Where capital is flowing, what's getting rejected, and how the market is heading toward consolidation.
Research conducted February 2026 by Gather on behalf of AirMDR
Key Statistics
Executive Summary
This report draws on new research from 125+ leading AI and cybersecurity investors — VCs, PE firms, and family offices actively deploying capital in the space. The AI cybersecurity investment landscape is undergoing a structural reset. After years of speculative funding, investors are tightening their frameworks — demanding measurable ROI, proven customer traction, and defensible technical differentiation before deploying capital.
Capital is still flowing, but with significantly higher selectivity and fewer, more concentrated bets. Within that, Security Operations has become the sharpest focal point — the category where conviction is highest and where startups will be judged most harshly on delivery.
Overall, the winners of the next investing cycle will be AI-native platforms that prove they reduce operational costs and deliver outcomes at scale — not those that layer AI onto legacy infrastructure or solve convenience problems. This report is organized in two parts: key findings and full survey results.
Key Findings
Finding 01
80% of investors are deploying more capital in AI cybersecurity — but 85% expect decisive proof of returns within three years, and 40% identify cost reduction as the single strongest adoption driver. Flat enterprise budgets (55%) mean enterprises are reallocating, not expanding, which rewards vendors who can show a clear reduction in total security spend.
Critically, investors are not just looking for any AI solution — they are looking for AI-native ones. The vendors built from the ground up around AI architecture, proprietary data, and automated workflows are the ones positioned to win both enterprise budget and investor conviction in this cycle.
Finding 02
Two failure modes sit essentially tied at the top of investor concern: UI-plus-prompt wrappers (54%) and "nice-to-have" AI use cases (52%) have both disappointed — covering both the technical and strategic failure modes of the first AI wave. On the avoidance side, narrow point solutions (52%), undifferentiated startups (46%), and AI bolted onto legacy platforms (38%) dominate.
The pattern is consistent: investors are pre-empting the same failures before they repeat. The message to founders is unambiguous — convenience, novelty, and thin technical differentiation are disqualifiers in 2026, not risks to manage later.
Finding 03
SecOps leads investor conviction at 43% — the clearest signal of where AI delivers measurable ROI against a real talent and alert-fatigue crisis. The sharpest tension is MDR: 34% bullish, yet 42% skeptical — the most polarizing category in the market.
The reason is a trust problem. MDR has become crowded and commoditized, and buyers can't reliably assess quality before committing. The MDR providers that break through will be those that let results speak before a buyer signs. Identity follows the same pattern: #3 bullish, #3 skeptical. In 2026, picking the right segment is necessary but not sufficient — being the defensible player within it is the real bet.
Finding 04
63% of investors expect AI-native startups and incumbents to coexist over the next 2–3 years — but consolidation is already underway. Incumbent acquisition of AI-native startups tops the M&A outlook at 36%, followed by broader platform consolidation at 32%.
The window to establish a differentiated position is narrowing. Companies that build proprietary models, prove enterprise traction, and own a defensible architecture will be acquired at premium valuations or become the platform. Everyone else gets absorbed cheaply or runs out of runway.
AI cybersecurity remains an attractive investment area, but investor enthusiasm is no longer enough on its own. Startups need to show measurable ROI, that they help lower total security costs, and provide clear evidence of impact quickly if they want to win funding and budget.
AI-native startups will also be the winners of the next investment cycle. Investors are losing patience with AI products that feel superficial, interchangeable, or bolted onto old platforms without meaningful value. The takeaway is that the market is rewarding substance over hype — and startups will need true differentiation and real-world usefulness to stand out.
"2026 will favor fewer, higher-quality exits over broad M&A volume. Valuation bifurcation will widen — AI-native leaders versus undifferentiated vendors will see dramatically different outcomes."
— Investment Director · Venture Capital Firm"Early-stage startups built primarily on third-party foundation models, without proprietary data or credible paths to defensibility, are our top avoidance zone heading into 2026."
— Partner · Venture Capital Firm"You either become the platform or a menu item inside one. That divergence is accelerating in 2026, not slowing down — and the window to choose your path is closing."
