Only 16% govern third-party AI: Gartner’s nine cybersecurity trends for 2027

Enterprises will spend $276.1 billion on information security in 2027. Gartner’s nine cybersecurity trends for the year explain where that money is already failing to keep up. Six of the nine trace to one cause. AI agents, frontier models and the machine identities they borrow are entering production faster than the controls built to govern, authenticate, test and train for them.

The readiness numbers behind the trends are blunt. For example, only 16% of organizations enforce workflows governing employee use of third-party AI applications. Likewise, 34% manage AI agent identity with tools designed for humans, and 15% have no approach at all. Fifty-one percent have not begun any post-quantum cryptography work, and 79% report no change to their PQC budget. Even so, Gartner dates the end of safe asymmetric encryption to 2029 through 2030. In its Cybersecurity Executive Outlook, 4Q26 (G00861818), it also predicts at least 200% higher migration costs for organizations that have not piloted PQC by 2027.

The budget is moving before the governance does

The three fastest-growing lines in Gartner’s 3Q26 security forecast are cloud security posture management at 29.1%, cloud access security brokers at 25.0% and zero trust network access at 22.3%. All three fund exactly the trends with the lowest readiness scores, while the legacy network controls they replace shrink. This analysis maps the nine trends in Gartner’s Top Trends in Cybersecurity, 2H26 (G00860263) to the 2027 forecast line by line. The pattern is consistent: the money is chasing the gaps, but the people and controls have not caught up.

Why the list grew from six trends to nine

In February I covered the six trends in Gartner’s 2026 cybersecurity trends list. Since then, it has stayed one of the most-read pieces on this blog all year. Gartner published its 2026 trends press release on February 5, 2026, and has not published a 2027 edition. So this is not a rewrite of a report that does not exist yet. Instead, it is built from the three documents CISOs are using to set 2027 budgets right now. The mid-year update to the trends list, Top Trends in Cybersecurity, 2H26 (G00860263, August 19, 2026), expands six trends to nine. The 2027 Planning Guide for Cybersecurity (G00856222, October 7, 2026) then narrows those into four planning areas. The Forecast: Information Security, Worldwide, 2024-2030, 3Q26 (G00862059, September 24, 2026) prices them. Where the three disagree on emphasis, I say so.

One trend from February is gone: global regulatory volatility dropped off the list. A second trend dropped with it. Collaborative data security governance appeared in the full 1H26 report but never made the six-trend press release. Three new trends replaced them. Software supply chain security for AI components, technical debt as a barrier to AI, and frontier AI models rewriting vulnerability management. The removals matter as much as the additions. Gartner folded regulation and data governance into resilience and the CISO’s remit rather than treating them as standalone forces.

The spending backdrop. $276.1 billion and the growth rate just peaked

Gartner’s 3Q26 forecast puts worldwide end-user spending on information security at $247.5 billion in 2026 and $276.1 billion in 2027. That is an 11.6% increase in current U.S. dollars by my calculation from the forecast dataset. By comparison, Gartner’s own constant-currency figure for 2027 is 11.2%. Either way, 2026 was the peak growth year at 13.6%. Growth then decelerates every year, landing at 9.9% in 2030 when the market reaches $372.8 billion. I covered the 3Q26 forecast in detail in October, including why post-quantum firewall refreshes are the only hardware upgrade Gartner expects through 2030.

Software takes share from services

Security software carries the market. It grows 13.4% to $143.9 billion in 2027 and adds $17.0 billion of the $28.7 billion in new spending. Its share of total security spending rises from 49.6% in 2024 to 52.1% in 2027 and 55.6% in 2030, while security services fall from 39.3% to 33.6%. In other words, enterprises are substituting software for outside help. Services still grow 8.7% to $101.7 billion, but at the slowest rate of the three markets.

Network security grows 13.2% to $30.6 billion. Gartner also raised its long-term network outlook from a 9.8% to a 10.9% CAGR through 2030 on the strength of PQC-driven firewall replacements. Cloud security remains the fastest subsegment at 25.1% growth in 2027, reaching $20.8 billion. The securing-AI market Gartner tracks inside other security software grows from $3 billion in 2026 to $16 billion by 2030. Meanwhile, AI-amplified security products grow from $49 billion to $204 billion over the same period. I broke down the AI-amplified forecast in August.

