Gartner’s secure AI Hype Cycle predicts twice the incidents without preproduction offensive GenAI testing

Gartner’s secure AI Hype Cycle predicts that enterprises skipping preproduction offensive testing of generative AI deployments will face twice as many cybersecurity incidents by 2028 as proactive users. That is a forecast, not a measured outcome.

Funding is already a constraint. Among organizations piloting or implementing offensive AI security technologies, 50% have either not secured funding or diverted money from existing cybersecurity initiatives. This finding describes surveyed adopters, not half of all enterprises.

Meanwhile, my count of the complete Priority Matrix puts 23 of 24 technologies at least two years from mainstream adoption. Security teams therefore need to control deployed agents before most specialist markets mature. The immediate questions are what each agent can do, which controls enforce its limits and what a new product would add.

Gartner’s Hype Cycle for Secure AI, 2026 (G00846820), published October 12, 2026, separates controls for employee AI use, enterprise-built applications and agents acting across systems. Those distinctions make it useful for testing a security architecture, not simply compiling a vendor shortlist.

How to read Gartner’s secure AI Hype Cycle

Gartner places AI runtime defense near the peak of inflated expectations, while AI security testing and agent identity remain on the rising side of the curve. Threat modeling automation sits much farther along, near the transition out of the trough. These positions describe the development of market expectations. They are not comparative scores for attack prevention, product quality or investment returns.

A security architecture has to combine controls from different parts of the curve. A team can use established threat-modeling practices to identify a dangerous workflow while evaluating less mature identity or runtime products to enforce its boundaries. Waiting for every component to reach the plateau would confuse the maturity of the supplier market with the enterprise’s responsibility to control a deployed system.

• The distance between two dots is not a measurable security advantage. The graphic supplies no numerical scale of effectiveness or precise calendar spacing. Its adoption markers and the accompanying Priority Matrix are more useful for procurement planning than the apparent horizontal distance between categories.
• Mature controls and emerging controls are complements, not substitutes. Threat modeling identifies which actions should be forbidden. Identity establishes who is acting, and enforcement must stop the forbidden action before it changes a record or exposes data. A mature planning process cannot compensate for an unenforced permission boundary.
• The investment case starts with the missing control, not the most prominent dot. Ask which failure the current stack cannot prevent or detect, what evidence would demonstrate improvement and who will operate the additional control. That creates a testable buying decision rather than a maturity-themed shopping list.

What the data changes for security leaders

• The next permission grant matters more than the next product announcement. An agent with a narrow task can still reach sensitive systems through its credentials and connectors. Evaluate the actions it can execute before expanding its autonomy.
• Budget pressure makes integration part of the security decision. A specialist tool needs to demonstrate a protection gap it closes, the evidence it produces and the work required to operate it. Buying overlapping discovery features leaves less funding for enforcement and response.
• A long adoption horizon does not justify postponing a control. Gartner’s maturity estimates describe technology markets. Enterprises still own the decision to release applications that can retrieve sensitive data, invoke tools or change business records.

Separate forecasts from survey evidence

Forecasts, survey responses and market-spending estimates answer different questions. Keeping their populations and periods separate prevents an adoption statistic from becoming a claim about measured protection.

Gartner’s 2026 Surviving the Agentic AI Era survey included 251 cybersecurity leaders and direct reports. The two funding measures combine respondents without secured funding and those redirecting existing budgets, and the report does not disclose those subgroup sample sizes.

• The two forecasts are not observed survey outcomes. The 2× figure concerns incident frequency, while the 4× figure concerns aggregate enterprise cost. Neither establishes the risk per deployed agent.
• Funding percentages cannot be converted into respondent counts. Multiplying 50% or 47% by 251 would apply the full sample to narrower, undisclosed subgroups. Adding the percentages would also ignore potential overlap.

Gartner does not disclose the funding subsamples needed to test whether 50% and 47% differ meaningfully. Treat both as evidence of implementation friction, rather than ranking one technology as better funded than the other.

The incident forecast cannot price a security investment

Gartner’s two-times forecast does not supply the baseline incident count, the distribution of incident severity or a controlled estimate of a specific product’s effectiveness. It would be a mistake to translate it directly into a promise that buying a testing tool cuts an enterprise’s losses in half. Testing identifies weaknesses. Risk falls only when the organization fixes the relevant weakness, restricts the exposed action or declines to deploy it.

