Skip to content

Posts from the ‘AI Security’ Category

Nov 9

Why Gartner and IDC are $86B apart on 2027 cybersecurity spending

Chart comparing Gartner's and IDC's cybersecurity spending forecasts for 2027: $276.1 billion versus $361.9 billion, an $85.8 billion difference explained by scope, while 2027 growth rates sit within 1.2 points at 11.2 to 12.4 percent
Cybersecurity spending forecasts for 2027 compared. Gartner and IDC are $85.8B apart on market size, yet their 2027 growth rates sit within 1.2 points of each other. Click any chart to open it full size. Sources linked below, analysis by softwarestrategiesblog.com.

Four research firms have now published cybersecurity spending forecasts for 2027. Their numbers do not agree, and the disagreement itself is more instructive than any one total. Gartner’s 3Q26 forecast puts worldwide information security end-user spending at $276.1 billion in 2027. IDC’s latest published figure is $361.9 billion. Omdia has 2026 at $315 billion but keeps its 2027 figure behind a paywall. Forrester surveys the people who hold the budgets instead of sizing the market, and 60% of them expect at least a 5% increase next year.

Put side by side, the spread looks like a dispute about demand. Growth rates say otherwise. Every firm’s 2026 rate lands between 12.7% and 13.6%, while each 2027 rate sits between 11.2% and 12.4%. What separates a $276 billion market from a $362 billion one is what each firm decides to count. This post reconciles the four cybersecurity spending forecasts for 2027, shows where the scope differences come from and identifies the one place where the firms genuinely disagree. That place is the pace of deceleration after 2027.

Five takeaways from the cybersecurity spending forecasts for 2027

  • The 2027 gap is $86 billion, and it is almost entirely definitional. IDC’s $361.9 billion includes security hardware and spans 38 technology markets across 28 industries. Gartner’s $276.1 billion covers 41 categories of security software, security services and network security equipment but no other hardware. Neither firm is wrong. Each draws the market boundary in a different place.
  • Growth is the point of agreement. Gartner has 2026 at 12.7% in constant currency (13.6% in current dollars) and 2027 at 11.2%. IDC’s V2 release has 2026 at 13.2% and its event page has 2027 at 12.4%. Omdia also has 2026 at 13%. Any of the four cybersecurity spending forecasts for 2027 would describe the same healthy, low-teens market.
  • Omdia’s services share is the biggest single difference. Omdia puts services at roughly two-thirds of cybersecurity spending, against a 37.8% services share in Gartner’s forecast. In dollar terms, Omdia’s June 2026 services figure of $204.8 billion is $111 billion above Gartner’s $93.5 billion. That alone is more than the entire gap between the two firms’ totals.
  • The real disagreement is after 2027. Gartner’s constant-currency growth path declines every year, falling from 12.7% in 2026 until it reaches 9.6% in 2030. That is a 10.8% compound rate for 2025 to 2030. IDC describes a “12.5% five-year path to $512.9B by 2030.” By 2030 the two long-range numbers are $140 billion apart.
  • Forrester’s budget signal improved year over year. In its 2027 planning survey, 16% of security decision-makers expect a budget increase above 10%, while 44% expect 5% to 10%. A year earlier the figures were 15% and 40%. Budgets are growing faster in the minds of the people who set them than a year ago.

What each firm’s cybersecurity spending forecasts say for 2026 and 2027

The table below holds the figures each firm has made public, together with the scope that goes with them. Read the scope column first, because the totals mean little without it. Gartner’s number is end-user spending in current dollars from the detailed forecast file. IDC’s figures come from two places. Its V2 Worldwide Security Spending Guide release gives $310.42 billion for 2026. A separate IT Security event page then gives $361.9 billion for 2027 and $512.9 billion for 2030. Omdia’s 2026 figure appears in its October 1, 2026 channel analysis. Forrester’s numbers are survey percentages rather than dollars.

The published figures side by side

Table comparing Gartner, IDC, Omdia and Forrester cybersecurity spending forecasts for 2026 and 2027 with long-range figures, 2026 total bars and scope notes: Gartner $247.5bn and $276.1bn, IDC $310.4bn and $361.9bn, Omdia $315bn for 2026, Forrester 55 percent and 60 percent expecting at least a 5 percent budget increase
What each firm has published for 2026 and 2027, with the scope behind each number. Bars compare the firms’ 2026 totals on their own scopes. Gartner growth rates and CAGR are calculations from the detailed forecast file. Analysis by Louis Columbus, softwarestrategiesblog.com.

One caution on IDC’s published figures

IDC’s own public figures do not fully reconcile. A 2027 total of $361.9 billion that is “up 12.4% year on year” implies a 2026 base of about $322 billion. That is about $11.6 billion above the $310.42 billion in the V2 release. A 12.5% five-year path to $512.9 billion implies a 2025 base near $285 billion, while the V2 growth rate implies $274 billion. The likeliest explanation is that the event page draws on a later version of the guide. I show both as published and treat them as two snapshots rather than one series.

Line chart of Gartner's 2024 to 2030 worldwide security spending forecast against IDC's published points for 2026, 2027 and 2030 and Omdia's 2026 figure, showing gaps of $86 billion in 2027 and $140 billion in 2030
Gartner’s full 2024-2030 series against the points IDC and Omdia have published. The IDC-Gartner gap grows from $86B in 2027 to $140B in 2030. Analysis by Louis Columbus, softwarestrategiesblog.com.

Why IDC’s cybersecurity spending forecasts run $63 billion above Gartner’s in 2026 and $86 billion above in 2027

Start with what each firm counts. Gartner’s forecast is end-user spending across three markets. Security software is $126.9 billion in 2026, security services $93.5 billion and network security equipment $27.0 billion. That equipment is also the only hardware in a forecast Gartner publishes as 41 categories across 47 country and sub-regional rows. The 2026 total still includes $9.0 billion of consumer security software. Once the consumer line is stripped out, the business-only figure is $238.4 billion for 2026 and $266.8 billion for 2027.

IDC built its Worldwide Security Spending Guide on a wider frame. It covers 38 technology markets, including security hardware beyond network appliances, and then slices them by 28 industries and 48 countries. IDC said in March that software would be more than half of its $308 billion 2026 total and grow fastest, at 14%. The October V2 release lifted 2026 to $310.42 billion and the growth rate to 13.2%. That combination means IDC revised 2025 down and 2026 up at the same time.