Theme 1. Secure new frontiers

Trend 1. CISOs expand software supply chain security to cover AI models and agents

New to the list. Fifty-nine percent of CISOs rank third-party and supply chain attacks among their top five threats for the next 12 months. The figure comes from the 2026 Gartner CISO Role Survey (n=297) cited in the 2H26 trends report. Pressure to ship AI systems fast pushes teams onto open-weight and frontier models and the third-party components that wrap them. As a result, the security posture of the model itself usually goes unchecked. Gartner’s position is that point-in-time assessments and static controls cannot secure assets that update, drift and pull unverified dependencies continuously.

The 2027 Planning Guide adds the number that shows how far behind most programs are. Specifically, only 22% of organizations scan repositories for third-party component compromises that include models. Gartner’s actions are specific. Build an AI bill of materials and binary composition analysis into the CI/CD pipeline. Then extend third-party cyber-risk assessments to AI-specific software and its components. Finally, write incident response playbooks for AI supply chain disruptions that include isolating a service or deploying a workaround. Application security spending grows 10.6% to $10.7 billion in 2027, while vulnerability assessment within it grows 12.6%.

Trend 2. IAM adapts to secure and enable AI agents

Ninety-four percent of organizations report rising machine identity volumes over the past 12 months, per Gartner’s 2025 Machine Identity Survey (n=299). The growth is driven chiefly by AI and machine learning adoption (52%) and autonomous agents (35%). Fifty-eight percent have had at least one incident in which AI-linked machine identities were compromised. Those incidents caused moderate to significant business disruption at 42% of affected organizations. They also caused financial loss at 36% and reputational damage at 32%.

Gartner’s Theme: Cybersecurity at the AI Frontier (G00862284, November 3, 2026) puts the governance gap in two numbers from its 2026 Surviving the Agentic AI Era Survey. Thirty-four percent of organizations manage AI agent identity with tools designed for humans. Another 15% have no defined approach at all. The Cybersecurity Executive Outlook, 4Q26 goes further and finds 50% have no defined approach to limit AI agent access. Gartner’s Top Strategic Technology Trends for 2027, released at Gartner IT Symposium/Xpo in October, named AI agent identity one of the ten trends. It also predicted that by 2028, 25% of enterprise security breaches will trace back to AI agent abuse. The causes it names are unmanaged machine privileges and legacy credential practices.

However, the spending data says the money has not caught up. Identity and access management grows 8.6% to $25.5 billion in 2027, below the market rate. User authentication, the largest human-centric IAM line, grows 2.7%. By contrast, privileged access management grows 11.7% and identity governance 10.8%. The IAM budget is shifting from authenticating people to governing what machines are allowed to do. It is shifting slowly, though.

Trend 3. The quantum decryption threat advances while organizations lag

Gartner now dates a cryptographically relevant quantum computer to 2029 or 2030. Among CISOs who have started PQC work, fewer than 25% have made meaningful progress. That covers both a cryptographic inventory (24%) and a quantum risk assessment (22%). Sixty-five percent also say their board is unaware of or does not raise quantum threats, per the 2027 Planning Guide. The Cybersecurity Executive Outlook, 4Q26 sets the deadline in cost terms. Pilot PQC migration by 2027 or pay at least 200% more for the full migration later.

Still, budgets are moving ahead of CISOs here. The 3Q26 forecast expects at least 20% of customers in government, financial services and defense to upgrade firewalls to PQC-capable platforms in 2027. That share rises to more than 30% in 2028. The reason is that many installed firewalls cannot handle the processing demands of ML-KEM through a firmware update. Firewall equipment grows 13.7% to $22.4 billion in 2027. Encryption software, meanwhile, grows 10.4% to $1.7 billion. Gartner’s recommendation has not changed since February. Inventory cryptographic deployments, rank data by sensitivity and lifespan, and build crypto-agility so algorithms can be swapped without re-architecting systems.

Theme 2. Transform governance

Trend 4. Technical debt undermines organizational AI ambitions

New to the list. Forty-nine percent of cybersecurity leaders cite technical debt as a major barrier to executing their top functional priorities. Executive pressure to deploy AI forces teams onto unstructured data repositories without AI-ready controls. Oversharing and unauthorized access follow as a result. At the same time, frontier models are accelerating vulnerability discovery across infrastructure and enterprise software. Gartner names Anthropic’s Mythos, OpenAI’s Daybreak and Microsoft’s M-DASH. Each wave of discoveries then lands on legacy systems that cannot absorb the patches.

Gartner’s advice is to separate cybersecurity debt from enterprise technical debt. CISOs who try to own all of it will overwhelm their teams and open control gaps. The 2H26 report tells CISOs to inventory in-flight and short-term initiatives immediately. It then tells them to rank each one by how much risk it cuts from the dual threats of AI adoption and AI-discovered vulnerabilities. The Theme document is blunter. Closing the AI-Cyber Capability Gap will cost more than most enterprises have planned, because the bill includes the debt, not only the new tooling.