The four-times forecast has another boundary. Aggregate cost can be larger because more task-driven agents are deployed, because their incidents are more expensive or because both are true. Without deployment counts and comparable loss distributions, the forecast cannot establish that an individual task-driven agent is four times as dangerous as an individual multiagent system. Its practical message is to include ordinary deployed agents in the review, rather than reserve the security program for more complex architectures.

The nearer-term risk is the agent already doing a job

Through 2027, Gartner predicts that enterprise costs from task-driven AI agent abuses will be at least four times those from multiagent systems. That forecast argues against building the entire security program around the most elaborate autonomous architecture while overlooking a single agent with access to files, credentials or business applications.

Gartner’s agent-identity analysis identifies employee credential sharing as a direct threat to auditability and traceability. A workflow that authenticates successfully can still leave the organization unable to distinguish the employee’s action from the agent’s. Gartner recommends unique agent identities, scoped access and short-lived credentials rather than reused human accounts.

Coworking agents create another permission problem. Gartner describes agents with local access that can read or delete files, use authenticated browser sessions, execute shell commands and install packages. Skills and plug-ins extend that access, adding another set of components whose instructions and permissions need review.

A useful review starts with one deployed agent, its accountable human owner and every action it can take. The team should be able to identify the credential behind each action, the resource it permits and the mechanism that blocks an action outside the task. A model’s answer quality does not establish those boundaries. My analysis of Gartner’s 2026 cybersecurity trends provides the broader agent-oversight context.

One legitimate connection can carry an unauthorized instruction

Consider a hypothetical support agent that reads customer tickets, retrieves account records and drafts replies. A malicious instruction embedded in a ticket asks it to send account data to an external destination. Authentication alone does not answer whether that destination is allowed, whether the retrieved records belong to the current customer or whether the task permits sending any data at all. This is an illustrative threat scenario, not an incident reported by Gartner.

Enforcement has to preserve those distinctions across the workflow. Record-level authorization restricts what the agent can retrieve. Tool policy limits where it can send information, while an approval requirement can interrupt a consequential action before execution. Runtime inspection supplies another opportunity to identify manipulation, but it should not be the only barrier between an untrusted instruction and a broadly privileged tool.

• A unique agent identity creates accountability without automatically creating least privilege. A named agent can still hold excessive permissions. Review the task, resource, action and credential lifetime together.
• A human approval is only useful when it exposes the consequential action. A generic confirmation of the overall task does not demonstrate approval of a particular destination, record change or command. Test what the approver sees and whether execution stays within that approved scope.
• A safe answer can conceal an unsafe execution path. The final response can look ordinary after a tool has already copied data or changed a record. A test should inspect the action trace and resulting state, not grade only the text returned to the user.

Buying AI for security is different from securing AI

Gartner’s separate 3Q26 AI Spending Forecast puts 2026 spending on AI-amplified security at $48.512 billion, compared with $2.835 billion on securing AI. The first category concerns using AI in cybersecurity capabilities. The second concerns protecting AI systems.

Dividing those forecast categories gives a ratio of about 17.1 to one. That calculation describes markets, not the budget split at an individual enterprise. An AI-enabled security product purchase does not, by itself, demonstrate that the buyer has secured an agent’s identity, tools or data access. The distinction also frames my earlier AI-amplified security market analysis.

By 2030, Gartner forecasts $204.451 billion for AI-amplified security and $16.440 billion for securing AI. The securing-AI category grows quickly, but aggregate spending cannot show whether a particular enterprise has funded its preproduction tests or runtime controls.

Annual security spending through 2030

Spending values come from Gartner’s 3Q26 forecast workbook. Ratios and the following growth calculations are my arithmetic, using the displayed source values rather than a separate Gartner forecast.

The smaller market gains share but not spending leadership

These shares cover only the two Gartner categories shown, not all cybersecurity spending. Their combined forecast rises from $51.347 billion in 2026 to $220.891 billion in 2030, an increase of $169.544 billion in annual spending.

