Skip to content

Posts from the ‘Cybersecurity Market Data’ Category

Oct 12

Gartner says frontier AI makes patch speed a vanity metric. Tolerable exposure time replaces it.

Gartner frontier AI vulnerability management hero chart showing 2026 and 2030 spending on managed security operations, vulnerability assessment, threat intelligence and network detection and response, with six tiles summarizing Gartner's findings on exploit timing, patch metrics, testing bottlenecks, actions, regulator deadlines and the 2026 trends
Gartner says frontier AI turns patch speed into a vanity metric. Spending bars show the exposure-focused categories in Gartner’s 3Q26 security forecast. Click any chart to open it full size. Sources: Gartner (G00859901, Aug. 6, 2026; G00862059, Sept. 24, 2026), analysis by softwarestrategiesblog.com.

Gartner’s new research on frontier AI vulnerability management says the patch-speed metric most security teams report to their boards no longer measures anything useful.

Gartner analysts Rob McMillan and Alex Michaels put it bluntly in a research note published August 6: “Measuring ‘how fast we patch’ is a vanity metric; the only metric that matters now is ‘tolerable exposure time.'”

The note covers one of Gartner’s nine top cybersecurity trends for 2026: frontier AI models transforming vulnerability management. Its central argument runs against most vendor messaging. The real shock from frontier AI is not faster attackers. It is the volume of vulnerabilities that vendors and open-source projects will now find in their own code, and the flood of urgent updates that follows.

Gartner calls it a supply side shock, one that “permanently breaks traditional volume-based patching processes.”

I built this analysis from Gartner’s research note (G00859901) and paired it with category data from Gartner’s 3Q26 information security forecast (G00862059), which sizes the markets security teams will buy from as they shift to exposure management.

The bars in the hero chart show 2026 and 2030 end-user spending for four exposure-focused categories. Six tiles underneath summarize the note’s core findings.
Read more

Oct 5

Gartner’s $247.5B security forecast makes post-quantum firewall refreshes the only upgrade through 2030

Gartner information security forecast 2024 to 2030 showing spending rising from $192.9 billion to $372.8 billion by software, services, network and consumer security, with six KPI tiles below the chart for 2026 and 2030 totals, new spending, the firewall revision, 2027 firewall growth and securing AI
Security spending climbs to $372.8B by 2030, and post-quantum firewall refreshes drew the only upgrade. Click any chart to open it full size. Source: Gartner (G00862059, Sept. 24, 2026), analysis by softwarestrategiesblog.com.

The 3Q26 Gartner information security forecast raised exactly one growth rate.

Gartner now projects firewall equipment spending to grow 13.4% in 2027 in constant currency, up from the 7.8% in its June forecast. Network security equipment overall rises to 12.8% from 8.7%. Post-quantum cryptography (PQC) is the cause. Many installed firewalls can’t run the new algorithms, which forces early replacement.

Every other business category in the 41-category forecast kept the constant-currency outlook it had 91 days earlier.

Published September 24, the forecast puts worldwide end-user spending at $247.5 billion in 2026, up 13.6% in current U.S. dollars and 12.7% in constant currency.

Spending reaches $372.8 billion by 2030. Gartner frames that as $373 billion and a 10.8% compound annual growth rate in constant currency from 2025 through 2030.

I built this analysis from Gartner’s 3Q26 report (G00862059), the full detailed dataset of 13,489 rows covering 47 countries, 9 regions, 41 categories and 7 years, and a line-by-line comparison against the 2Q26 file Gartner released in June (G00855892).

For the 2Q26 update that first counted securing AI inside the forecast, see Gartner’s $248.2B security forecast makes securing AI the only segment accelerating through 2030.

Each bar in the hero chart stacks four parts of Gartner’s forecast in current U.S. dollars. Navy is business security software, mid-blue is security services, sky blue is network security and light blue is consumer security software. Bold figures above the bars give each year’s total, with Gartner’s constant-currency growth rate in italics.

Six tiles underneath carry the 2026 and 2030 totals, the $125.4 billion in new spending between 2026 and 2030, the 2030 firewall revision in constant currency, the change in Gartner’s 2027 firewall growth forecast and the securing AI trajectory.

