Security marketing has a long habit of selling fear and a longer one of selling a new acronym alongside it. John Vecchi's account of his industry is that for every new attack and every new threat, buyers have been told they need a new product, a new console, a new tagline, or a new category. He runs marketing at Mitiga, which makes the industry he is describing his own.
He describes a narrower thing he wants customers to feel. An attacker will inevitably get in. What is worth paying for is the confidence that something is already in place to detect it, disrupt it, stop it, and take the impact to zero before the business feels it.
The language changed because the ground did. Attacks are not mainly about malware on an endpoint any more. They run through cloud, SaaS, identity, third-party services, and AI, and the industry’s vocabulary has stopped matching where the damage happens. Agentic Runtime Security and Zero-Impact Breach Prevention are attempts to describe the real situation.
Then there's the part a buyer can use tomorrow. When a vendor claims its product is AI-powered, he asks three questions.
"Show me the investigation. Show me what work it replaces. Show me what services and infrastructure it protects."
All of them are underpinned by a fourth question: what data is powering the AI, because an agent is only as good as the data underneath it. That data has to be contextualized, normalized and correlated before anyone asks it anything, which is the part most AI security claims will skip.