• Securing AI grows faster from a much smaller base. Its projected 2026–2030 compound annual growth rate is 55.2%, compared with 43.3% for AI-amplified security. The ratio narrows even though both markets expand.
• The larger category still captures far more incremental spending. AI-amplified security adds about $155.9 billion in annual market spending between 2026 and 2030, compared with $13.6 billion for securing AI. Faster percentage growth does not mean the smaller category becomes larger.
• These figures cannot produce a recommended enterprise budget split. Market spending says nothing about a particular company’s agent count, data sensitivity, existing protections or loss exposure. A company deploying agents with payment or production privileges needs a different control design from one limiting AI to document drafting.

Relative growth and absolute spending

• The smaller market’s relative gain does not close the absolute gap. Securing AI’s share of the two categories rises by about 1.9 percentage points, yet the dollar difference widens from $45.677 billion in 2026 to $188.011 billion in 2030. Both statements can be true because the larger category keeps adding more dollars.
• Growth decelerates even while spending multiplies. Securing AI’s annual growth falls from 83.0% in 2026 to 42.1% in 2030. The investment case depends on a rapidly expanding market, not an assumption that near-doubling continues indefinitely.

Where the incremental security spending goes

Software Strategies Blog AI security projections through 2033

The following 2031–2033 values are Software Strategies Blog projections, with analysis by Louis Columbus, not Gartner forecasts. I extend each category using its 2026–2030 compound growth rate and, separately, its slower 2029–2030 growth rate. The purpose is to show the sensitivity of the market outlook to continued growth, not to estimate how much an enterprise should spend.

How I calculated the security projections

I calculate compound annual growth as (ending value / starting value) raised to 1/n, minus one, where n is the number of annual intervals. The 2025–2030 calculation has five intervals, while 2026–2030 has four. These are growth rates calculated from Gartner’s forecast series, not realized investment returns or measured historical revenue growth.

For each projection, I multiply the 2030 source value by (1 + the selected annual rate) for each year after 2030. I use the supplied CSV values at their published precision and retain the full calculated growth rate before rounding the displayed result. A separate check against the workbook’s additional decimal places leaves every displayed CAGR and projection unchanged. All amounts remain annual market spending on the source’s current-US-dollar basis, without a separate inflation or exchange-rate model.

Annual Software Strategies Blog security projections

Gartner’s Forecast: AI Spending, Worldwide, 2025–2030, 3Q26 (G00862061), October 7, 2026, supplies the source base. I calculated the growth rates and all post-2030 values, labeled SSB projections in the table.

What the two security scenarios imply

My securing-AI projection reaches $61.4 billion in 2033 when the 55.2% forecast CAGR continues, versus $47.2 billion when only the 42.1% final-year growth rate continues. AI-amplified security reaches $601.4 billion or $422.8 billion under the corresponding 43.3% and 27.4% assumptions. The difference between each pair comes entirely from the selected compounding rate.

• The larger category remains larger under both cases. Comparing like scenarios, AI-amplified security is about 9.8 times securing AI in the CAGR case and 9.0 times in the final-year case by 2033. The smaller category gains relative ground without overtaking it.
• A slower scenario can produce faster relative convergence. In the final-year case, AI-amplified security slows more sharply than securing AI relative to its longer forecast CAGR. The resulting ratio narrows further even though both markets end at lower dollar levels.
• Market projections cannot extend the incident forecast. These dollar paths do not estimate future attacks, control efficacy or the adoption date of any Hype Cycle technology. Gartner’s two-times incident prediction and its maturity bands remain separate evidence.

Both cases assume uninterrupted positive growth and are not confidence bounds. Product consolidation, embedded controls, price changes or a change in category definitions could make the actual market diverge from either path. I would revise the projection when a new forecast changes the source base rather than splice a new endpoint into the old growth rate.

Market growth is not evidence of enterprise protection

Only about 8.0% of the combined increase in these two annual spending categories goes to securing AI, calculated as $13.605 billion divided by $169.544 billion. The forecast therefore supports two different commercial readings. Specialists protecting AI have a rapidly growing addressable category, while vendors applying AI to existing security functions compete for a much larger incremental pool.