Both the 56% software share and the $80.5 billion software tile include consumer security software.
Read more

Aug 17

Gartner’s AI security forecast exposes 162x services growth that still trails software 2 to 1 in new spending

Gartner AI-amplified security forecast, growth multiple versus net-new dollars by segment, 2024 to 2030

Growth multiple versus net-new dollars added, 2024 to 2030. The segment ranking inverts between the two measures.

Every chart and table in this analysis opens full size when you click it.

Security services inside Gartner’s AI-amplified security market were worth $364 million in 2024. Gartner now projects $59 billion by 2030. That is 162 times larger in six years, compounding at 133.5% annually, the steepest curve anywhere in the forecast. I have tracked this forecast through every quarterly update, and no segment has ever moved like this one.

What Is AI-Amplified Security?

Gartner’s term for the share of existing security spending flowing to products with AI built in. Endpoint protection, firewalls, identity, and network security that now embed AI-driven detection, autonomous remediation, and agent-based response. Not a new category. Existing budgets redirecting toward AI-native capabilities. The companion forecast for securing AI itself reaches $16.4 billion in 2030. Gartner publicly confirms the 75%-by-2028 adoption projection.

The share table and the dollar table tell different stories. Software’s share of this market falls from 87.1% to 61.3%, and services picks up almost every point software gives up. Read only that and you conclude software is losing. Run the arithmetic on net-new spending and software still collects $116.5 billion of the $194.4 billion the market adds between 2024 and 2030. That is 60 cents of every new dollar, and it puts software ahead of services 2 to 1 on net-new spending.

Both things are true at once, and the gap between them is where security budgets get set wrong.

The numbers come from Gartner’s Forecast Analysis: AI-Amplified Security, Worldwide, 2026 (G00846160, August 4, 2026) by Shailendra Upadhyay. It is the first time Gartner has split AI-amplified security into software, services, and network security across a full seven-year window. The totals reconcile cleanly with the 2Q26 AI spending forecast, which carried AI-amplified security at $204.5 billion in 2030 without breaking out the segments underneath it.

Read more

Aug 5

Gartner’s $5.95 trillion AI forecast puts the chatbot era on a 2027 deadline

Spending on the chatbots and assistants embedded in enterprise software peaks at $272.6 billion in 2027 and then shrinks every year through 2030. Gartner buried that projection inside the 2Q26 update of its worldwide AI spending forecast, published July 24, and it matters more than the headline total. By 2030, embedded chatbot spending falls back to $205.8 billion, a hair above its 2025 starting point.

Embedded agenticAI takes the money instead, growing from $88.2 billion in 2025 to $1 trillion by 2030, an 11.4x expansion inside a single software category.

None of that slows the topline. Worldwide AI spending reaches $2.67 trillion in 2026, up 49.5% from 2025, on its way to $5.95 trillion by 2030. The figure Gartner published in May was $2.59 trillion for this year. Ninety days later, the client-facing number runs $74.8 billion higher, and the firm added $496.8 billion to its comparable 2025 through 2030 outlook in a single quarter.

Four tables below show where the money lands, which segments stall, and what Gartner changed its mind about between April and July.

Where $5.95 trillion lands

Infrastructure stays the biggest line through 2030 at $2.79 trillion, even as its share of total spending slides from 55% in 2025 to 46.9% at the end of the window. AI-optimized servers alone reach $981.7 billion by 2030, a 3.4x jump from 2025, and AI processing semiconductors add another $656.4 billion. O

One caution before quoting the total anywhere. Gartner’s note flags the forecast as a view across the whole AI value chain, so the chip and the server it ships inside both get counted. Read $5.95 trillion as the size of the AI economy, not as net end-user budgets.

Devices carry more of the infrastructure number than most readers expect. Business and consumer AI devices combine for $904.4 billion in 2030, and $647.4 billion of that is consumer hardware, the AI PCs and phones landing in shopping carts rather than data centers.

Growth flattens fast after next year. Total spending rises 49% in 2026 and 36% in 2027, then steps down to 21%, 18% and 15% through 2030, while infrastructure decelerates from 51% growth this year to 9% at the end of the forecast.

