AI Proposal Targets Security Teams' Alert Backlog
A venture firm's report sketches behavior-based AI to replace hand-written rules, but no production system has been shown yet.
Updated on Nov. 7, 2026 in Artificial Intelligence
Andreessen Horowitz published a report, 'Defense in Depth, Rebuilt for Machine Speed,' on November 6, 2026, proposing AI systems for security operations threat detection and response. The proposal is a published report, not a shipped product, and its recommendations have not been demonstrated in deployment.
Why it matters
The report argues that rule-based detection cannot keep pace with alert volume, since narrow rules miss new attack variants while broad rules bury real threats in queues. It frames AI-driven behavioral detection as a way to shift security work from hand-maintained rules toward systems that learn which activity is suspicious.
The figures come from Vectra's 2026 survey on the alert backlog, which the report cites, covering security teams that receive about 3,000 alerts daily. The survey does not establish how the proposed AI system would reduce that backlog, and no benchmark for the proposed system is reported.
The players
Andreessen Horowitz
A venture capital firm whose investments span enterprise software and security startups, and which published the report proposing AI-driven security operations.
Vectra
A security company whose 2026 survey on the alert backlog is cited by the report as its primary data source.
The details
The proposed system develops detections by examining behavior rather than matching known attack signatures, so it can flag activity that resembles no previously catalogued threat. Confirmed detections are converted into rules, and the model retires those rules when the activity they target goes quiet. The system reads events directly from existing security products, without waiting for a security information and event management (SIEM) platform, which is a central log-aggregation system. For actions that could take a production system offline, the design requires human approval.
Timeline
November 6, 2026: Andreessen Horowitz publishes 'Defense in Depth, Rebuilt for Machine Speed.'
The Tech Race
The report positions AI-driven security operations against the established rule-based detection model that dominates current practice. It frames the shift as a response to documented alert backlogs rather than as a finished competitive product category.
Security teams that leave most alerts unexamined could see changes in how threats are triaged if systems like this are adopted, but the report does not give a timeline for availability or pricing. The proposal currently exists as a published recommendation, not a product that teams can deploy.
The takeaway
The central trajectory is a move from hand-written detection rules toward behavior-based AI, judged by whether alert backlogs actually fall. Watch for published production results or benchmark data from any vendor that implements this design, since the report itself presents no measured outcomes.
Further reading
For background on how these systems are being built, see Artificial Intelligence coverage.