Neither reading establishes an enterprise protection deficit in dollars. A market forecast cannot show how much existing identity, endpoint or application-security spending already protects AI workloads. My 2Q26 security forecast analysis examines where securing AI sits within the broader spending categories. The useful buyer question is whether the current stack enforces the required behavior. Purchasing a product classified as AI-amplified security is not proof of that coverage, but neither does its classification prove that it provides none.

The Hype Cycle survey captures that implementation problem more directly. In addition to the 50% offensive-security funding result, 47% of organizations piloting or implementing AI runtime defense have either not secured funding or shifted budget from existing cybersecurity work. The report also says 50% of surveyed CISOs are uncertain about specialized controls’ long-term costs, while 43% consider them too expensive relative to perceived value.

Those findings make the procurement question specific. Before approving a new AI security platform, identify which agent behavior it will stop, which existing control cannot stop it and which team will operate it. A product that duplicates discovery without enforcing permissions has to justify the additional cost.

The funding and cost comparisons

The survey does not rank which control is hardest to fund

Offensive AI security’s 50% combined funding-tradeoff figure is three percentage points above runtime defense’s 47%. The report does not give the subgroup sizes or respondent overlap needed to determine whether that difference is meaningful. Multiplying either percentage by all 251 survey respondents would manufacture a headcount for a subgroup whose size is not disclosed.

Cost uncertainty and price objections also describe different questions. A respondent can be uncertain about lifetime cost and still consider the proposed price too high. Adding 50% and 43% would therefore not establish how many distinct CISOs have a concern, and neither percentage estimates the proportion of enterprise AI systems left unprotected.

• Separate missing funding from redirected funding in an internal review. Gartner combines the two in the reported percentages. Within a company, they imply different decisions. An unfunded control requires a financing decision, while redirected funding requires an explicit assessment of the protection being displaced.
• Ask for implementation cost before arguing over license price. Integration, recurring tests, false blocks and analyst handling can alter the cost of ownership. Require the vendor and operating team to show those inputs rather than presenting a market-growth forecast as a business case.

The secure AI Hype Cycle is not permission to postpone testing

My count of all 24 technologies in Gartner’s Priority Matrix puts 17 in the two-to-five-year adoption band, six in the five-to-ten-year band and only one below two years. That leaves 23 of 24 technologies, or 95.8%, at least two years from mainstream adoption under the report’s estimates.

Counts and shares are my calculation from the complete Priority Matrix, including its second appendix page. They count technology categories, not companies, products or survey respondents.

Most high-benefit controls remain several years from mainstream adoption

Separating benefit from adoption time exposes the concentration more clearly. Of the 17 categories rated high or transformational, 16 sit at least two years from mainstream adoption.

No category appears in the more-than-ten-year column of the source matrix. These counts describe Gartner’s portfolio of technologies, so they should not be interpreted as a probability that a particular product will succeed.

• Waiting for broad adoption would defer most of the portfolio. The 17 categories in the two-to-five-year band include identity, runtime defense, MCP cybersecurity and coworking agent security. Enterprises need interim integration and enforcement decisions while specialist products mature.
• High expected benefit does not remove implementation risk. Sixteen of the 17 high-or-transformational categories remain at least two years from mainstream adoption. Use the benefit rating to prioritize evaluation, then test deployment-specific efficacy and cost.
• The five-to-ten-year group includes foundational lifecycle and access questions. Agent development life cycle and workload access management sit there alongside AI security testing and governance. Long market timelines make organizational ownership more important now, not less.

Concentration is an integration problem

The high-benefit group contains 15 of the matrix’s 24 categories, or 62.5% by my count. Ten of those 15 sit in the two-to-five-year band and four in the five-to-ten-year band. Threat modeling automation is the only high-benefit category below two years. Both transformational categories also remain two to five years from mainstream adoption.

That distribution argues against treating a high rating as a reason to skip integration testing. A buyer can select promising technologies across identity, testing and runtime protection and still fail to connect them into one enforceable workflow. The important procurement evidence is whether the controls exchange the identity, policy and event data needed to stop a prohibited action.

