Every cybersecurity company today is "AI-powered." Increasingly, they are also "agentic."
Ask a few of those companies what that actually means in practice, and you will likely get very different answers.
That gap is not about hype. It is about clarity, and right now, clarity is in short supply.
A Simple Way to Think About the AI Stack
At a high level, most AI products are built on three layers.
At the foundation are the models. Companies like OpenAI, Anthropic, and Google DeepMind build large-scale models that can generate, reason, and interpret. Most cybersecurity companies are not building these models. They are using them.
On top of that sits the infrastructure layer. Platforms such as Amazon Web Services, Microsoft Azure, and Google Cloud provide the compute, storage, and APIs that make those models usable in real systems. This layer handles scale, performance, and reliability.
The top layer is where cybersecurity products actually live. This is where data is ingested, whether that is logs, alerts, or telemetry. It is where workflows are defined, decisions are shaped, and analysts interact with the system. This is also where real differentiation should happen.
What That Looks Like in Practice
A quick way to read the stack from bottom to top, with each layer building on the one below it:
- Compute / Infrastructure — The raw horsepower. GPUs, storage, and networking that make AI possible.
- Cloud Platforms — Where most of this runs, including managed services and scaling.
- Foundation Models — The core intelligence layer that generates and reasons.
- Model Access / APIs — How applications interact with those models in practice.
- Data Layer — Logs, telemetry, and context that ground the model in real-world signals.
- Orchestration — The logic that sequences steps, prompts, and tool usage.
- Tools / Integrations — The systems the AI can interact with, like SIEM, EDR, or ticketing.
- Agents / Workflows — Multi-step processes that combine reasoning and action toward a goal.
- User Experience — Where analysts actually interact, validate, and make decisions.
You do not need to build every layer to deliver value, but understanding how they fit together makes it much easier to evaluate what a product is actually doing.
You will also hear more specific terms like MCP (Model Context Protocol), tool calling, or function calling. These are not separate layers. They are mechanisms that live inside the model access and orchestration layers, and define how models interact with data and external systems in practice.
What "Agentic AI" Means in Practice
An agent is best understood as a system that can take a goal, make decisions, and take actions across multiple steps using available tools.
In a security context, that could mean investigating an alert, pulling in related data, correlating signals, determining severity, and initiating a response.
That is the direction the industry is heading, and there is real progress being made.
Most systems described as "agentic" today are not yet fully autonomous. They operate as structured workflows combined with model-driven reasoning, along with defined levels of automation and human oversight.
That is not a limitation so much as a reflection of where the market currently is. The shift toward more autonomous systems is happening, but it is incremental, and in many cases, that balance between automation and control is exactly what buyers want today.
Where the Real Value Actually Comes From
It is becoming clear that the model itself is not where most of the differentiation lives.
Saying that a product uses a specific model is quickly becoming table stakes. Many companies are using the same underlying models and the same infrastructure providers.
What separates one product from another is everything built around it.
The quality and accessibility of the data determine what the system can actually see. The design of the workflow determines how investigations happen in practice. Decision boundaries define what the system is allowed to do on its own and what requires human input. The user experience determines whether an analyst can trust the output and act on it quickly.
The system, not just the model, is the product.
What Buyers Should Be Looking For
For buyers evaluating these solutions, the most useful questions are often the simplest ones.
What decisions can the system make without a human involved? What data is it operating on, and what gaps exist? Where does it require escalation? How are actions validated and audited?
Clear answers to those questions are far more meaningful than any headline claim about being AI-powered or agentic.
A Pattern That Feels Familiar
This situation is not entirely new.
When I was working on SOAR, the category was still emerging and not well understood. I remember sitting in conversations with CISOs and SOC leaders where everything seemed to land. The discussion was thoughtful, the reactions were positive, and there were no obvious objections.
Later, we would find out that the core value had not actually come through.
When we dug into it, the issue was not the product. It was that the buyer did not have a clear understanding of what SOAR was in the first place. At industry events, people would ask directly what SOAR meant. That was not a fringe question. It was common.
The Lesson That Applies Directly to AI
It is easy to assume that buyers understand more than they actually do, especially when you are close to the technology.
When that baseline understanding is missing, everything else breaks down. Buyers cannot evaluate the product, they cannot see the differentiation, and in many cases, they choose to do nothing.
The people who already understand will move quickly through the basics. The people who do not will benefit from having that clarity established. Both groups are important.
Where the Opportunity Is
This is where strong product marketing becomes a real advantage.
The companies that stand out will take the time to create a clear baseline for their buyers. They will explain what these systems actually do in practical terms, define how they operate, and clearly articulate where they differ.
Without that foundation, differentiation does not land. With it, everything becomes easier to understand, evaluate, and trust.
AI is advancing quickly, and agent-based systems will continue to improve. Right now, the biggest gap in the market is not capability. It is clarity. And the companies that win will be the ones that close that gap.