AI is now at the center of almost every MDR conversation.

That’s not surprising. Security teams are under more pressure. Attackers are moving faster. Clients expect more. Providers are being pushed to improve outcomes while managing cost, scale, and speed.

The market is responding in the obvious way: more automation, more AI, more claims.

But I do not believe the future of MDR will be defined by who automates the most.

I believe it will be defined by who helps clients make the best decisions, with the clearest context, at the moments that matter most.

That’s why I see the next era of MDR as human-led and AI-powered: machine speed, guided by human judgment.

The broader market is moving in that direction, too. The World Economic Forum’s Global Cybersecurity Outlook 2026 makes clear that cyber risk is accelerating, driven by rapid advances in AI, deeper geopolitical fragmentation, and growing supply chain complexity. In that kind of environment, the market does not need more noise. It needs more clarity.

Speed matters. But speed alone is not the answer.

There is no question that speed matters in security.

The CrowdStrike 2026 Global Threat Report underlines just how fast attackers can move. Average eCrime breakout time has fallen to 29 minutes, down from 48 minutes just two years ago, while the fastest observed breakout took just 27 seconds.

The M-Trends 2026 Report points in the same direction. Attackers are moving quickly, targeting edge devices and network appliances early and using SaaS integrations to enable data theft and movement across cloud environments.

But speed on its own doesn’t solve the real problem.

If a security team gets alerts faster but still cannot see the business impact, understand the priority, or decide what to do next, speed simply creates faster confusion.

That is why I think the AI discussion in MDR needs to mature.

The real opportunity is not AI for speed alone. It’s AI that provides better reasoning and context, so human experts can make better decisions.

That is also the direction we’re taking at Kudelski Security. We are moving beyond the idea of simply “having AI.” Instead, we are focused on AI that understands risk, not just threats; AI that improves decision-making, not just speed; and MDR that delivers cyber resilience outcomes, not just SOC metrics.

Clients need more than automation. They need judgment they can trust.

This is where I believe the market is separating.

The question is no longer whether MDR providers use AI. Most will. Many already do.

The more important question is how they use it.

In our view, AI in MDR should not remove human judgment. It should strengthen it.

It should help analysts spend less time on repetitive work and more time applying judgment where it matters. It should bring clearer context to investigations, help teams learn from past incidents, and make reporting more consistent. Just as importantly, it should make the service easier for clients to understand and trust.

But when it comes to priority, escalation, business context, and response decisions, people still matter.

That isn’t a weakness in the model. It’s what makes the model stronger.

The NIST AI Risk Management Framework is useful here because it puts trustworthiness, transparency, and governance at the center of AI adoption. That matters in MDR because security decisions can have real consequences across both IT and OT environments. In that environment, black-box outputs are not enough. Clients need AI that is explainable, accountable, and grounded in real-world operations.

Human-led AI is not a slogan. It is an operating model.

At Kudelski Security, we believe AI has to be built into the service in a practical and responsible way.

That starts with a simple principle: AI accelerates. Humans decide.

You can see that in the design choices we are making. Our AI philosophy is built around three ideas: human-on-the-loop, explainability-first, and security-native design. We believe AI should recommend and draft, while people decide and approve. We believe every AI output should come with reasoning, not just results. And we believe it should be built by security practitioners and validated in live SOC environments, and never trained on client data.

That is also why we do not see AI as a bolt-on feature. We see it as a connected layer across MDR and a foundation for what comes next.

The KLARA™ (Kudelski Learning and AI Reasoning Agents) agentic AI ecosystem is built around that idea, supporting analysts and clients across investigation, response, and reporting, with explainability throughout. The goal is not to make AI visible for its own sake. It is to make MDR faster, more consistent, easier to understand, and ultimately more effective at building cyber resilience.

Recently, one of our KLARA AI agents flagged a credential anomaly within minutes. The fastest response would have been to lock the account. But our analyst, with the wider client context in view, recognized that the activity was linked to a planned third-party integration rolled out that morning.