Both firms tell roughly the same software-led growth story, although about differently sized markets. A $63 billion gap in 2026 that holds its proportion in 2027 is what a fixed scope difference looks like. Demand disagreements leave a different trail. If IDC saw stronger demand than Gartner, the gap would widen quickly. It does widen, but slowly, and almost entirely because of the long-range growth assumption discussed below.

Stacked bar chart showing how Gartner, IDC, Omdia and Forrester each divide cybersecurity spending in 2026: Gartner 51 percent software, 38 percent services, 11 percent network equipment. IDC more than half software. Omdia one-third technology and two-thirds services. Forrester 40 percent software and about 29 percent personnel
Each firm’s 2026 split of cybersecurity spending, in its own categories. Omdia’s two-thirds services share and Forrester’s personnel line have no equivalent in Gartner’s forecast. Analysis by Louis Columbus, softwarestrategiesblog.com.

Omdia’s two-thirds services share is the largest definitional split

Omdia’s $315 billion looks close to IDC’s $310 billion, but it gets there by a different route. Omdia says technology, meaning licenses, subscriptions and appliances, is roughly one-third of cybersecurity spending. Services spanning advisory, design and managed security are the other two-thirds. Its June 2026 figures were $106.4 billion for technology and $204.8 billion for services, out of $311 billion.

Gartner’s forecast inverts that ratio. Software plus network security equipment is $153.9 billion in 2026, $47.5 billion more than Omdia’s technology figure. Gartner’s security services total of $93.5 billion sits $111.3 billion below Omdia’s services figure, and that one difference is larger than the $63.5 billion gap between Omdia’s June total and Gartner’s.

Managed security shows how far apart the definitions sit. Gartner’s Managed Security Services subsegment is $32.3 billion in 2026, with managed detection and response at $11.5 billion of that and security operations at $15.6 billion. Omdia’s managed security services figure for 2026 is $106 billion, growing 14%, as cited by WithSecure’s MSP Cybersecurity Buyer’s Guide from Omdia’s MSSP Trends and Predictions. That one number is larger than Gartner’s entire security services market. Omdia is counting partner-delivered services that Gartner either books as product revenue or leaves outside the forecast.

For anyone selling security services, the implication is simple. Omdia’s figures describe the partner economy, and Gartner’s describe the services revenue that vendors recognize on their own books. Both are real answers, but to different questions.

Paired horizontal bar chart comparing Gartner and Omdia 2026 cybersecurity spending by type: technology $153.9 billion versus $106.4 billion, services $93.5 billion versus $204.8 billion, managed security $32.3 billion versus $106 billion
Gartner and Omdia 2026 figures by type. Omdia counts $111B more in services than Gartner, and its managed security figure alone is larger than Gartner’s total services market. Analysis by Louis Columbus, softwarestrategiesblog.com.

The one real disagreement is how fast growth slows after 2027

Once scope is set aside, the four cybersecurity spending forecasts agree on 2027 and differ on what follows. Gartner’s constant-currency growth falls every year in the 3Q26 file, from 12.7% in 2026 to 11.2% in 2027, 10.4% in 2028, 10.0% in 2029 and 9.6% in 2030, so the compound rate for 2025 to 2030 works out to 10.8%. The market adds $28.7 billion in 2027 and then $96.7 billion over the following three years, which is strong growth on a decelerating path.

IDC’s published path barely decelerates. After 13.2% in 2026 and 12.4% in 2027, the firm describes a 12.5% five-year compound rate to $512.9 billion by 2030. Getting from $361.9 billion in 2027 to $512.9 billion in 2030 requires 12.3% a year for three more years, which is flat growth rather than a slide toward single digits. By 2030 the gap between IDC’s compound rate and Gartner’s year-on-year rate reaches 2.9 percentage points.

Why the 2030 numbers are $140 billion apart

That difference compounds, so the dollar gap widens every year. In 2027 the two totals are $86 billion apart, and by 2030 the distance reaches $140 billion, or about 38% of Gartner’s own 2030 total. Had IDC’s figure grown at Gartner’s rates from 2027 instead, it would reach about $489 billion in 2030. The gap would then be $116 billion, leaving $24 billion that comes from the growth assumption alone.

That leaves the 2028 to 2030 call as a call about AI. Either AI-driven security demand sustains low-teens growth, or platform consolidation and budget pressure pull it toward 10%. Consolidation is the Gartner case, while sustained AI demand is IDC’s. Gartner’s own forecast assumptions also back that reading. By 2029 it expects 52% of organizations to use fewer than 10 cybersecurity tools, up from 21% in 2025, according to Forecast Analysis: Information Security, Worldwide, 2026 (G00838442).

Line chart of year-on-year growth in worldwide security spending showing Gartner's constant-currency path falling from 12.7 percent in 2026 to 9.6 percent in 2030 against IDC's 13.2 percent, 12.4 percent and 12.5 percent five-year compound rate
Growth rates in the cybersecurity spending forecasts for 2027 and beyond. Gartner’s path declines every year through 2030, while IDC’s published points and its 12.5% five-year rate stay above 12%. Analysis by Louis Columbus, softwarestrategiesblog.com.

Forrester measures budgets, not markets, and the mood improved

Forrester built its Budget Planning Guide 2027: Security And Risk Leaders Must Confront The AI Cost Explosion from a survey of more than 2,600 business and technology decision-makers. The guide produces no market size, and that is useful here. Budgets include headcount, training, insurance and now what Forrester calls “token economics,” the inference costs of running AI inside security operations, none of which any vendor forecast counts.

The headline is a modest, consistent improvement. For 2027, 60% of security decision-makers expect their budgets to rise by at least 5%, with 16% expecting more than 10% and 44% expecting 5% to 10%. A year earlier the same questions for 2026 returned 55%, split 15% and 40%. Across all technology decision-makers, 82% expect budgets to rise in 2027, although the regional detail for 2026 showed how uneven that optimism was. Only 9% of North American security leaders expected more than 10% growth, against 14% in Europe and 22% in Asia Pacific.

