Trend Micro (TMICY) Vision One AI Cuts Threat Hunting to Seconds

Trend Micro Incorporated (TMICY) said on its 2026-08-13 earnings call that the AI in Trend Vision One has cut customer environment simulation from months to days and threat hunting from hours to seconds, and that 45% of its existing customers are now attached to the platform. Revenue is still reported for the platform as a whole [1].

What Trend Vision One is

Trend Micro is an enterprise cybersecurity company headquartered in Tokyo. Its products cover endpoints, servers, cloud workloads and network traffic, and its revenue comes mainly from subscription-billed software and cloud services sold through distributors and managed service providers to enterprises and governments.

Trend Vision One is the company's cloud security operations platform for enterprise security teams. Customers turn on different modules under a single license. The platform continuously collects operating data from the customer's PCs, servers and network, uses AI to build a model that mirrors the real environment, then simulates attacks against that model, hunts intrusions that are already under way, and tells the security staff which vulnerabilities to fix first and how. This sits in the company's core business: in the prior period, management disclosed that Vision One platform sales accounted for roughly 38% of total revenue [2].

How the public account changed in six months

On the 2026-02-21 call, the story was capability plus commercial traction. Management described a digital twin of the customer environment, a specially trained cybersecurity language model and agentic AI that together help customers make better security decisions. The evidence it could point to was mostly that the platform was selling: 11,500 existing customers using it and net retention of 130%. Helping customers automate security work and save staff effort was still framed as something that would come later [2].

The 2026-08-13 call moved the implementation one step further. Part of the judgment now runs on small models deployed locally at the customer, with a routing layer on top that hands harder problems to larger models. On that call the company also, for the first time, described this application's output as delivery time that has already happened rather than as a future capability [1].

The two new readings are about time

Both new figures measure elapsed time. Building an environment simulation a customer can use for tabletop exercises now takes days instead of months. Threat hunting, the step security teams care most about, has been compressed to seconds [1]. That places the AI in two real steps of the work: delivery and investigation.

Both readings are directional comparisons only. The company did not give exact before-and-after durations, how many simulations have been run, or how many alerts have been handled, and it did not say how many customers are using these capabilities. Management also stated that customer counts for these newer services are still small today [1].

From function to revenue

The path from the feature to the income statement is straightforward. Vision One is billed by subscription, so customers turn on an extra module or expand usage at renewal, and the money shows up in two numbers: Vision One annual recurring revenue (ARR) and its share of total company revenue.

For the most recent period, the company disclosed ARR growth of 49% year over year, 45% of existing customers attached to Vision One, and net retention revenue of 122% [1]. All three are whole-platform measures. They include modules that have nothing to do with AI, as well as channel expansion and pricing. The company has never broken out how much revenue environment simulation, threat hunting or agentic AI each contributes.

Net retention was disclosed at 130% in the prior period [2] and 122% in this one, but the company did not state the measurement window or basis for the metric, so the two readings should not simply be subtracted from one another. Cloud and AI unit cost also moved back up in the same period. What the evidence supports is that the AI upgrade and the revenue growth are moving in the same direction; it does not support saying the growth was produced by AI.

What is confirmed and what is not

The operating change that can be confirmed today is that AI changed how fast Vision One delivers environment simulation and works through threat investigation, while platform subscription revenue is still expanding at close to a 50% annual rate.

What has not been quantified separately is what these new capabilities are worth on their own. The company has not disclosed paying customer counts for environment simulation, threat hunting or agentic AI, or the ARR each of them contributes. Until it does, this upgrade can only be read as high growth being sustained, not as measurable incremental revenue.

Application assessment

• Trend Vision One AI Security Operations | Business position: core business | Adoption stage: limited production | Scope: single business unit | Value type: revenue gain

Sources

[1] Drillr - Trend Micro Incorporated (TMICY) - 2026-08-13 - earnings call

"Vision One ARR, YOY Growth, 49%, continuing with seeing customers getting on to use more of those modules and the net retention revenue is 122%."

[2] Drillr - Trend Micro Incorporated (TMICY) - 2026-02-21 - earnings call

"And then we use our specialized cybersecurity intelligence to create the Cybertron asset or -- and specialized language model. Together with the agentic AI, we can help customers make the best cybersecurity decision and going forward, can also help them automate and save their efforts on their cybersecurity practice."