Trend 5. AI and cyber resilience redefine the CISO’s remit

Ninety-three percent of board directors view cyber risk as a threat to shareholder value. In addition, 98% expect it to increase over the next two years. This is where February’s regulatory volatility trend went. Gartner’s CISO Agenda for 2027 (G00859134, September 17, 2026) reports that 40% to 70% of CISOs now hold accountability for six adjacent areas, depending on the activity. Those areas are third-party risk, AI governance, disaster recovery, crisis management, business continuity and fraud prevention. Nearly half experienced burnout in the past 12 months, and nearly 60% say their team members did.

The same document counts the cost of AI vendor promises. Across 13 AI use cases in cybersecurity, only 39% of CISOs report significant ROI. In fact, 55% say vendor overpromise forced costly rework. Even so, boards are deliberately expanding their tolerance for technology risk to pursue AI growth. That is the finding of Gartner’s CISO Agenda Priority: Align Cybersecurity Investment With Board Risk Appetite (G00862663). The 2027 job is to measure business consequences rather than incident counts and to fund resilience for the risk the board has already accepted. Security consulting grows 7.8% to $31.7 billion in 2027 and professional services 8.5% to $34.5 billion. Those are the two slowest-growing of the three services subsegments in the forecast. Organizations are buying less outside strategy help as a share of spend. Instead, they are buying more software.

Trend 6. Agentic AI demands program oversight

Forty-six percent of senior cybersecurity professionals have observed production use of standalone SaaS GenAI agent platforms. Sixty-seven percent have also observed unsanctioned, employee-driven agent platforms through informal reports or monitoring. Meanwhile, 32% of IT workers using GenAI at work hide it. Only 16% of organizations have enforced workflows that govern employee use of third-party AI applications. That leaves what Gartner calls rogue automation running with excessive privilege. Despite the gaps, about 41% of GenAI prototypes reach production.

The Theme document reframes the whole category. Cybersecurity incidents are caused by AI agents taking ungoverned actions, not by how intelligent the model is. Gartner tells executives to treat every AI agent as an insider risk and to adopt risk frameworks built for nondeterministic systems. It also tells them to ban what it calls governance theater, meaning committees that can flag concerns but cannot block a launch. The Planning Guide’s version is to secure third-party agents first and extend application security to AI applications. Zero trust then becomes the architecture for agentic access. Zero trust network access grows 22.3% to $3.7 billion in 2027, the third-fastest category in the forecast. I covered the governance side in Gartner’s 2026 AI governance Hype Cycle and the testing side in the secure AI Hype Cycle.

Theme 3. Normalize AI adoption

Trend 7. Frontier AI models transform vulnerability management

New to the list, and the one most likely to change SOC metrics in 2027. Gartner’s argument is that frontier models created a supply-side shock. Vendors and open-source projects now use AI to find latent flaws in their own code. Consequently, the volume and frequency of urgent updates has jumped. The bottleneck is not patching capacity. Instead, it is testing and change management. Mandates to patch everything immediately therefore transfer risk into insufficient testing and self-inflicted downtime. Gartner calls patch speed a vanity metric and replaces it with maximum tolerable exposure time. I covered that shift in October in Gartner says frontier AI makes patch speed a vanity metric.

Maturity is still low. Fifty-two percent of organizations prioritize purely on CVSS ratings rather than active exploitability. Sixty-one percent still rely on traditional penetration testing, and only 39% use simulation technologies such as breach and attack simulation to confirm exploitability. The Planning Guide’s 2025 Impact of Emerging Tech on Infrastructure Security Operations Survey (n=249) finds only 48% weigh likelihood of exploitation and business impact when prioritizing. Similarly, only 41% use documented cross-team approval workflows to act on findings. Gartner’s Top Strategic Technology Trends for 2027 list adds autonomous exposure remediation. It predicts that by 2031 adopters will cut containment windows from weeks to within 48 hours. Threat intelligence spending grows 20.2% to $3.7 billion in 2027.

Trend 8. AI breaks traditional cybersecurity awareness tactics

Sixty percent of all data breaches involve the human element. Eighty-six percent of organizations also have standalone public SaaS GenAI in production. Over 57% of employees use personal GenAI accounts for work, and 33% admit inputting sensitive company information into them. The numbers from February have not improved. The threat side got worse. AI-assisted malicious emails, for instance, doubled in two years. Forty-one percent of organizations experienced at least one deepfake incident during an audio call with an employee. Likewise, 35% encountered one on a video call.