Forrester’s budget composition data explains why its figures do not map onto Gartner’s or IDC’s cybersecurity spending forecasts for 2027. Citing Information Services Group data for 2025, Forrester says software is about 40% of security budgets. That outpaces hardware and outsourcing combined and, in Forrester’s wording, exceeds personnel-related costs by 11%. Read as percentage points, that puts personnel near 29% of the budget, the second-largest line a CISO carries and one that no market forecast includes. A security budget growing 5% to 10% is consistent with a vendor market growing 11% to 13%, provided staff costs grow more slowly than software and services. Two years of consolidation and automation point that way.

Stacked bar chart of Forrester survey results showing 55 percent of security decision-makers expected at least a 5 percent budget increase for 2026 and 60 percent expect it for 2027, with a side panel showing 9 percent of North American, 14 percent of European and 22 percent of Asia Pacific leaders expecting more than 10 percent growth for 2026
Forrester’s security budget surveys for 2026 and 2027. The share expecting at least a 5% increase rose from 55% to 60%. Analysis by Louis Columbus, softwarestrategiesblog.com.

What Gartner’s CISO research adds to the demand picture

Gartner’s own planning research for the same cycle points the same way, and it adds two cost drivers that none of the market forecasts isolates. CISO Agenda Priority: Align Cybersecurity Investment With Board Risk Appetite (G00862663) states that the cybersecurity challenge “is no longer primarily a budget problem” and that boards are deliberately increasing risk appetite to accelerate AI adoption. The money is there, so the argument is about where it goes.

On staffing, the 2027 Planning Guide for Cybersecurity (G00856222) says the SOC workforce will transform rather than shrink as AI agents arrive. Gartner projects that by 2028 security operations teams will employ 50% more engineers than traditional analysts, which keeps Forrester’s personnel line intact even as vendor spending grows. The Cybersecurity Executive Outlook, 4Q26 (G00861818) reports that 51% of CISOs have not begun any post-quantum cryptography activity and predicts that organizations that do not begin piloting PQC by 2027 will pay 200% higher costs for full migration. Those are reasons for 2027 budgets to keep rising regardless of how a market is scoped.

The securing-AI gap is wider than the market gap

The sharpest divergence between the cybersecurity spending forecasts for 2027 is in the newest category. Gartner’s securing-AI forecast appears in Forecasting the $16.4 Billion Opportunity in Securing AI (G00853861) and carries into the 2Q26 and 3Q26 information security forecasts. It has spending on securing AI at about $3 billion in 2026 before rising to $16 billion in 2030. That implies growth of roughly 52% a year, although from a small base. The category sits inside Gartner’s security software total rather than beside it.

IDC’s IT Security event page states that spending on securing AI will reach $58.3 billion in 2027, “compounding at 37.8% a year.” It calls this “the fastest-moving segment in security.” The source is IDC’s Worldwide Artificial Intelligence Security Spending Forecast, 2025-2029. That 2027 figure is 3.6 times Gartner’s 2030 figure, three years earlier.

A gap of that size comes from definitions. IDC’s event page does not say what the $58.3 billion counts, and its scale points to a far broader set of spending than Gartner’s, plausibly including AI-enabled security tooling and services. Gartner’s securing-AI line covers only the spend on protecting AI models, agents and data. A third number, Gartner’s AI-amplified security forecast, reaches $204 billion by 2030 and is a different construct again. The firm’s February analysis says so itself, stating that AI-amplified security “is not additive spending and will not change security spending” (G00838442). I covered it in an earlier post linked below. Anyone quoting an “AI security market size” needs to say which of these three definitions they mean.

Bar chart comparing Gartner's securing AI forecast of $3 billion in 2026 and $16 billion in 2030 with IDC's $58.3 billion securing AI figure for 2027
Gartner’s securing-AI forecast against IDC’s. IDC’s 2027 figure is 3.6 times Gartner’s 2030 figure, a difference of definition rather than demand. Analysis by Louis Columbus, softwarestrategiesblog.com.

Nearly half of the gap sits in the United States

Regional detail shows where IDC’s extra scope lands. IDC’s March release put the United States at $150 billion for 2026. Gartner’s 3Q26 file has the United States at $119.5 billion, so the $30.5 billion difference is nearly half of the $63 billion gap between the two totals. Gartner then has the US rising to $133.6 billion in 2027 and $181.1 billion in 2030.

Europe is closer than the worldwide totals imply. IDC has Western Europe at $69 billion, while Gartner’s Europe region, which includes Central and Eastern European countries, sums to $64.0 billion. Even a broader Gartner region lands $5 billion below a narrower IDC one. In Asia/Pacific excluding Japan and China, IDC’s $26 billion sits $8.3 billion above the $17.7 billion in Gartner’s Mature and Emerging Asia/Pacific regions combined. As a ratio, that is the widest regional gap of the three. IDC runs at 1.47 times Gartner’s figure there, against 1.26 in the United States and 1.08 in Europe.

The US-heavy gap fits the scope story, because the United States has the deepest market for security hardware, managed services and industry-specific security spending. Those are also the three areas where IDC’s definitions extend furthest beyond Gartner’s.

Dumbbell chart comparing Gartner and IDC 2026 security spending by region: United States $119.5 billion versus $150 billion, Europe $64 billion versus $69 billion for Western Europe, Asia/Pacific excluding Japan and China $17.7 billion versus $26 billion
Gartner and IDC 2026 regional figures. The United States accounts for $30.5B of the $63B gap between the two firms’ worldwide totals. Analysis by Louis Columbus, softwarestrategiesblog.com.

How to use four cybersecurity spending forecasts for 2027 that do not agree

  • Pick the forecast that matches your question, then stay with it. Vendor revenue planning and competitive share analysis belong on Gartner’s end-user spending basis, because that is how most public security vendors are benchmarked. Channel and services strategy belongs on Omdia’s partner-centric total, while hardware-inclusive or industry-vertical sizing belongs on IDC. Switching bases mid-analysis is how a 12% growth market gets misreported as a 30% one.
  • Quote growth rates before you quote totals. The four cybersecurity spending forecasts agree that 2026 grows 12.7% to 13.6% and 2027 grows 11.2% to 12.4%. Those are the defensible numbers, while totals carry scope assumptions that most audiences will not check.
  • Treat 2028 to 2030 as the open question. Gartner’s path heads for 9.6% growth by 2030 while IDC’s stays near 12.5%. Plans built on the IDC trajectory have about $140 billion more market to divide by 2030 than plans built on Gartner. Watch Gartner’s 4Q26 update and IDC’s next guide version for which way the 2028 numbers move.
  • Use Forrester as the demand-side check. The share of security leaders expecting at least a 5% budget increase rose from 55% to 60%. If it keeps rising, the vendor forecasts’ low-teens growth has budget support. A decline would instead make Gartner’s deceleration the base case.
  • Never cite an AI security market size without its definition. $3 billion, $16 billion, $58.3 billion and $204 billion are all current analyst figures for some version of “AI security.” They describe four different things.