• The nearest-maturity category helps define the problem rather than enforce every boundary. Threat modeling automation can support the design process. It does not replace the authorization decision at a tool, repository or data source.
• Benefit ratings cannot become budget percentages. Seventeen high-or-transformational categories do not justify allocating 17/24 of a security budget to those products. Categories differ in deployment scope, overlap, cost and the losses they address.
• Portfolio averages can hide the longest dependency. A workflow that depends on a difficult access-management integration is not ready merely because another component has a shorter adoption horizon. Measure readiness against the weakest required control, not the average maturity of purchased products.

Fast adoption and high benefit are different signals

Gartner’s Priority Matrix puts threat modeling automation less than two years from mainstream adoption. AI agent identity, runtime defense, MCP cybersecurity and coworking agent security sit in the two-to-five-year band, while AI security testing and AI cybersecurity governance sit five to ten years out.

These are Gartner’s estimates of time to mainstream adoption, not deadlines for implementing the underlying security practices. The same report recommends preproduction testing now and forecasts a higher incident burden for organizations that skip it.

Existing systems can enforce some protections before specialist markets mature. A team can start by assigning an owner, limiting credentials, reviewing connectors or requiring approval before a destructive action.

Treat the Hype Cycle as a dependency map rather than a shopping list

Gartner’s 24 categories are not 24 independent procurement requirements. My operational interpretation is that the identity, testing, runtime and governance categories have to exchange decisions and evidence. A test needs to know the agent’s intended authority. Runtime enforcement needs that policy, and incident response needs a credential it can revoke without disabling unrelated work.

This changes what a proof of concept should demonstrate. Four disconnected dashboards can document the same agent while none stops an out-of-scope action. A smaller integrated deployment can be more useful if an adversarial test identifies a failure, the responsible team changes the policy and the runtime system demonstrably blocks the repeated attempt. Category coverage is a weaker acceptance criterion than a completed control loop.

The maturity ratings also argue for reversible procurement. Evaluate a narrow production use case, require exportable policy and telemetry, and keep the business authorization rules independent of a proprietary dashboard where practical. Those are my procurement recommendations for an emerging market, not Gartner product scores. They reduce the cost of changing suppliers without treating vendor consolidation as certain for any particular company.

The adoption bands come from Gartner’s Priority Matrix. The rollout decisions are my operational synthesis, not additional Gartner predictions or product ratings.

High benefit does not mean a mature deployment

Gartner’s profiles also distinguish benefit, maturity and estimated market penetration. Those measures answer different questions, so a high benefit rating should not be read as evidence that a category already works consistently across enterprise environments.

These are selected Gartner profile assessments, not percentages from the 251-person survey. Each penetration range refers to that technology’s target audience, so the rows cannot be added or treated as adoption rates within one common population.

• A transformational rating can coexist with limited adoption. Agentic application security testing promises substantial benefit while remaining emerging and at 1%–5% penetration. Buyers should test finding quality, reproducibility and remediation throughput before assuming it replaces established testing.
• Identity and runtime controls need an integration plan. Both carry high benefit ratings but remain emerging in this report. Ask how credentials, tool permissions, telemetry and revocation connect to systems already in production.
• The most mature item in this selection helps teams design protections. Threat modeling automation identifies requirements and trust boundaries earlier. It does not itself enforce an agent’s authorization or stop an active tool call.

Two similarly named testing categories solve different problems

AI security testing probes AI-enabled systems for exposures such as prompt injection, data leakage and compromised models or components. Gartner rates the category emerging, with penetration of 5% to 20% of its target audience.

Agentic application security testing uses AI agents to assess application code and identify vulnerabilities. Gartner places it in the two-to-five-year adoption band, gives it a transformational benefit rating and estimates penetration of 1% to 5%.

Buying an agent that finds software vulnerabilities is therefore not the same as testing whether a business agent can be manipulated. Gartner also recommends adding agentic application security testing without removing traditional deterministic testing, and warns that faster vulnerability discovery increases the need for effective remediation.

A procurement document should name which of these jobs the product performs. Combining them under “AI security testing” makes a coverage gap difficult to spot until an application is ready to launch.

A prompt filter cannot see every agent action

Gartner’s runtime-defense analysis identifies a deployment limitation that belongs in every proof of concept. Controls positioned in front of an application see user inputs and application outputs. They do not automatically observe every internal tool invocation or step in the execution path.

Gartner also identifies false positives, added latency and new agent attack vectors as unresolved product challenges. A successful demonstration against a set of malicious prompts does not establish acceptable performance across a real business workflow.

