Alert noise and false positives are the leading challenge for enterprise threat-intelligence teams, cited by 65 percent of respondents in a new Flashpoint report examining security planning for 2027.

The company found that 55 percent of respondents reported insufficient analyst bandwidth and 50 percent pointed to gaps between security tools. Half expect their threat-intelligence budgets to increase during the next 12 months, while 40 percent expect spending to remain roughly flat. None of the participants predicted a decrease.

AI is increasing pressure on both sides of the security operation. Deepfakes, AI-accelerated exploitation and new AI-enabled attack methods were the top priorities for expanded coverage. At the same time, 25 percent of organizations said they were using agentic AI in production for threat intelligence and another 20 percent were piloting it.

The findings come from independent qualitative buyer research commissioned by Flashpoint, so they are useful as a market signal rather than a population-wide measurement. The operational message is clearer: automation will not fix an intelligence program if it only produces more alerts. Teams need evidence that an agent can reduce repetitive work, integrate with existing systems and keep consequential decisions under human review.