Frequently asked questions

What do the cybersecurity spending forecasts say the market is worth in 2027?

Among the published cybersecurity spending forecasts for 2027, Gartner’s is the lowest at $276.1 billion in worldwide information security end-user spending. That is up 11.6% in current dollars and 11.2% in constant currency. IDC’s published figure is $361.9 billion, up 12.4%. The $86 billion difference reflects IDC’s broader scope, which includes security hardware across 38 technology markets, and the two firms’ 2027 growth rates sit within 1.2 points of each other.

Why do IDC’s cybersecurity spending forecasts run higher than Gartner’s for 2027?

IDC’s Worldwide Security Spending Guide counts hardware, software and services across 38 markets, 28 industries and 48 countries. Gartner counts security software, security services and network security equipment in 41 categories. Nearly half of the 2026 gap, $30.5 billion of $63 billion, is in the United States, because hardware, managed services and industry-specific spending are largest there.

What does Omdia forecast for cybersecurity spending?

Omdia’s October 2026 figure is $315 billion for 2026, up 13%, with technology about one-third and services about two-thirds. Its earlier June 2026 breakdown was $106.4 billion for technology and $204.8 billion for services on a $311 billion total. Omdia’s 2027 and five-year figures remain available only to subscribers, unlike its 2026 headline.

What does Forrester say about 2027 security budgets?

In Forrester’s Budget Planning Guide 2027 survey, 60% of security decision-makers expect at least a 5% budget increase for 2027. Of those, 16% expect more than 10% and 44% expect 5% to 10%. The previous year’s survey for 2026 returned 55%, 15% and 40%.

Are the cybersecurity spending forecasts for 2026 and 2027 rising or falling?

For 2026, every firm’s number is higher than when the year began. Gartner’s went from $244.2 billion in 4Q25 to $248.2 billion in 2Q26, then eased to $247.5 billion in 3Q26. IDC’s rose from $308 billion to $310.42 billion, while Omdia’s rose from $311 billion to $315 billion. For the longer range, Gartner forecasts growth slowing to 9.6% by 2030, while IDC’s published five-year rate holds at 12.5%.

How I built this analysis

I computed the Gartner figures from the detailed data file behind Forecast: Information Security, Worldwide, 2024-2030, 3Q26 (G00862059). That file contains 13,489 rows of end-user spending by year, region, country, market, subsegment and category, in both current and constant currency. Its accompanying report confirms the totals and the 2029 and 2030 growth rates, and Forecast Analysis: Information Security, Worldwide, 2026 (G00838442) supplies the forecast assumptions quoted above. CISO and planning-guide statements come from CISO Agenda Priority: Align Cybersecurity Investment With Board Risk Appetite (G00862663), 2027 Planning Guide for Cybersecurity (G00856222) and The Cybersecurity Executive Outlook, 4Q26 (G00861818). Totals, growth rates, segment shares, regional sums and the 2025-2030 CAGR are my calculations from that file. Securing-AI figures come from Forecasting the $16.4 Billion Opportunity in Securing AI (G00853861), as carried into the 2Q26 and 3Q26 forecasts.

Where the IDC, Omdia and Forrester figures come from

IDC figures are as published in its March 3, 2026 press release, its October 28, 2026 blog on the V2 release of the 2026 Worldwide Security Spending Guide, and its IT Security event page. That page cites the spending guide and the Worldwide Artificial Intelligence Security Spending Forecast, 2025-2029. The implied 2026 base of about $322 billion in the event-page series is my calculation rather than an IDC figure.

Omdia figures come from its October 1, 2026 channel analysis as well as the June 2026 figures published by Omdia’s Jay McBain. The managed security figure is as cited by WithSecure from Omdia’s MSSP Trends and Predictions. Forrester figures come from its Budget Planning Guide 2027 press release and coverage, together with its July 2025 Security Planning 2026 blog and its Predictions 2027 release. The Forrester personnel share of about 29% reads Forrester’s statement that software exceeds personnel-related costs by 11% as a percentage-point gap below the 40% software share. Read as a relative 11%, personnel would be about 36%, and either reading leaves personnel as the second-largest budget line.

I built all charts comparing the cybersecurity spending forecasts for 2027 from these figures and labeled each with its sources. Where a figure is an estimate or a derived value, the chart and text say so.

Related comparisons

Sources

This post is my personal analysis and does not represent my employer.

Nov 5

Gartner’s secure AI Hype Cycle predicts twice the incidents without preproduction offensive GenAI testing

Secure AI Hype Cycle overview. Gartner forecasts twice as many incidents by 2028 without preproduction testing as among proactive users. Of 24 technologies, one is under two years from mainstream adoption, 17 are two to five years away and six are five to ten years away.
Gartner, Hype Cycle for Secure AI, 2026 (G00846820), October 12, 2026. Incident comparison is a forecast. Technology counts and shares are my calculations from the complete Priority Matrix. Analysis and graphic by Software Strategies Blog. Click to open full size.

Gartner’s secure AI Hype Cycle predicts that enterprises skipping preproduction offensive testing of generative AI deployments will face twice as many cybersecurity incidents by 2028 as proactive users. That is a forecast, not a measured outcome.

Funding is already a constraint. Among organizations piloting or implementing offensive AI security technologies, 50% have either not secured funding or diverted money from existing cybersecurity initiatives. This finding describes surveyed adopters, not half of all enterprises.

Meanwhile, my count of the complete Priority Matrix puts 23 of 24 technologies at least two years from mainstream adoption. Security teams therefore need to control deployed agents before most specialist markets mature. The immediate questions are what each agent can do, which controls enforce its limits and what a new product would add.