Of the $883.8 billion in net-new AI spending arriving in 2026, infrastructure absorbs $502.5 billion, or 57 cents of every new dollar. The shape of the curve says the buildout peaks now and software inherits the growth.

Farther down the board, AI cybersecurity at $220.9 billion and AI agents and assistants at $219.9 billion finish 2030 within $1 billion of each other. Gartner created the agents category only this quarter.

Agentic AI crosses $1 trillion inside enterprise software

Gartner rebuilt its segmentation this quarter, splitting cross-functional and consumer agents out of AI software and adding consumer agents to the forecast for the first time. The new structure exposes a replacement cycle the old rollup hid. Inside enterprise software, agentic AI overtakes chatbots in 2027, the same year chatbot spending tops out, and from that peak to 2030 the embedded chatbot line surrenders $66.8 billion.

Cross-functional agents, the ones that work across software from multiple vendors, start from a base of zero. Gartner books $347 million for cross-functional agentic AI in 2026 and $78.1 billion in 2030, a number it raised this quarter on the thesis that these agents begin cannibalizing traditional SaaS by decade’s end. The ceiling matters as much as the curve. Against $1.21 trillion in total 2030 AI software spending, $78.1 billion says the incumbents hold the decade, because data access, integration complexity and execution reliability hold the category back from serious SaaS competition until 2030, in Gartner’s read.

The buy-versus-build verdict is just as lopsided. Agent builder platforms, the tooling for constructing your own agents, reach only $12.6 billion by 2030, so embedded agentic AI outspends them nearly 80 to 1. The first production agent most companies run will ship inside software they already own. Gartner describes exactly that race, with vendors across software categories embedding agentic AI to defend their installed bases against cross-functional challengers.

Consumer agents barely register yet in dollar terms. Gartner carries $26.9 million for consumer agentic AI in 2026, then $17.7 billion in 2027 as paid consumer agents arrive at scale, building to $51.8 billion by 2030. Adding consumer agents and assistants lifted Gartner’s 2030 total by $133 billion. For how these agent numbers stack against other analyst estimates, see my roundup of agentic AI forecasts and market estimates, 2026.

AI security expands 8.5x and splits in two

AI cybersecurity grows from $25.9 billion in 2025 to $220.9 billion in 2030, an 8.5x expansion at a 53.5% compound rate. Spending in the category grew 140% in 2025, and Gartner models another 98% jump this year. AI cybersecurity and AI data were also the only two markets left completely untouched between the 1Q26 and 2Q26 forecasts, which makes security the steadiest conviction in the entire model. For the standalone security spending outlook, see my breakdown of Gartner’s 2Q26 information security forecast.

Two markets move at different speeds inside the category. AI-amplified security, meaning AI capability inside security tooling, carries the volume and reaches $204.5 billion by 2030. Securing AI, the discipline of protecting AI systems themselves, runs smaller and faster, from $1.5 billion in 2025 to $16.4 billion in 2030 at a 60.4% compound rate.

Set the security numbers against the agent forecast and an exposure gap opens. The 2030 outlook has enterprises running $1.08 trillion of embedded and cross-functional agentic software while spending $16.4 billion to secure AI systems, roughly $66 of agentic software for every $1 of securing-AI budget. AI observability and governance tooling adds just $3.9 billion more. A software wave that large riding on a security ratio that thin is the budget argument CISOs should be starting now.

The fastest growth goes to whatever cuts the bill

Rank every segment by compound growth and one pattern jumps out, because the fastest-growing lines are the ones that make AI cheaper. Synthetic data generation leads the entire forecast at a 142.5% compound rate, expanding 84x from $146 million in 2025 to $12.2 billion in 2030. AI-ready datasets, the licensed real-data alternative, peak at $583 million in 2029 and then decline, leaving synthetic data outselling licensed data 22 to 1 by 2030. Gartner is forecasting the substitution of purchased data itself.