Include benign tasks as well as attacks in the evaluation. Measure how often the control blocks legitimate work, which malicious actions it misses and how much delay it adds. Require evidence from the proposed deployment configuration, including the points where the product can inspect or enforce policy.

Gartner recommends connecting runtime defense with AI security testing so adversarial assessments can improve controls. The operational requirement is a feedback loop that reaches the enforcement point. Finding a prompt-injection weakness without testing the resulting policy change leaves the same workflow exposed.

Measure prevention and workflow disruption separately

A single accuracy score can hide a security failure. The following worked example uses invented results from two configurations tested against the same 200 malicious attempts and 10,000 authorized tasks. It is not a Gartner benchmark or a claim about any vendor.

Configuration B prevents eight additional malicious actions while interrupting 400 additional legitimate tasks in this constructed test. That trade is not resolved by calling either configuration more accurate. The decision depends on the consequences of the malicious actions and the cost of interrupted work. Preventing an unauthorized payment and avoiding a delayed draft reply do not have equal value.

Test prevalence changes the result

The test-set proportions are also chosen, not measured production attack prevalence. These counts cannot estimate live incident frequency or a product’s financial return. For an actual evaluation, report attack results by consequence and by entry point, retain a separate benign task set and repeat tests where model behavior varies. A control that stops direct hostile prompts but misses instructions inside retrieved documents should not receive a single averaged score that hides the missed path.

• Record the moment of enforcement. Count a malicious action as prevented only when it is stopped before the protected resource changes or data leaves. An alert raised after execution belongs in a detection result.
• Measure operational cost alongside blocking quality. Report added end-to-end latency, authorized-task completion and analyst handling time under the intended deployment configuration. A policy that staff routinely bypass to finish their jobs does not provide the protection demonstrated in a lab.
• Retest after a material workflow change. A new model, tool, permission or connector changes the system being evaluated. Keep the earlier test set, add cases for the changed boundary and document which release decision the new results support.

MCP connections need their own owner and incident path

Gartner treats Model Context Protocol deployments as privileged assets because they connect agents to tools and data. Its recommendations include scoped, short-lived authorization, runtime mediation, monitoring and an ownership chain for MCP use cases.

Gartner also warns that third-party MCP environments can obscure access controls, logging and sandboxing. A team using a vendor-hosted server still needs evidence of those controls rather than assuming the platform’s general security claims cover the connection.

For a rollout review, ask the application owner to demonstrate an allowed tool call and a denied one. Then revoke the credential and repeat the workflow. The useful result is observable enforcement and a log that identifies the agent, resource, decision and accountable owner. OWASP’s MCP Top 10 supplies a separate beta-stage review checklist covering token exposure, privilege escalation, tool poisoning, authorization and audit gaps. Use it to build test cases, not as evidence that a product has passed them.

Match the control to the execution surface

An enterprise can buy several AI security products and still leave a decisive permission unchecked. The following comparison maps the report’s control categories to illustrative deployment failures, rather than claiming Gartner observed these specific incidents.

My assessment is that coverage should be bought around these execution paths, not around a product’s use of the term “agentic.” The same vendor can cover several cells, but procurement should verify each one independently.

• Discovery is the starting point, not the release decision. An inventory tells the team what exists. Approval requires evidence that identities, permissions and execution controls remain effective under adversarial inputs.
• A blocked response and a blocked action are different outcomes. Filtering an answer after a tool has transferred data or changed a record is too late for that action. Place authorization and approval before consequential execution.
• Containment is incomplete until revocation is tested. A control that alerts on suspicious activity still needs an owner and a response path. Test whether active sessions, cached credentials or queued work continue after access is withdrawn.

Six checks before an agent gets broader permissions

The following worksheet turns the report’s recommendations into acceptance tests. It is an editorial tool for security and application teams, not a Gartner certification scheme.

The business owner should approve the task and acceptable loss conditions before the test starts. Security and engineering can then judge whether the implementation enforces those limits, instead of negotiating acceptable behavior after the agent takes an action.

For a coding agent, include repository permissions, dependency installation and deployment access. Gartner’s agentic coding security profile recommends “least agency,” human review for relevant high-risk activities and continued application-security controls throughout development.

