When enterprises are asked where they are actually deploying agents and AI, one function leads. Futurum Group’s 1H 2026 survey of IT decision-makers places cybersecurity first, at 58.7%. Sales, marketing and service follow at 51.3%, and supply chain at 47.8%. The order matters less than the reason behind it.
Security is not the obvious first candidate. It is high-stakes, closely scrutinised, and unforgiving of error. If the question were which function has the most tolerance for experimentation, security would rank near the bottom. Yet it leads. That suggests the enterprises deploying agents are not choosing the safest place to experiment. They are choosing the place where the work was already shaped in a way agents can do well.
That is the lesson worth drawing out. The properties that made security operations ready for agents are not unique to security. They can be found — or built — in finance, service, supply chain, and compliance. Functions that want to deploy agents successfully can use security’s head start as a readiness checklist.
This blog is for transformation, operations, and function leaders deciding where agents should go next and what has to be true before they do.
Why Security Went First
Security operations arrived at the agent era with five properties already in place, largely because the discipline was forced to develop them long before agents existed.
The work arrives at high volume. Security teams face a continuous stream of alerts, events, and signals — far more than people can triage by hand. Volume creates both the need for automation and the data from which automation can learn and be measured.
The work runs on written playbooks. Security operations has long documented its response procedures: when this kind of alert fires, gather this context, check these sources, take these actions, escalate under these conditions. A playbook is, in effect, a specification for an agent. The function did the hard work of making its process explicit years ago.
The outcomes are measurable. Time to detect, time to respond, false-positive rates, alerts closed, incidents escalated — security has an established vocabulary for performance. An agent’s contribution can be measured against a baseline the function already tracks.
Human-in-the-loop is the culture. Security analysts are used to tiered response, where routine work is handled at the first tier and significant decisions escalate to senior staff. Agents fit naturally into that structure as a new first tier, with humans keeping authority over consequential actions.
The telemetry already exists. Security operations runs on logs, events, and structured records. The data an agent needs to reason about a case, and the data needed to audit what the agent did, are already collected and retained.
The Five Readiness Tests For Every Other Function
The first test is volume. Does the function face a recurring stream of similar work items — invoices, tickets, claims, orders, enquiries — large enough that handling them consistently is a real constraint? Agents produce their clearest returns where volume is high and work items resemble one another.
The second test is the playbook. Is the way the work should be done written down, specifically enough that a new colleague could follow it? If the process lives only in experienced people’s heads, the first step is not deploying an agent; it is writing the playbook. That work pays off on its own, and it becomes the agent’s specification.
The third test is measurement. Does the function have a baseline — cycle time, accuracy, cost per case, customer satisfaction — against which an agent’s contribution can be compared? Without a baseline, an agent’s value is a matter of opinion, and opinion does not survive a budget review.
The fourth test is the escalation structure. Is there a clear line between routine decisions and consequential ones, with named people who own the consequential ones? Agents work best when they have a well-defined first tier to operate in and a well-defined path upward.
The fifth test is telemetry. Is the data the agent needs available in structured, accessible form, and will the agent’s own actions be recorded in a way that supports review? Functions that still run on unstructured email chains and scanned documents need a data foundation — extraction, structuring, and logging — before they can match security’s readiness.
What Security Teaches About Scope
Security’s lead also says something about scope. The successful deployments in security operations are not general-purpose assistants. They are agents bound to specific playbooks — triage this class of alert, enrich this type of event, draft this kind of report. Narrow scope makes agents measurable, governable, and trustworthy, and it lets the human team build confidence step by step.
The same holds elsewhere. An accounts payable team does not need an agent that “does finance”. It needs an agent that extracts and validates supplier invoices, flags exceptions against purchase orders, and routes the exceptions to the right reviewer. Scope defined by a playbook is scope that can be measured and expanded with evidence.
The Gulf Industry View
For Gulf enterprises, the function that most closely matches security’s readiness profile in the coming year may be finance and tax operations. The UAE’s e-invoicing programme requires businesses above AED 50 million in revenue to begin mandatory e-invoicing from January 1, 2027, and Saudi Arabia’s ZATCA Wave 25 brings taxpayers above SAR 187,500 into Fatoora integration by February 1, 2027. These programmes impose exactly the properties security already had: structured data, defined validation rules, measurable compliance, clear escalation for exceptions, and a mandatory audit trail.
In other words, e-invoicing compliance is building a security-style foundation inside finance. Enterprises that treat the mandate as a readiness programme, not only a filing obligation, will find their finance operations prepared for agents in the same way security operations was.
What Inspires Us At Lynt-X Global
At Lynt-X Global, what inspires us about Futurum Group’s finding is not the ranking itself but what it reveals: agents succeed where the work has been made explicit. Security teams did years of patient groundwork — writing playbooks, defining tiers, instrumenting everything — and that groundwork is now paying a dividend nobody planned for. It is an optimistic lesson, because every function can do the same groundwork, starting today.
We are also encouraged by how naturally agents fit security’s tiered culture. Analysts keep authority over consequential decisions while agents take on the repetitive first pass, giving skilled people more time for the investigations that genuinely need their judgement. That is the model of human-agent collaboration we hope to see spread across the enterprise.
For the Gulf, the next function to follow security may well be finance. E-invoicing mandates in the UAE and Saudi Arabia are building structured data, validation rules, and audit trails into finance operations — the same foundations that put security first.
Looking ahead, we are watching which function claims second place in the next round of surveys, how quickly playbook-writing becomes a recognised discipline outside security, and whether outcome baselines start to appear in agent business cases from day one.
The Research Read
Futurum Group’s 1H 2026 data shows cybersecurity leading agent and AI deployment at 58.7%, ahead of sales, marketing and service at 51.3% and supply chain at 47.8%. Security went first not because it tolerates risk, but because its work was already shaped for agents: high volume, written playbooks, measurable outcomes, a human-in-the-loop culture, and existing telemetry.
Those five properties are a readiness test for every other function. Functions that pass it can deploy agents with confidence. Functions that do not should start by writing the playbook, setting the baseline, defining escalation, and structuring the data. The reason security went first is the lesson for everyone else.
“Security operations did not lead agent deployment because it was the safest place to experiment. It led because its work already had what agents need — volume, written playbooks, measurable outcomes, tiered human oversight, and telemetry. Every other function can build the same foundation, and the ones that do will be ready for agents next.”