Analysts say the AI works. Their CISOs want the data-handling terms in writing.

Rapid7 has published findings from an Omdia survey of 500 security professionals in which 97 percent report positive outcomes from AI in security operations, 98 percent say it reduces alert fatigue and 95 percent say it helps with staffing shortages ^[1][2][3][4]. The finding that will actually move money is further down: according to the research, executive security leaders such as CISOs, CSOs and VPs are 1.6 times more likely than operational security managers to be highly concerned about how AI vendors handle their organisation's security data ^[5].

Read that as a split in what each level is being asked to answer. The people running the console have been asked whether the tooling reduces work, and they say it does ^[2][3]. The people signing the contract are being asked something else, and the blog framing this research puts the questions plainly: how do we govern it, who is accountable, and whose job it was to catch the threat the model missed ^[6].

Two cautions before anyone puts the 1.6x figure in a board pack. First, the published material gives the ratio without absolute concern rates for either group, so there is no way to tell whether this is 55 percent against 34 percent or 16 percent against 10 percent ^[7]. Second, Rapid7 commissioned the survey and closes by telling readers to use it to evaluate whether their MDR provider can answer buyers' transparency questions ^[1][8]. Directional, not independent.

The procurement signal is in the expectations data. Asked what they want from an AI-enabled MDR provider, 55 percent named visibility into how AI decisions are made as their top expectation, 53 percent wanted AI explicitly integrated with human analyst expertise and 52 percent wanted regular updates on model performance and accuracy ^[9][10][11]. Those three sit within three percentage points of each other and none of them is a performance metric ^[12]. Faster detection and higher automation rates did not top the list ^[9]. That is a shift from feature claims to evidence obligations, and the blog's own summary of it is that "we use AI" is no longer a differentiator ^[13].

The over-reliance number is the one to keep. Ninety-two percent of respondents said AI enhances rather than replaces human analysts, while 41 percent are actively worried that teams will defer to AI where an experienced analyst would have caught something ^[14][15]. Arithmetically, at least a third of the sample holds both positions at once ^[16]. That is not incoherence, it is people describing a control they have not yet built.

What to watch is whether any of this reaches paper. Model-performance reporting is a contract deliverable with a cadence and a recipient, not a product feature, and 52 percent of buyers say they want it ^[11]. The questions worth putting to a vendor in the next renewal cycle are narrow: what happens to customer telemetry after ingestion, whether it trains models shared with other customers, how a detection decision is reconstructed after a miss, and who is named as accountable when one happens. Also watch whether the full report discloses the base rates behind the 1.6x claim ^[7], and whether 86 percent believing AI-enabled MDR has a clear advantage over traditional approaches survives contact with the first set of buyers who demand the transparency clauses to match ^[17].