Domain-specific language models tell the same cost story at larger scale. DSLMs and specialized models grow 210% in 2026 and compound at 84.5% through 2030, rising from 12.2% of all model spend to 24.3%. Cost pressure also explains the strangest revision in the update. Gartner cut $57.8 billion in cumulative dollars from its generative AI model forecast while raising the segment’s 2026 growth rate from 110% to 117%, which nets out to more deployments running on cheaper models and smaller checks. Arunasree Cheparthi, a senior principal research analyst at Gartner and one of the forecast’s authors, said in the firm’s July 20 platforms and models announcement that spending “is shifting toward providers who can demonstrate clear value.”

What Gartner changed in 90 days

Between the April forecast and this one, Gartner added $500.8 billion to AI infrastructure across the 2025 through 2030 window, the largest revision in the update, and did it while flagging memory-related price increases. The note calls infrastructure demand inelastic to that pricing pressure, because hyperscalers keep buying AI-optimized servers on the conviction that model capabilities improve through 2030.

Gartner’s September consolidation research asks whether that infrastructure pays back. I compare its model with Goldman, Bain and J.P. Morgan in AI revenue gap forecasts compared; by my calculation the shortfall in Gartner’s model exceeds $6 trillion through 2032.

Software took the other side of the trade. AI software gained $191.9 billion and application development platforms picked up $10.7 billion. Gartner lifted the 2026 app-dev growth rate from 28% to 39% as enterprises build custom AI applications and demand usage tracking to prove the spend. The cuts land on everything that resembles consulting or plumbing. AI services lost $80.7 billion across the window, with every single year revised down, and platforms for data science and machine learning lost $68.2 billion, including an 8% cut to 2027 alone.

The services cut hides a structural shift rather than a retreat. Gartner still sizes AI services at $1.25 trillion in 2030, but the growth belongs to indirect services, which compound at 34.5% and pass direct, consulting-led engagements in 2028. Direct AI services compound at 15.7%, less than half the indirect rate. Buyers are routing transformation budgets through software and cloud purchases instead of billable hours.

Three dates to plan against

2027 is the year chatbot spending tops out and agentic AI takes over inside enterprise software, which gives any vendor still selling assistant-branded features through the end of next year to ride what growth remains. By 2028, indirect services pass consulting-led engagements and infrastructure growth drops to 15%, so the buildout stops flattering everyone’s numbers. And 2030 arrives with $1.08 trillion of agentic software guarded by $16.4 billion of securing-AI spend. The first two dates decide where the money goes, and the third decides what happens when it arrives unprotected.

This post is my personal reflection on Gartner’s AI spending research from an industry analyst perspective. It does not represent my employer.

Source: Gartner, Forecast: AI Spending, Worldwide, 2025-2030, 2Q26, Kay Arnott, Jon Erensen, Amarendra, Adrian O’Connell, Arunasree Cheparthi, Naresh Singh, Peter Middleton, Hardeep Singh, Shailendra Upadhyay, Rishi Padhi, 24 July 2026, G00855896.

Jul 6

Gartner securing AI forecast, 2Q26: securing AI turns Other Security Software into the only accelerating segment, 16.3% to 20.1% by 2030

Gartner’s $248.2B security forecast makes securing AI the only segment accelerating through 2030

Gartner's 2Q26 information security forecast puts 2026 spending at $248.2B and adds securing AI for the first time, making other security software the only segment accelerating through 2030.

Read more

Apr 8

Top 10 security categories where VC funding trails Gartner’s 2026 growth forecast, Crunchbase data

Top 10 security categories where VC funding trails Gartner’s 2026 growth forecast, Crunchbase data

Two of Gartner’s 10 fastest-growing security categories have zero venture-backed startups. Firewall equipment, a $26.7 billion market by 2030, and pure-play cloud access security brokers, projected at $7.1 billion, are controlled entirely by incumbent vendors. No startup has raised a dollar in either category since January 2025.

I cross-referenced Gartner’s 1Q26 Information Security forecast against CB Insights, Crunchbase, and PitchBook funding data for every one of the 10 fastest-growing security categories. The question: where is venture capital following Gartner’s growth signal, and where is it missing?