An agent that can generate code should not receive production deployment authority merely because the generated code passes a scan. The release process still needs an accountable approval and a way to revoke the agent’s access without disabling an employee’s account.

Fund enforcement before another inventory

Gartner reports that only 33% of surveyed organizations have enterprise-built, customer-facing GenAI agents in limited or broad production. That figure identifies the scope of the survey finding. It does not mean two-thirds have no AI agents, no internal deployments or no third-party agent use.

Gartner warns that projects move from experimentation toward production faster than security teams can adapt their controls. It also describes a fragmented market in which no single product evidently discovers, governs, protects and manages every layer of the agent stack.

A purchase decision should start with the unprotected action. If the current identity system can issue scoped credentials but the deployment bypasses registration, the immediate work is integration and enforcement. If the application’s internal tool calls are invisible to the current runtime control, the team needs a demonstrated coverage change.

Budget tradeoffs should remain visible. When a new AI control takes money from an existing cybersecurity initiative, record which coverage or project has been reduced and who accepted the trade. The Hype Cycle’s funding results make that an operating decision, not an accounting detail.

Price the complete control rather than the license

A security business case should compare expected avoided loss with licensing, integration, recurring testing, analyst work and disruption to legitimate tasks. My recommended calculation starts with an explicitly defined loss scenario and a time period. It should not substitute Gartner’s market growth rate or relative incident forecast for an enterprise’s own exposure.

For a deliberately simplified example, assume a control costs $250,000 per year in total and addresses a single type of event with a $2 million loss if it occurs. Ignoring all other effects, the control needs to reduce that event’s annual probability by more than 12.5 percentage points to produce positive expected net value. The arithmetic is $250,000 divided by $2 million. This is an absolute probability reduction, not a 12.5% relative reduction or a probability supplied by Gartner.

That calculation is a screening question, not a complete risk decision. Repeated events require a frequency model, and legal obligations or unacceptable catastrophic outcomes can rule out deployment regardless of an average-dollar estimate. The purpose is to reveal the assumptions a budget request must defend. If a vendor cannot connect its observed control performance to the buyer’s exposure, a claimed return on security investment remains unproven.

Budget diversion makes the comparison stricter. A new AI control that reduces one loss scenario while removing protection from another has a net effect across both. Name the displaced work and its exposure rather than presenting the new purchase’s benefits in isolation. Where that trade cannot be measured credibly, keep it explicit for the accountable business and security leaders.

All 24 technologies in the secure AI Hype Cycle

This complete assessment table keeps Gartner’s technology names, benefit ratings and mainstream-adoption bands together. The evaluation questions are my synthesis for procurement and deployment reviews, not Gartner product scores or additional forecasts.

Transformational and high-benefit technologies

Moderate- and low-benefit technologies

The first three columns come from Gartner, Hype Cycle for Secure AI, 2026 (G00846820), October 12, 2026, complete Priority Matrix on appendix pages 1A–2A. The low-benefit differential-privacy entry appears on the continuation page. Omitting that page would leave the inventory and denominator incomplete.

Similar names do not mean interchangeable controls

Threat modeling automation and threat modeling AI applications occupy different adoption bands in the source matrix. The first concerns automation of a security design practice, while the second focuses the practice on AI applications. A buyer should specify which job it needs rather than treating the similar names as duplicate product categories.

Governance also appears in several forms. A platform purchase, data-governance process and cybersecurity decision right are not interchangeable evidence that an agent’s action will be permitted or denied correctly. My assessment is that the evaluation must trace the policy from its owner through the deployed enforcement point.

• Use the inventory to find unanswered questions, not to require 24 purchases. One existing system may satisfy several needs, while one new product may satisfy only part of a category. Count demonstrated controls before counting vendors.
• Retain the source’s low-benefit rating without making it a universal dismissal. Differential privacy’s portfolio position does not decide its suitability for a particular privacy requirement. Evaluate the data use and required guarantee rather than buying or rejecting a capability solely on its location in the matrix.

Make the next production approval the test

In short, use the Hype Cycle to assess buying risk, not to defer responsibility for a deployed system. Therefore, my recommendation is to make the next expansion of an agent’s authority depend on three kinds of evidence.