— Managing Director · Venture Capital Firm"Access to foundation models is no longer a moat. We look for proprietary data advantages, feedback loops, and domain-specific workflow lock-in — that's where defensibility lives."
— Investment Director · Venture Capital FirmAutomation of security operations is the most immediate and measurable driver. Persistent analyst shortages and alert fatigue make this the killer app — and it is happening now, not in five years.
Security operations has strong near-term ROI from AI-driven SOC efficiency and autonomous response, with clear buyer demand driven by talent shortages and alert fatigue.
Primary Adoption Engine
Investors Are Focused on Security Operations
Bullish Subsectors
Which AI-enabled cybersecurity segments are you most bullish on for venture-scale returns over the next 24 months? (Select up to 3)
Skeptical Subsectors
Which segments worry you most — where do you see risk of overhype or under-delivery? (Select up to 3)
Select up to 3 — percentages do not sum to 100%
Security Operations is emerging as the clearest center of gravity for VC interest in AI cybersecurity, with strong conviction matched by equally strong scrutiny. This is where the market sees the biggest opportunity — but also where startups will be judged most harshly on whether they can deliver real operational results, especially in MDR.
Within that broader SecOps theme, MDR stands out as the area drawing especially heavy scrutiny — 34% of investors are bullish on it, yet 42% are skeptical, making it the most polarizing category in the market. That scrutiny is rooted in history. MDR has often under-delivered because buyers struggled to assess service quality upfront, leaving investors wary of vendors that have not fundamentally changed how outcomes are measured and delivered.
Underperformance Map
Capital Avoidance Zones
Market Structure — 2–3 Year Outlook
The market is heading toward coexistence, and then consolidation. In the near term, investors expect AI-native startups and established incumbents to coexist, rather than one quickly dominating. The market is still open, but over time it is likely to consolidate — which raises the importance of building a differentiated position before it's too late.
*Open-text responses — respondents could express multiple themes. Percentages do not sum to 100%.
Enterprise Budget Outlook
Return Horizon
Capital Raising in 2026
*Open-text responses — respondents could express multiple themes. Percentages do not sum to 100%.
2026 Investment Plans
About This Research
This research was conducted in February 2026 by Gather on behalf of AirMDR. It surveyed 125 active investment decision-makers at VC firms, private equity firms, family offices, and corporate venture arms with cybersecurity as an active or primary focus area. All percentages represent unique respondents.
Appendix
Complete responses to all survey questions from 125 active investment decision-makers surveyed in February 2026.
Q1. Over the last 2–3 years, how has your firm's posture toward AI investments changed?
Q2. Which AI-enabled cybersecurity segments are you most bullish on for venture-scale returns over the next 24 months? (Select up to 3)
Select up to 3 — percentages do not sum to 100%
Q3. Which segments worry you most — where do you see risk of overhype or under-delivery? (Select up to 3)
Select up to 3 — percentages do not sum to 100%
Q4. For 2026, how do you see your firm's investment in AI-driven cybersecurity changing?
Q5. When do you expect to see decisive evidence that an AI cybersecurity investment is on a path to VC-grade returns?
Q6. Over the last 12–18 months, which types of AI investments have raised the most concerns or shown early signs of underperformance? (Select up to 2)
Q7. Which AI investment areas is your firm actively avoiding or deprioritizing in 2026? (Select up to 2)
Q8. What will be the strongest driver of AI cybersecurity adoption through 2026?
Q9. How are enterprise security budget trends shaping your AI cybersecurity investment decisions?
Q10. What factors will most determine whether an AI startup can successfully raise capital in 2026?
*Open-text responses — respondents could express multiple themes. Percentages do not sum to 100%.
Q11. Looking ahead 2–3 years: who wins in cybersecurity — AI-native startups or AI-enabled incumbents?
Q12. How do you expect M&A/consolidation among AI cybersecurity startups to evolve in 2026?
*Open-text responses — respondents could express multiple themes. Percentages do not sum to 100%.
About AirMDR
AirMDR is AI-native MDR built to solve the trust problem investors and enterprises have long had with managed security: we made quality measurable.
High-quality, transparent investigations. 100% alert coverage. No legacy overhead, no AI veneer.