as parts of the same investigation. AI then stops being another feature in the security stack and starts changing how the SOC itself operates.
This distinction will become more important as AI use grows. The future SOC should not be measured by how many models it runs, agents it deploys, or tokens it consumes. It should be measured by whether it identifies the real threat, understands what happened, responds correctly, and does so before the attacker can move.
Humans still matter in that model. Autonomous security cannot become unaccountable security. The practical destination is a human-augmented autonomous SOC, where AI provides scale, correlation, and investigative speed while people retain judgment, governance, and control.
Tunguz is right: cybersecurity looks increasingly like AI’s third major product-market fit.
But the larger opportunity is not putting AI into more security products. It is building a security architecture in which AI can finally make all of those products work together.
https://tomtunguz.com/the-third-product-market-fit-in-ai/