• Application owners should define permitted actions before selecting a product. First, name the task, sensitive resources, forbidden actions and accountable owner. Otherwise, a successful demonstration may prove that the tool works without proving that it enforces the business boundary.
• Security teams should require a demonstrated denial and revocation path. For example, test an out-of-scope action, hostile retrieved instructions and access withdrawal during a workflow. Then check whether authorized work still completes and whether the logs explain what happened.
• Budget owners should fund a demonstrated control gap. In addition, compare the protection added with integration, retesting and operating costs. If funding comes from an existing initiative, disclose the protection being reduced rather than presenting the new purchase as a pure gain.

Ultimately, a category’s adoption horizon cannot approve a production release. That decision belongs to the enterprise, supported by evidence that the deployed agent stays within its authority and can be stopped.

Frequently asked questions

Is Gartner’s two-times incident figure an observed result?

It is a forecast for 2028, presented as a strategic planning assumption. The report does not present it as a measured incident rate from its 2026 survey.

Does the 50% funding figure mean half of enterprises have no AI security budget?

No. It combines organizations without secured funding and those diverting money from existing initiatives, among respondents piloting or implementing offensive AI security technologies. It is neither a measure of all enterprises nor a measure of entirely unfunded programs.

Should teams wait five to ten years before adopting AI security testing?

Gartner’s five-to-ten-year band describes expected mainstream adoption of the technology category. The report recommends testing before production and continuous retesting, so the maturity estimate is not a waiting period.

Is this the Hype Cycle for AI-driven cybersecurity?

This analysis covers Hype Cycle for Secure AI, 2026, which focuses on securing AI that organizations use and build. Gartner distinguishes that subject from its separate work on using AI within cybersecurity.

Related implementation guidance

For complementary implementation guidance, consult NIST’s voluntary AI Risk Management Framework, which addresses AI risks across design, development, use and evaluation. It is a separate resource, not the source of Gartner’s forecasts or market estimates.

Research and methodology

This analysis uses the original Hype Cycle for Secure AI, 2026 (G00846820), dated October 12, 2026. The strategic planning assumptions appear on page 1, adoption and funding findings on pages 2–5, and the Priority Matrix on pages 6–7. The relevant profiles cover agentic application security testing on pages 20–22, agentic coding security on pages 22–25, coworking agent security on pages 35–39, agent identity on pages 39–42, AI security testing on pages 43–46, runtime defense on pages 62–65 and MCP cybersecurity on pages 66–69.

Gartner’s methodology states that the Surviving the Agentic AI Era survey included 251 respondents and ran online from June 29 through August 7, 2026. Respondents were CISOs or equivalent cybersecurity leaders and their direct reports. Gartner cautions that the findings reflect the surveyed organizations rather than the global market, and the report does not provide the subgroup sample sizes for the funding percentages used here.

The market-spending comparison uses Forecast: AI Spending, Worldwide, 2025–2030, 3Q26 (G00862061), dated October 7, 2026, and its workbook and CSV. The 17.1-to-one ratio is my calculation using $48.512 billion divided by $2.835 billion. Those market categories are not a measurement of an individual organization’s security budget.

The six-check worksheet, control-dependency analysis and proposed owner assignments are my synthesis. The runtime evaluation and annual-loss examples use explicitly hypothetical inputs, not survey observations, vendor performance results or Gartner forecasts. The Hype Cycle graphic is Gartner’s Figure 1. The adoption-count, benefit-maturity, spending and funding graphics are my analysis of the original reports and data. The complete 24-technology table preserves Gartner’s benefit and adoption classifications while separating my evaluation questions.

More analysis from this blog

• The broader security-budget outlook. Read Gartner’s 3Q26 information-security spending comparison for the market context surrounding specialist AI controls.
• Using AI in cybersecurity. Compare the AI-amplified security forecast with the distinct task of protecting AI systems.
• The economics behind the AI buildout. Review the revenue requirements from Gartner, Goldman Sachs, Bain and JPMorgan for a separate analysis of provider economics.
• Agentic AI adoption and market size. Compare the major agentic AI market forecasts alongside the security market’s adoption horizons.

This is my personal analysis. It does not represent my employer.