Gartner’s Hype Cycle for Secure AI, 2026 (G00846820), published October 12, 2026, separates controls for employee AI use, enterprise-built applications and agents acting across systems. Those distinctions make it useful for testing a security architecture, not simply compiling a vendor shortlist.

Gartner’s original Hype Cycle for Secure AI, 2026, with all technology labels, adoption markers and phase labels.
Gartner, Hype Cycle for Secure AI, 2026 (G00846820), October 12, 2026, Figure 1, page 6. © 2026 Gartner, Inc. Click to open the full-size graphic.

Read more

Oct 26

20 Cybersecurity Startups to Watch in 2027

Bar chart ranking the latest verified funding round of each of the 20 cybersecurity startups to watch in 2027, from Island and Cyera at $400 million to Opal Security at $23 million, colored by the six sections of the article
Eighteen of the 20 closed their latest round in 2026. Bars show announced rounds, not total funding or valuation. Click the chart to open it full size.

Cyera paid $1 billion for Oasis Security and closed the deal on Sept. 3, 2026, 37 days after Globes reported the agreement on July 28. In late June, Oasis had made CRN’s list of the 10 hottest cybersecurity startups of 2026 so far. Startup lists go stale fast. Notable Capital’s Rising in Cyber 2026 names 30 companies picked by 150 CISOs and security executives, with funding data as of Q1 2026. A CISO setting a 2027 budget needs something narrower from both lists. Which young vendors produced evidence this year that they will still be independent, shipping and staffed when the contract renews?

Dot chart of each company's latest 2026 funding round by announcement date, showing 14 of the 20 rounds landing after March 31 and 12 after CRN's June 26 list, with markers for Notable Capital's Q1 data, the CRN list and Cyera completing its Oasis acquisition on Sept. 3
Each dot is a company’s latest verified round, placed on its announcement date. Keycard and 7AI raised in late 2025 and are not shown.

That question picked these 20. Every company here produced at least one verified 2026 event beyond a valuation, whether a priced round, a named production customer, a shipped product or a public technical result. Valuation earned no one a spot. Eleven of the 20 appear on neither the CRN nor the Notable list.

Eighteen of the 20 closed their latest round in 2026. That money turns into hires, product launches and sales coverage next year, when buyers will feel it. Several companies here have already tied specific 2027 deliverables to the cash.

The research cutoff is Oct. 17, 2026. To qualify, a company had to be privately held and independent on that date. Late-stage companies qualify under the same rule as seed-stage ones, so Cyera and Island stay in. A completed acquisition disqualifies a company. So does an announced sale, which is why Oasis is out.

Securing AI agents company profiles for Onyx Security, HiddenLayer, Reco and Harmonic Security, showing each company's latest verified round, total funding where disclosed, buyer, 2027 watch item and what to validate
Securing AI agents at a glance. Bars share one scale across all six sections.

Read more

Oct 12

Gartner says frontier AI makes patch speed a vanity metric. Tolerable exposure time replaces it.

Gartner frontier AI vulnerability management hero chart showing 2026 and 2030 spending on managed security operations, vulnerability assessment, threat intelligence and network detection and response, with six tiles summarizing Gartner's findings on exploit timing, patch metrics, testing bottlenecks, actions, regulator deadlines and the 2026 trends
Gartner says frontier AI turns patch speed into a vanity metric. Spending bars show the exposure-focused categories in Gartner’s 3Q26 security forecast. Click any chart to open it full size. Sources: Gartner (G00859901, Aug. 6, 2026; G00862059, Sept. 24, 2026), analysis by softwarestrategiesblog.com.

Gartner’s new research on frontier AI vulnerability management says the patch-speed metric most security teams report to their boards no longer measures anything useful.

Gartner analysts Rob McMillan and Alex Michaels put it bluntly in a research note published August 6: “Measuring ‘how fast we patch’ is a vanity metric; the only metric that matters now is ‘tolerable exposure time.'”

The note covers one of Gartner’s nine top cybersecurity trends for 2026: frontier AI models transforming vulnerability management. Its central argument runs against most vendor messaging. The real shock from frontier AI is not faster attackers. It is the volume of vulnerabilities that vendors and open-source projects will now find in their own code, and the flood of urgent updates that follows.

Gartner calls it a supply side shock, one that “permanently breaks traditional volume-based patching processes.”

I built this analysis from Gartner’s research note (G00859901) and paired it with category data from Gartner’s 3Q26 information security forecast (G00862059), which sizes the markets security teams will buy from as they shift to exposure management.

The bars in the hero chart show 2026 and 2030 end-user spending for four exposure-focused categories. Six tiles underneath summarize the note’s core findings.
Read more

Oct 5

Gartner’s $247.5B security forecast makes post-quantum firewall refreshes the only upgrade through 2030

Gartner information security forecast 2024 to 2030 showing spending rising from $192.9 billion to $372.8 billion by software, services, network and consumer security, with six KPI tiles below the chart for 2026 and 2030 totals, new spending, the firewall revision, 2027 firewall growth and securing AI
Security spending climbs to $372.8B by 2030, and post-quantum firewall refreshes drew the only upgrade. Click any chart to open it full size. Source: Gartner (G00862059, Sept. 24, 2026), analysis by softwarestrategiesblog.com.

The 3Q26 Gartner information security forecast raised exactly one growth rate.

Gartner now projects firewall equipment spending to grow 13.4% in 2027 in constant currency, up from the 7.8% in its June forecast. Network security equipment overall rises to 12.8% from 8.7%. Post-quantum cryptography (PQC) is the cause. Many installed firewalls can’t run the new algorithms, which forces early replacement.

Every other business category in the 41-category forecast kept the constant-currency outlook it had 91 days earlier.

Published September 24, the forecast puts worldwide end-user spending at $247.5 billion in 2026, up 13.6% in current U.S. dollars and 12.7% in constant currency.

Spending reaches $372.8 billion by 2030. Gartner frames that as $373 billion and a 10.8% compound annual growth rate in constant currency from 2025 through 2030.

I built this analysis from Gartner’s 3Q26 report (G00862059), the full detailed dataset of 13,489 rows covering 47 countries, 9 regions, 41 categories and 7 years, and a line-by-line comparison against the 2Q26 file Gartner released in June (G00855892).

