Been going back and forth on this for a while. The UEBA side of things has genuinely improved, behavioral baselines and dynamic risk scoring are meaningfully better than pure rules-based alerting, and the triage time reduction is real. False positive rates are down significantly on the platforms worth using. But every time I push a vendor on what happens after the alert, the story gets thin fast. No auto-containment, no clean integration with existing response workflows. Just a better alert sitting in a queue. The thing that keeps nagging me is the governance overhead. You get better signal but now you need cross-functional buy-in from HR and legal just, to act on it, and most orgs I talk to still aren't set up for that. Detection improves, response pipeline stays a mess. That gap doesn't close just because the model got smarter. The "AI countering AI" angle is also starting to feel less theoretical. Insiders using LLMs for low-noise obfuscation, subtle session abuse, behavior that stays just inside the baseline, is a real pattern now. Agentic AI makes the attack chains faster and harder to fingerprint. I'm not convinced most platforms have caught up to that yet, and the vendors who claim they have usually can't show me the evidence. Curious if anyone's actually seen the prevention side mature, or if it's still mostly a detection layer you bolt onto a response process that was already broken.