The answer is stark. $93.2 billion in projected 2030 spending across these 10 categories. $11.2 billion in total VC raised by 59 funded startups. That is an 8.3:1 gap between where enterprise demand is heading and where startup capital is flowing. In 5 of 10 categories, the gap exceeds 12:1. As I detailed in last week’s analysis of the 10 fastest-growing categories, growth is concentrating in cloud infrastructure, proactive intelligence, and privacy compliance. The VC data tells you whether anyone is building what CISOs need to buy.

“Cybersecurity leaders are navigating uncharted territory this year as these forces converge, testing the limits of their teams in an environment defined by constant change,” said Alex Michaels, Director at Gartner. The spending data confirms it. The startup funding data shows the supply side has not caught up.

Two of Gartner’s 10 fastest-growing security categories have zero venture-backed startups. Firewall equipment, a $26.7 billion market by 2030, and pure-play cloud access security brokers, projected at $7.1 billion, are controlled entirely by incumbent vendors. No startup has raised a dollar in either category since January 2025. I cross-referenced Gartner’s 1Q26 Information Security forecast against CB Insights, Crunchbase, and PitchBook funding data for every one of the 10 fastest-growing security categories. The question: where is venture capital following Gartner’s growth signal, and where is it missing? The answer is stark. $93.2 billion in projected 2030 spending across these 10 categories. $11.2 billion in total VC raised by 59 funded startups. That is an 8.3:1 gap between where enterprise demand is heading and where startup capital is flowing. In 5 of 10 categories, the gap exceeds 12:1. As I detailed in last week’s analysis of the 10 fastest-growing categories, growth is concentrating in cloud infrastructure, proactive intelligence, and privacy compliance. The VC data tells you whether anyone is building what CISOs need to buy. “Cybersecurity leaders are navigating uncharted territory this year as these forces converge, testing the limits of their teams in an environment defined by constant change,” said Alex Michaels, Director at Gartner. The spending data confirms it. The startup funding data shows the supply side has not caught up. ▼ GRAPHIC: GRAPHIC 2 — Paired bar chart: Gartner 2030 projection vs. VC raised (insert before master table) ▼ Figure 2: Gartner 2030 projections (dark) vs. total VC raised (light) for each of the 10 categories. The master table: Gartner forecast vs. startup funding by category I mapped each Gartner category against every cybersecurity startup that raised equity or debt since January 2025. Each company is assigned to one primary category to avoid double-counting. Gap Ratio is the Gartner 2030 market projection divided by total VC raised. Higher means wider gap. # Gartner Security Category 2025-26 GR 5yr CAGR 2030 Proj Startups Total VC Gap Ratio Verdict 1 Cloud Access Security Brokers (CASB) 27.2% 24.3% $7.1B 4 $182M 39:1 Critical Gap 2 Firewall Equipment (NGFW/FWaaS) 15.9% 9.1% $26.7B 0 $0 ∞ Incumbent Lock 3 Cloud Security Posture Mgmt (CSPM) 33.4% 27.6% $16.2B 6 $752M 21.5:1 Underfunded 4 Vulnerability Assessment 15.7% 12.0% $6.4B 6 $306M 20.9:1 Underfunded 5 Cloud Workload Protection (CWPP) 25.9% 21.0% $16.1B 8 $1.28B 12.6:1 Underfunded 6 Subject Rights Request Automation 16.2% 12.3% $2.3B 2 $240M 9.6:1 M&A Absorbed 7 Network Detection & Response (NDR) 15.6% 12.4% $4.1B 4 $701M 5.9:1 Moderate Gap 8 Zero Trust Network Access (ZTNA) 23.0% 20.9% $6.4B 10 $1.94B 3.3:1 VC Ahead 9 Threat Intelligence 27.3% 21.1% $6.9B 12 $3.16B 2.2:1 Oversupplied 10 Consent & Preference Mgmt 22.1% 18.6% $2.0B 7 $2.61B 0.8:1 Oversupplied Source: Gartner 1Q26 Information Security Market Current Outlook (G00846158, March 2026). Growth rates in constant currency. Funding data from CB Insights, Crunchbase, PitchBook. Analysis by Software