For the 2Q26 update that first counted securing AI inside the forecast, see Gartner’s $248.2B security forecast makes securing AI the only segment accelerating through 2030.

Each bar in the hero chart stacks four parts of Gartner’s forecast in current U.S. dollars. Navy is business security software, mid-blue is security services, sky blue is network security and light blue is consumer security software. Bold figures above the bars give each year’s total, with Gartner’s constant-currency growth rate in italics.

Six tiles underneath carry the 2026 and 2030 totals, the $125.4 billion in new spending between 2026 and 2030, the 2030 firewall revision in constant currency, the change in Gartner’s 2027 firewall growth forecast and the securing AI trajectory.

Both the 56% software share and the $80.5 billion software tile include consumer security software.
Read more

Aug 17

Gartner’s AI security forecast exposes 162x services growth that still trails software 2 to 1 in new spending

Gartner AI-amplified security forecast, growth multiple versus net-new dollars by segment, 2024 to 2030

Growth multiple versus net-new dollars added, 2024 to 2030. The segment ranking inverts between the two measures.

Every chart and table in this analysis opens full size when you click it.

Security services inside Gartner’s AI-amplified security market were worth $364 million in 2024. Gartner now projects $59 billion by 2030. That is 162 times larger in six years, compounding at 133.5% annually, the steepest curve anywhere in the forecast. I have tracked this forecast through every quarterly update, and no segment has ever moved like this one.

What Is AI-Amplified Security?

Gartner’s term for the share of existing security spending flowing to products with AI built in. Endpoint protection, firewalls, identity, and network security that now embed AI-driven detection, autonomous remediation, and agent-based response. Not a new category. Existing budgets redirecting toward AI-native capabilities. The companion forecast for securing AI itself reaches $16.4 billion in 2030. Gartner publicly confirms the 75%-by-2028 adoption projection.

The share table and the dollar table tell different stories. Software’s share of this market falls from 87.1% to 61.3%, and services picks up almost every point software gives up. Read only that and you conclude software is losing. Run the arithmetic on net-new spending and software still collects $116.5 billion of the $194.4 billion the market adds between 2024 and 2030. That is 60 cents of every new dollar, and it puts software ahead of services 2 to 1 on net-new spending.

Both things are true at once, and the gap between them is where security budgets get set wrong.

The numbers come from Gartner’s Forecast Analysis: AI-Amplified Security, Worldwide, 2026 (G00846160, August 4, 2026) by Shailendra Upadhyay. It is the first time Gartner has split AI-amplified security into software, services, and network security across a full seven-year window. The totals reconcile cleanly with the 2Q26 AI spending forecast, which carried AI-amplified security at $204.5 billion in 2030 without breaking out the segments underneath it.

Read more

Aug 10

34% of enterprises govern AI with policies they only partly follow. Gartner’s first AI Governance Hype Cycle shows CISOs what to fund first.

Gartner Hype Cycle for AI Governance, 2026, plotting AI governance platforms, AI TRiSM, AI agent identity and responsible AI across the innovation trigger, peak, trough and slope stages

Gartner Hype Cycle for AI Governance, 2026, showing AI cybersecurity governance, AI governance platforms, and agentic AI risk innovations plotted across the innovation trigger, peak, trough, slope, and plateau phases. Please click on the graphic to expand for easier reading.

Gartner’s 2026 AI Leaders Effectiveness Survey found that 34% of organizations have well-defined AI governance structures and policies for managing risks, ethics, and compliance. Those same organizations report only partial adherence to the rules they wrote, while another 22% still rely on basic or ad hoc policies. Only 7% qualify as recognized leaders in ethical AI.

That gap between writing the policy and living by it is what Gartner’s first Hype Cycle for AI Governance, 2026 is built to address. Published July 21, 2026, the inaugural cycle plots 32 innovations and ranks each by benefit rating and years to mainstream adoption. CISOs and enterprise architects get a planning map that builds on Gartner’s forecast that agentic AI will overtake chatbot spending by 2027. Throughout this post, I use “rogue agents” as my editorial shorthand for unsanctioned AI agents operating outside governance perimeters.

The two clusters that carry the security agenda

The report organizes its 32 innovations around six enterprise trends. Two carry the security agenda. Agentic AI oversight and life cycle governance is the first, grouping agentic AI governance, agent development life cycle, AI agent identity, AI engineering, AI gateways and AI governance platforms under one trend. Advancing AI security is the second, covering AI TRiSM, AI cybersecurity governance, disinformation security, zero-trust data governance, mechanistic interpretability and AI product attribution and transparency. Together they define where governance stacks connect to identity systems, traffic controls and incident response playbooks. For how these gaps show up in spending data, see my analysis of Gartner’s $248.9B security forecast.

Five innovations that pay off in under two years

Table 1, the Priority Matrix, ranks every innovation by benefit rating and adoption timeline. Only five entries land in the “Less Than 2 Years” column. Responsible AI sits alone in the Transformational row, Gartner’s highest rating. AI guardrails, data access governance, digital ethics and ontologies all carry High benefit ratings at the same timeline. Gartner calls these the near-term priorities for scalable governance. CISOs should fund them first.

Table 1: Gartner Priority Matrix for AI Governance, 2026, mapping transformational, high, moderate and low benefit innovations against years to mainstream adoption

Please click on the image to expand for easier reading.

The two-to-five-year column is the densest band. Thirteen innovations carry a High benefit rating there, including agentic AI governance, AI agent identity, AI TRiSM, zero-trust data governance and third-party risk management. That band is where CISOs will build governance stacks over the next several budget cycles. For context on spending already flowing to AI-related capabilities, see my breakdown of Gartner’s $244.2B security forecast.

Where AI cybersecurity governance actually lands

AI cybersecurity governance carries a Moderate benefit rating at the Innovation Trigger, five to ten years from mainstream adoption. That placement may surprise CISOs who expected Gartner to rate it higher. The profile’s key goals are to prevent shadow AI, minimize attack surfaces and ensure visibility and response to incidents. The placement is a market signal, not a dismissal. Tooling is early, but the need is urgent enough that CISOs should treat AI cybersecurity governance as an architecture requirement today.

