Half of organizations expect to increase their threat intelligence budgets over the next year as AI-related threats intensify, according to new research from Flashpoint, creating opportunities for managed security services providers (MSSPs) to expand their detection, response, and security operations services.
The Enterprise Threat Intelligence Report: 2026 is Flashpoint’s study that examines the challenges shaping enterprise threat intelligence programs as AI-fueled attacks increase, where teams plan to expand coverage, and how they’re approaching agentic AI as 2027 plans are crafted.
Agentic AI adoption faces cost and performance hurdles
Half of organizations (50%) have reported increasing threat intelligence investments; however, most teams (75%) are still evaluating where it can deliver meaningful value for defenders.
Among key findings of the report are:
- AI is expanding the threat landscape and increasing operational pressure on intelligence teams. 65% of respondents cited alert noise and false positives as the top pain point, followed by insufficient analyst bandwidth (55%), and product integration gaps (50%).
- Half of respondents expect threat intelligence budgets to increase over the next 12 months, including 35% anticipating increases of 10% or more. Another 40% expect spending to remain essentially flat, and none anticipate a decrease. These increased budgets are for AI-related threat coverage, additional intelligence feeds and modules, and broader program development.
- AI-related threats are the lead priority for expanded coverage and new investment. Deepfake detection, AI-accelerated vulnerability exploitation, and emerging AI-enabled threat vectors are identified as expanding intelligence requirements.
- Just 25% of organizations are using agentic AI in production today to power their threat intelligence teams, while 20% are piloting it and 35% plan to adopt it within 12 to 24 months.
- 55% cited demonstrable time savings or the ability to extend analyst reach as an investment requirement, while 35% want real-world evidence through a proof of concept or pilot first.
- Lack of demonstrable value and unpredictable AI costs were among the most commonly cited barriers to investment.
“2027 will test whether threat intelligence programs can scale their reach as fast as AI is reshaping the threat landscape,” said Josh Lefkowitz, Co-Founder and CEO of Flashpoint. “The opportunity for agentic AI on the defensive side is significant, and our research shows security leaders are ready to invest.”
“But they aren’t swayed by the hype. They’re holding agentic AI to a high bar, and they want to know where it improves their work, whether they can trust the output, and where human judgment must remain part of the process,” Lefkowitz continued.
Where MSPs and MSSPs can expand security services
Flashpoint’s research points to key new opportunities for MSPs and MSSPs to expand AI-focused security services, improve threat detection and response, and help customers adopt agentic AI responsibly.
These include:
- Managed threat intelligence: Offer ongoing threat monitoring, intelligence-feed integration, threat hunting, and incident escalation to help customers identify and respond to AI-enabled threats.
- AI-assisted security operations: Use AI to streamline alert triage, reduce false positives, and improve investigation efficiency while keeping human analysts involved in critical decisions.
- AI threat protection: Develop services addressing emerging risks like deepfakes, AI-accelerated vulnerability exploitation, and other AI-enabled attacks. These services could complement existing endpoint, email, and identity security offerings.
- AI security governance: Assist customers in assessing AI-related risks, managing unauthorized AI use, establishing security policies, and implementing appropriate oversight of AI tools.
- Agentic AI implementation and consulting: Guide customers through proof-of-concept projects for AI-powered security workflows. Measure time savings, accuracy, risk reduction, and operating costs before expanding deployments.
With the rapid growth of threat intelligence budgets and rising concerns about AI-enabled attacks, new opportunities for MSPs and MSSPs to expand recurring services have also grown.
Providers that demonstrate measurable improvements, integrate security tools effectively, and maintain predictable costs may be better positioned to win customer investment.