Morgan Stanley: AI speeds up security investigations, but cybersecurity vendors still have opportunities

Why do security operations need faster investigations?

The time between a vulnerability being discovered and exploited is shrinking. Devon Rollins, Morgan Stanley’s head of security response and AI security, noted that attackers can replicate successful techniques across thousands of organizations, while defenders have historically found it harder to share experience at scale.
AI can accelerate evidence gathering and pattern recognition, and investigate multiple possible explanations for an incident at the same time. Defenders also want to share behavioral intelligence and detection content that people and machines can use, allowing organizations with different security systems to learn from one another.
Morgan Stanley’s research team believes security operations automation products that can narrow the information gap between attackers and defenders have a chance of being adopted, but competition in this market is intense.

As response times shorten, companies still need to maintain an understanding of their assets, which are exposed and how permissions are allocated, and ensure they can isolate and recover after an incident.
The principle of least privilege is extending to workloads and agents; vulnerability prioritization must also account for their connections to critical systems. For long-established companies carrying technical debt, fixing every threat is unrealistic, making preauthorized isolation measures especially important.

The current approach combines in-house development and purchasing: vendors provide sensors, models and capabilities to enforce controls, while internal teams connect the tools to their own data, asset relationships and decision-making processes.
AI coding tools have accelerated internal development, but Rollins emphasized the distinctive value of a company’s own knowledge. Morgan Stanley’s research team therefore believes in-house development is currently more likely to complement purchases. Although open-weight models provide greater control, they also leave companies responsible for security, evaluation, deployment and maintenance.

Security information and event management systems (SIEM) remain valuable: they combine organized security data with identity, behavioral, threat and asset context to help make decisions faster. But if the data is noisy, incomplete or untrustworthy, AI may also reach incorrect conclusions faster.
Security orchestration, automation and response tools (SOAR) remain suited to repetitive processes with clear rules; AI-led automation serves other tasks. The value of additional data depends on the insights it can generate, not the volume collected itself.
Vendor selection also depends on interface quality and agent governance: where evidence comes from, what permissions agents have, and whether actions can be stopped or reversed. Morgan Stanley believes platforms that can extract insights from data benefit from these needs.

Rollins said teams are increasingly willing to let AI conduct substantive investigations and recommend next steps, thanks to improvements in the context, evaluation and access controls surrounding models. Actions with clear boundaries are easier to automate; humans still make and are accountable for decisions in ambiguous situations or where consequences are significant.
He believes leaner tool portfolios and measurable operational efficiencies may emerge over the long term, but those benefits are still prospective. Morgan Stanley’s research team is optimistic about cybersecurity software spending while raising a key question: after the total number of tools falls, can efficiency gains translate into greater customer purchasing commitments to vendors?