What the Priority Matrix tells your board

The report leads with two strategic planning assumptions that carry board-level weight. Enterprises implementing AI governance will outperform ungoverned competitors in AI adoption by 25% by 2029. The downside is just as concrete. Autonomous agents identifying minor consumer rights violations and turning them into lawsuits will increase corporate settlement costs by 15% over the same period. Growth-oriented executives respond to the first number. Risk-averse ones respond to the second.

Turning the curve into controls

Start by mapping your AI agent footprint, sanctioned and unsanctioned, across SaaS platforms, internal applications and shadow IT. From there, match the Hype Cycle’s innovations to four governance domains. The identity and access layer runs on AI agent identity and AI governance platforms. Data classification draws on AI guardrails, data access governance and zero-trust data governance, while AI gateways and AI TRiSM handle traffic mediation. Agent risk management anchors in agentic AI governance and the agent development life cycle. Build all four as shared services. For how agent sprawl is reshaping security spending, see my roundup of agentic AI forecasts and market estimates, 2026.

What these numbers add up to

Gartner’s inaugural Hype Cycle for AI Governance puts 32 innovations on the curve. Only five reach mainstream adoption in under two years. The security-relevant capabilities cluster in the two-to-five-year band, which means CISOs have a narrow window to build governance stacks before agent footprints outpace controls. The 34% adherence stat is the warning, and the Priority Matrix is the roadmap out of it.

This post is my personal reflection on Gartner’s AI governance research from a CISO and enterprise architecture perspective. It does not represent any employer or client.

Source: Gartner, Hype Cycle for AI Governance, 2026, Svetlana Sicular, Var Shankar, Lauren Kornutick, Sumit Agarwal, 21 July 2026, G00854164.

For each month’s AI agent attacks, exploited CVEs and breaches with primary sources, see my monthly AI security news briefing.

Aug 5

Gartner’s $5.95 trillion AI forecast puts the chatbot era on a 2027 deadline

Chart from Gartner's 2026 AI spending forecast: embedded chatbot spending peaks at $272.6B in 2027 then declines to $205.8B by 2030 while embedded agentic AI rises to $1,003.6B

Spending on the chatbots and assistants embedded in enterprise software peaks at $272.6 billion in 2027 and then shrinks every year through 2030. Gartner buried that projection inside the 2Q26 update of its worldwide AI spending forecast, published July 24, and it matters more than the headline total. By 2030, embedded chatbot spending falls back to $205.8 billion, a hair above its 2025 starting point.

Embedded agenticAI takes the money instead, growing from $88.2 billion in 2025 to $1 trillion by 2030, an 11.4x expansion inside a single software category.

None of that slows the topline. Worldwide AI spending reaches $2.67 trillion in 2026, up 49.5% from 2025, on its way to $5.95 trillion by 2030. The figure Gartner published in May was $2.59 trillion for this year. Ninety days later, the client-facing number runs $74.8 billion higher, and the firm added $496.8 billion to its comparable 2025 through 2030 outlook in a single quarter.

Four tables below show where the money lands, which segments stall, and what Gartner changed its mind about between April and July.

Where $5.95 trillion lands

Table: worldwide AI spending by market, 2025 to 2030, in billions of dollars, from AI infrastructure at $2,792.9B to AI data at $20.7B, grand total $5,950.6B with 27.2% CAGR, Gartner July 2026

Infrastructure stays the biggest line through 2030 at $2.79 trillion, even as its share of total spending slides from 55% in 2025 to 46.9% at the end of the window. AI-optimized servers alone reach $981.7 billion by 2030, a 3.4x jump from 2025, and AI processing semiconductors add another $656.4 billion. O

One caution before quoting the total anywhere. Gartner’s note flags the forecast as a view across the whole AI value chain, so the chip and the server it ships inside both get counted. Read $5.95 trillion as the size of the AI economy, not as net end-user budgets.

Devices carry more of the infrastructure number than most readers expect. Business and consumer AI devices combine for $904.4 billion in 2030, and $647.4 billion of that is consumer hardware, the AI PCs and phones landing in shopping carts rather than data centers.

Growth flattens fast after next year. Total spending rises 49% in 2026 and 36% in 2027, then steps down to 21%, 18% and 15% through 2030, while infrastructure decelerates from 51% growth this year to 9% at the end of the forecast.

Of the $883.8 billion in net-new AI spending arriving in 2026, infrastructure absorbs $502.5 billion, or 57 cents of every new dollar. The shape of the curve says the buildout peaks now and software inherits the growth.

Farther down the board, AI cybersecurity at $220.9 billion and AI agents and assistants at $219.9 billion finish 2030 within $1 billion of each other. Gartner created the agents category only this quarter.

Agentic AI crosses $1 trillion inside enterprise software

Table: chatbots versus agentic AI worldwide spending, 2025 to 2030, showing embedded agentic AI growing 62.7% a year to $1,003.6B while embedded chatbots grow 0.6%, Gartner July 2026

Gartner rebuilt its segmentation this quarter, splitting cross-functional and consumer agents out of AI software and adding consumer agents to the forecast for the first time. The new structure exposes a replacement cycle the old rollup hid. Inside enterprise software, agentic AI overtakes chatbots in 2027, the same year chatbot spending tops out, and from that peak to 2030 the embedded chatbot line surrenders $66.8 billion.

Cross-functional agents, the ones that work across software from multiple vendors, start from a base of zero. Gartner books $347 million for cross-functional agentic AI in 2026 and $78.1 billion in 2030, a number it raised this quarter on the thesis that these agents begin cannibalizing traditional SaaS by decade’s end. The ceiling matters as much as the curve. Against $1.21 trillion in total 2030 AI software spending, $78.1 billion says the incumbents hold the decade, because data access, integration complexity and execution reliability hold the category back from serious SaaS competition until 2030, in Gartner’s read.

The buy-versus-build verdict is just as lopsided. Agent builder platforms, the tooling for constructing your own agents, reach only $12.6 billion by 2030, so embedded agentic AI outspends them nearly 80 to 1. The first production agent most companies run will ship inside software they already own. Gartner describes exactly that race, with vendors across software categories embedding agentic AI to defend their installed bases against cross-functional challengers.

Consumer agents barely register yet in dollar terms. Gartner carries $26.9 million for consumer agentic AI in 2026, then $17.7 billion in 2027 as paid consumer agents arrive at scale, building to $51.8 billion by 2030. Adding consumer agents and assistants lifted Gartner’s 2030 total by $133 billion. For how these agent numbers stack against other analyst estimates, see my roundup of agentic AI forecasts and market estimates, 2026.

