96% of security teams run AI at triage level. The autonomous SOC case rests on 24 respondents.

Four percent of 611 is about 24 respondents ^[8]. That is the whole population in this survey running AI above senior-triage and basic incident response work ^[2], and it is the population that any claim about what happens at higher maturity would have to rest on. The report does not make that claim numerically. With a cohort that size, it could not.

What the sample does support is narrower and more usable. The returns being reported come from chatbots handling first-pass alert triage and automation that sorts true positives from noise ^[11]. That is the labour being displaced, and the near-universal improvement figure is measured against it.

That figure also deserves a closer read than it usually gets. It is published as the share of organizations reporting improvement in incident response and remediation, with no magnitude and no named metric attached ^[5]. No median change in time to respond, no alerts closed per analyst, no baseline. A room where everyone says "better" and a room where everyone says "31% faster" are different findings, and this is the first kind. As a signal that Level 1 automation is not vapour, it holds. As an input to a business case with a payback period in it, it does not.

The platform numbers have a similar softness underneath them. Self-described platform orientation went from roughly 69% to 82% in a year ^[4][10], which is a large move for an architecture change and a modest one for a change in vocabulary. The survey itself complicates the distinction: EDR, SIEM and CNAPP are simultaneously the technologies most often deployed standalone and the top anchors that organizations expand outward from ^[6]. An estate running EDR next to a SIEM can answer that question the same way an estate that deliberately consolidated does.

The sequencing argument is where the vendor's read and its own data pull apart. SentinelOne's position is that organizations waiting for higher AI maturity before building the supporting infrastructure are running the sequence backward, and that the foundation built today determines how far the returns scale ^[12]. The mechanism it offers is real enough: agentic AI needs connected, continuously updated telemetry, and fragmented pipelines that require manual effort will not carry autonomous action at scale ^[13]. But note what the survey contributes to that case. The most-cited benefit of a SecOps data lake is supporting AI-driven workloads and agents ^[7], which records what buyers expect the lake to do, not what it has done for them.

So the two purchases sit on different evidence. Triage automation has roughly 605 organizations behind it saying it improved something ^[9], and it demands very little of the underlying stack. The data layer is being priced against returns this survey did not observe, for the straightforward reason that almost nobody in it has reached the maturity level where those returns would appear ^[2]. That is not an argument against consolidating telemetry. It is an argument for buying it on your own architecture and incident-history case, at a pace you set, rather than on the strength of a number generated by organizations doing alert triage.

The one asymmetry worth holding onto: the cheap tier is the tier with the evidence, and the expensive tier is the one with the roadmap.