Gartner’s answer is to retire generic awareness training in favor of adaptive behavioral programs with AI-specific tasks. It also wants sanctioned GenAI tools to be easier to reach than unsanctioned ones. Cloud access security brokers grow 25.0% to $3.5 billion in 2027. CASB is the control most often used to see and govern SaaS GenAI usage. Enterprise data loss prevention grows 11.1% too. Those two lines are the budget expression of this trend.

Trend 9. AI-driven SOC solutions destabilize operational norms

Fifty percent of CISOs strongly agree that workforce resistance or talent gaps have slowed adoption of AI in security. The same gaps, they say, have cut the value of those investments. Similarly, only 17% of executive and AI leaders believe their organizations have enough talent to support AI initiatives. Inside the SOC, 26% have trained analysts to interpret enriched signals, and 35% have a structured skills transformation program. Meanwhile, 51% operate without a dedicated detection engineering function, which leaves them dependent on generic vendor rules.

Gartner’s forecast for the SOC workforce is the opposite of the headcount-cut narrative. By 2028, security operations teams will employ 50% more engineers than traditional analysts. By 2030 the SOC’s primary output will be validated cases with business impact and documented rationale rather than alerts reviewed. The Planning Guide also warns that AI SOC’s long-term value is unproven and that overpromising is the norm. Managed detection and response grows 9.8% to $12.6 billion in 2027, while managed security operations grows 10.7% to $17.3 billion. Organizations are still buying SOC capacity faster than they can build it.

What changed from the February list

Where the 2027 dollars move

Map the nine trends onto the forecast and a pattern shows up. The categories growing fastest in 2027 are the ones that reduce the attack surface AI agents and cloud workloads create. For example, cloud security posture management grows 29.1% to $8.1 billion. CASB grows 25.0%. ZTNA grows 22.3%. Cloud workload protection grows 21.8% to $9.2 billion. Threat intelligence grows 20.2%. Conversely, the categories shrinking are the legacy network controls those trends replace. Network access control falls 12.9% and intrusion detection and prevention systems fall 7.4%.

The Planning Guide’s fourth 2027 trend is attack surface reduction as a core part of defense in depth. It is the quietest of the four and also the best funded. Its planning considerations are endpoint hardening baselines and software supply chain controls. They also include CNAPP for the cloud attack surface, and DSPM plus AI security posture management for data overexposure. Endpoint protection platforms add $2.9 billion in 2027. That is the largest absolute increase of any category outside the other security software bucket where securing-AI tools sit.

What this means for CISOs planning 2027

Six of the nine trends describe the same failure from different angles. AI agents, the models behind them and the identities they borrow are operating inside enterprises faster than governance, identity, testing and training can adapt. Gartner’s Theme document gives that failure a name, the AI-Cyber Capability Gap, and a rule. You cannot scale AI value without scaling AI security first. The other three trends, quantum, technical debt and the CISO’s remit, are the structural debts coming due at the same time.

Four moves for the 2027 plan

Four moves follow from the documents, in the order Gartner’s own numbers argue for.

Give every AI agent an identity you can trace to a human. Thirty-four percent of organizations run agents on human identity tools and 15% have no approach. Gartner’s 25%-of-breaches-by-2028 prediction is the cost of leaving that alone. Start with the agents carrying the most privilege and the least oversight.

Pilot PQC in 2027 or budget for triple the migration cost. Fifty-one percent have still not begun. Gartner’s 200% penalty applies to organizations that wait past 2027 to start piloting. The firewall refresh cycle already in the 3Q26 forecast is the first line item most CISOs will see.

Replace patch speed with tolerable exposure time. Fifty-two percent prioritize on CVSS alone. Frontier models will keep raising the volume of urgent fixes. The organizations that survive it will be the ones that validate exploitability first and then negotiate exposure-based SLAs with product teams.

Fund detection engineering before you fund AI SOC agents. Fifty-one percent of SOCs have no detection engineering function. Gartner’s 2028 forecast of 50% more engineers than analysts is a hiring plan, not a headcount cut. AI SOC agents, after all, amplify whatever the team already knows how to do.

Gartner’s six trends in February explained where $244.2 billion was going. The nine trends CISOs carry into 2027 explain where $276.1 billion goes. The fastest-growing lines in that forecast already match the trends with the lowest readiness scores. In short, the money is moving toward the gaps. The question for 2027 is whether the governance and the people move with it.