AI security expands 8.5x and splits in two

AI cybersecurity grows from $25.9 billion in 2025 to $220.9 billion in 2030, an 8.5x expansion at a 53.5% compound rate. Spending in the category grew 140% in 2025, and Gartner models another 98% jump this year. AI cybersecurity and AI data were also the only two markets left completely untouched between the 1Q26 and 2Q26 forecasts, which makes security the steadiest conviction in the entire model. For the standalone security spending outlook, see my breakdown of Gartner’s 2Q26 information security forecast.

Two markets move at different speeds inside the category. AI-amplified security, meaning AI capability inside security tooling, carries the volume and reaches $204.5 billion by 2030. Securing AI, the discipline of protecting AI systems themselves, runs smaller and faster, from $1.5 billion in 2025 to $16.4 billion in 2030 at a 60.4% compound rate.

Set the security numbers against the agent forecast and an exposure gap opens. The 2030 outlook has enterprises running $1.08 trillion of embedded and cross-functional agentic software while spending $16.4 billion to secure AI systems, roughly $66 of agentic software for every $1 of securing-AI budget. AI observability and governance tooling adds just $3.9 billion more. A software wave that large riding on a security ratio that thin is the budget argument CISOs should be starting now.

The fastest growth goes to whatever cuts the bill

Table: the 10 fastest-growing AI segments 2025 to 2030, led by synthetic data generation at 142.5% CAGR and DSLMs at 84.5%, with securing AI at 60.4%, Gartner July 2026

Rank every segment by compound growth and one pattern jumps out, because the fastest-growing lines are the ones that make AI cheaper. Synthetic data generation leads the entire forecast at a 142.5% compound rate, expanding 84x from $146 million in 2025 to $12.2 billion in 2030. AI-ready datasets, the licensed real-data alternative, peak at $583 million in 2029 and then decline, leaving synthetic data outselling licensed data 22 to 1 by 2030. Gartner is forecasting the substitution of purchased data itself.

Domain-specific language models tell the same cost story at larger scale. DSLMs and specialized models grow 210% in 2026 and compound at 84.5% through 2030, rising from 12.2% of all model spend to 24.3%. Cost pressure also explains the strangest revision in the update. Gartner cut $57.8 billion in cumulative dollars from its generative AI model forecast while raising the segment’s 2026 growth rate from 110% to 117%, which nets out to more deployments running on cheaper models and smaller checks. Arunasree Cheparthi, a senior principal research analyst at Gartner and one of the forecast’s authors, said in the firm’s July 20 platforms and models announcement that spending “is shifting toward providers who can demonstrate clear value.”

What Gartner changed in 90 days

Table: what Gartner changed between its 1Q26 and 2Q26 AI spending forecasts, with AI infrastructure revised up $136.0B for 2030 and AI services revised down $11.2B

Between the April forecast and this one, Gartner added $500.8 billion to AI infrastructure across the 2025 through 2030 window, the largest revision in the update, and did it while flagging memory-related price increases. The note calls infrastructure demand inelastic to that pricing pressure, because hyperscalers keep buying AI-optimized servers on the conviction that model capabilities improve through 2030.

Gartner’s September consolidation research asks whether that infrastructure pays back. I compare its model with Goldman, Bain and J.P. Morgan in AI revenue gap forecasts compared; by my calculation the shortfall in Gartner’s model exceeds $6 trillion through 2032.

Software took the other side of the trade. AI software gained $191.9 billion and application development platforms picked up $10.7 billion. Gartner lifted the 2026 app-dev growth rate from 28% to 39% as enterprises build custom AI applications and demand usage tracking to prove the spend. The cuts land on everything that resembles consulting or plumbing. AI services lost $80.7 billion across the window, with every single year revised down, and platforms for data science and machine learning lost $68.2 billion, including an 8% cut to 2027 alone.

The services cut hides a structural shift rather than a retreat. Gartner still sizes AI services at $1.25 trillion in 2030, but the growth belongs to indirect services, which compound at 34.5% and pass direct, consulting-led engagements in 2028. Direct AI services compound at 15.7%, less than half the indirect rate. Buyers are routing transformation budgets through software and cloud purchases instead of billable hours.

Three dates to plan against

2027 is the year chatbot spending tops out and agentic AI takes over inside enterprise software, which gives any vendor still selling assistant-branded features through the end of next year to ride what growth remains. By 2028, indirect services pass consulting-led engagements and infrastructure growth drops to 15%, so the buildout stops flattering everyone’s numbers. And 2030 arrives with $1.08 trillion of agentic software guarded by $16.4 billion of securing-AI spend. The first two dates decide where the money goes, and the third decides what happens when it arrives unprotected.

This post is my personal reflection on Gartner’s AI spending research from an industry analyst perspective. It does not represent my employer.

Source: Gartner, Forecast: AI Spending, Worldwide, 2025-2030, 2Q26, Kay Arnott, Jon Erensen, Amarendra, Adrian O’Connell, Arunasree Cheparthi, Naresh Singh, Peter Middleton, Hardeep Singh, Shailendra Upadhyay, Rishi Padhi, 24 July 2026, G00855896.

Jul 6

Gartner securing AI forecast, 2Q26: securing AI turns Other Security Software into the only accelerating segment, 16.3% to 20.1% by 2030

Gartner’s $248.2B security forecast makes securing AI the only segment accelerating through 2030

Gartner's 2Q26 information security forecast puts 2026 spending at $248.2B and adds securing AI for the first time, making other security software the only segment accelerating through 2030.

Read more

Apr 1

Gartner’s $246.2B Security Forecast shows 10 categories growing 2x to 3x the market

$30.6 billion in new security spending in a single year. Gartner's 1Q26 Information Security forecast projects $246.2 billion in 2026 spending across 41 categories. Cloud Security Posture Management leads at 33.4% growth, followed by Threat Intelligence at 27.3% and Cloud Access Security Brokers at 27.2%. Two legacy categories are declining. I analyzed the full dataset to rank the 10 fastest-growing categories by growth rate and what they mean for CISO budgets.

Read more

« Older Entries