The decision was not simply faster. It was right.

That is human-led AI in practice: KLARA surfaced the signal at machine speed, while a person provided the judgment that protected the client’s operations.

In OT, human judgment isn't optional. It's a safety control.

Nowhere is that more important than in operational technology. On the plant floor, an automated response can have consequences far beyond the security team. Isolating a controller, terminating a session, or locking an account could interrupt production or, in the wrong circumstances, affect a critical safeguard.

In IT, an automated account lock may be an inconvenience. In OT, the same action can create real safety and availability risks.

That is why our unified IT and OT defense combines passive OT/CPS monitoring with human analysts who understand the wider process context before containment decisions are made.

Where the stakes are this high, agentic AI without human judgment can become a liability. It is one of the clearest examples of why the next era of MDR has to remain human-led.

Better AI should lead to a better client experience

This point matters just as much outside the SOC as it does inside it.

Clients do not want a stream of technical outputs that they have to decode on their own. They want to know what happened, why it matters, and what should happen next.

That’s where well-designed AI combined with human expertise can make a real difference.

AI can turn raw telemetry into plain-language context and surface similar past incidents, so teams do not have to start from zero every time. It can get investigations moving sooner, help create clearer and more consistent incident summaries, and make it easier for clients to ask questions about alerts, incidents, posture, and outcomes in natural language.

These are not small improvements. They go to the heart of what clients want from MDR now.

They want speed, yes. But they also want confidence. They want transparency. They want consistency. They want to know the service is helping them reduce risk in a way that is clear, defensible, and backed by a partner they trust.

That is why the next stage of MDR must be measured by more than just alert volume, resolution time, or other familiar SOC metrics. It also has to be measured by the quality of decisions, the quality of communication, and the resilience outcomes the service helps create. That is a core part of our MDR direction.

It’s Time to Rethink MDR SLAs

This shift should also change how MDR performance is measured.

For years, many MDR SLAs have focused on activity: how quickly an alert is acknowledged, how many tickets are triaged, or how fast a provider responds. Those measures still have value, but they only tell part of the story.

At a time when average eCrime breakout time has fallen to just 29 minutes, clients need to know more than how quickly an alert was opened. They need to know how quickly a genuine threat can be understood, contained, and resolved.

I believe that means SLAs need to evolve from measuring activity alone toward measuring outcomes, including time to containment, time to eradication, and validated recovery.

AI can help shorten investigation time, but that makes the quality of the response even more important. The goal is not simply to acknowledge an alert faster. It is to reduce the time between identifying a real threat and taking the right action.

As MDR evolves, the way we measure its value has to evolve with it. Ultimately, clients will judge providers not by how much activity they generate, but by the outcomes they help deliver.

The next winners in MDR will be the most useful, not the loudest

There will be a lot of AI claims in this market. Some will be credible. Some will not.

But over time, I believe the winners will be the providers that use AI to make MDR more useful to clients.

That means better prioritization, not just more automation.

Better context, not just more data.

Better reporting, not just faster output.

Better support for analysts, not the illusion that analysts no longer matter.

And better business outcomes, not just better dashboards.

This is the direction we believe in at Kudelski Security.

We see AI as a major part of the future of MDR. But we also believe that future has to be shaped with care. It has to be explainable. It has to be accountable. And it has to keep human judgment where human judgment matters most.

That is how you build trust.

That is how you improve outcomes.

And that is why I believe the next era of MDR will be human-led and AI-powered.

At Kudelski Security, this is the future we are building toward: MDR that combines machine speed with human judgment to improve clarity, consistency, and decision-making.

With our unified approach across IT and OT, and the KLARA agentic AI ecosystem, that future is now taking shape inside our own MDR service.

In the weeks ahead, we’ll go deeper into what this means for clients, from unified IT and OT defense to Managed Risk & Exposure (MRX), and how bringing exposure reduction, detection, and response together can help reduce risk over time.

‍