Why reskill · the receipts
Go and check it yourself
The argument next door rests on two things a reader is entitled to verify: what the people paying for this say they are worried about, and what vendors have actually put into production. Both are below, with their sources.
Nothing on this page is our measurement. The survey is cited under its own figures; every product row carries the vendor page it came from.
What the buyers say
The worry is already in the room
Security and risk lead the concern list, and readiness sits right behind them. The second one is the reskilling problem, named by the people who would have to pay for it.
What 1,528 leaders fear most
Base: 1,528 AI decision-makers who have concerns about AI usage. Source: Forrester's State of AI Survey, 2025.
What the vendors shipped
Every product, with the page that proves it
Every dot below is a task that used to belong to a person, inside a product you can buy today.
Every dot, with what it absorbs and where to check it
GitLab
Duo Security Analyst Agent
Generally availableTriaging vulnerability findings across scan types, and judging severity and exploitability.
Beta in GitLab 18.5, generally available in 18.8 · Ultimate, with the Duo add-on
Our read: Augmented · Source ↗
Agentic SAST Vulnerability Resolution
Generally availableWriting the fix. It reasons through the surrounding code and opens the merge request itself.
Beta in GitLab 18.9, generally available in 18.11 · Ultimate
Our read: Augmented · Source ↗
CrowdStrike
Charlotte AI Detection Triage
Generally availableSeparating true positives from false ones across the detection queue.
13 February 2025 · The Falcon platform
Our read: Augmented · Source ↗
Microsoft
Phishing Triage Agent, in Defender
Generally availableReading every user-reported phishing mail, classifying it, and closing the false alarms.
Documentation current at 15 June 2026 · Security Copilot compute units, plus Defender for Office 365 Plan 2
Our read: Augmented · Source ↗
Security Alert Triage Agent
PreviewThe same agent, widened to a subset of identity and cloud alerts.
Documentation current at 15 June 2026 · Security Copilot compute units
Our read: Augmented · Source ↗
Palo Alto Networks
Cortex AgentiX, Case Investigation Agent
Generally availableEstablishing case context and reading the complex data points that start an investigation.
Platform announced October 2025 · Cortex Cloud and Cortex XSIAM
Our read: Assisted · Source ↗
Cortex AgentiX, Automation Engineer Agent
Generally availableBuilding the automation. A prompt in plain language becomes the script a playbook runs.
Platform announced October 2025 · Cortex Cloud and Cortex XSIAM
Our read: Augmented · Source ↗
Cisco
Malware Threat Reversing Agent
Generally availableMalware analysis and reverse engineering, which is the deepest specialist work in the room.
Announced 23 March 2026 · The Cisco and Splunk security platform
Our read: Augmented · Source ↗
Triage Agent
AnnouncedPrioritising threats and triaging the queue.
Announced 23 March 2026, expected June 2026 · The Cisco and Splunk security platform
Our read: Augmented · Source ↗
SOP Agent
AnnouncedRunning the standard operating procedure that a junior analyst is handed on day one.
Announced 23 March 2026, expected April to May 2026 · The Cisco and Splunk security platform
Our read: Augmented · Source ↗
Detection Builder Agent
AnnouncedDetection engineering: planning and writing the detections themselves.
Announced 23 March 2026, prerelease targeted June 2026 · The Cisco and Splunk security platform
Our read: Augmented · Source ↗
Cursor
Bugbot
Generally availableReviewing every pull request for logic bugs and security flaws, and proposing the fix.
Usage-based billing announced May 2026 · Cursor Teams and Individual, billed per run
Our read: Augmented · Source ↗
The autonomy column is ours, not theirs. It places each product on our own ladder; no vendor has used these words.
Not one of these is a research preview from a lab. They ship inside commercial platforms, on ordinary release notes, to customers who already had the licence.