Strategies Blog, April 2026. The table splits cleanly into three tiers. Five categories are underfunded or locked out (Gap Ratio above 9:1). Two sit in the middle. Three are oversupplied or ahead of the Gartner signal. I update this comparison every quarter as Gartner releases new forecast data. Get the next one in your inbox. The 3 widest gaps Gap #1: CASB — 39:1, and the category is disappearing Gartner projects cloud access security brokers reaching $7.1 billion by 2030 at a 24.3% CAGR. Total startup funding since January 2025: $182 million across just 4 companies. Company Total Funding Last Round Lead Investor HQ Founded Reco $85M $30M Series B Zeev Ventures New York 2020 Seraphic Security $44M $29M Series A GreatPoint Ventures Palo Alto / Israel 2020 Nudge Security $35M $22.5M Series A Cerberus Ventures Austin, TX 2021 Spin.AI $18M+ Undisclosed (K1) K1 Investment Mgmt Palo Alto 2017 The gap is structural, not cyclical. Pure-play CASB startups no longer exist as a standalone category. The buying motion has shifted to SASE platforms. Cato Networks raised $409 million in a Series G in June 2025, but that money funds a unified SASE platform spanning CASB, ZTNA, and SD-WAN. For CISOs, the implication is direct. If your CASB requirement is standalone, your vendor options are Netskope, Skyhigh, Forcepoint, and a handful of sub-$50 million startups. Expect fewer competitive bids and less pricing leverage than in categories where VC is abundant. Gap #2: CSPM — 21.5:1, the fastest-growing category is still starved Cloud security posture management is the single fastest-growing category in Gartner’s entire information security forecast. 33.4% growth in 2026. $16.2 billion by 2030 at a 27.6% five-year CAGR. Total startup funding: $752 million across 6 companies. Company Total Funding Last Round Lead Investor HQ Founded Upwind Security $430M $250M Series B Bessemer Venture Partners San Francisco 2022 Noma Security $132M $100M Series B Evolution Equity Partners New York / Tel Aviv 2023 Sentra $100M+ $50M Series B Key1 Capital New York / Tel Aviv 2021 Native Security $42M $31M Series A Ballistic Ventures Tel Aviv / Seattle 2024 Mondoo $32.5M $17.5M Series A Ext HV Capital San Francisco 2020 AccuKnox $15M $4M Venture DreamIt Ventures Menlo Park 2020 Upwind alone accounts for 57% of all CSPM startup capital. It hit unicorn status at a $1.5 billion valuation in January 2026. But one company cannot fill a $16.2 billion market. Alphabet’s $32 billion acquisition of Wiz in March 2026 removed the largest independent cloud security company from the startup market entirely. In my analysis of $3.6 billion in agentic AI security funding, I tracked how M&A is filling gaps that VC has not. CSPM is a category where that pattern is accelerating. Gap #3: Vulnerability Assessment — 20.9:1, the most active seed-stage category Gartner projects vulnerability assessment at $6.4 billion by 2030. Total VC: $306 million across 6 companies. Company Total Funding Last Round Lead Investor HQ Founded Zafran Security $130M $60M Series C Menlo Ventures New York 2022 Seemplicity $82M+ $50M Series B Sienna Venture Capital Tel Aviv 2020 Cogent Security $53M $42M Series A Bain Capital Ventures San Francisco 2024 Nucleus Security $20M+ $20M Series C Undisclosed Tampa, FL 2018 Onit Security $11M $11M Seed Hetz Ventures Tel Aviv 2025 ZAST.AI ~$10M $6M Pre-A Hillhouse Capital Seattle 2024 ▼ GRAPHIC: GRAPHIC 3 — Top funded startups in underfunded categories (insert after Vuln Assess table) ▼ Figure 3: Total funding by startup across the three underfunded categories (CSPM, CWPP, Vulnerability Assessment). This is the category with the most active early-stage investment. Cogent Security and Onit Security both use AI agents for autonomous vulnerability remediation. Zafran tripled ARR since its prior round. The agentic AI thesis is landing hardest in vulnerability management, and the funding trail shows it. Balbix, which had raised $98.6 million, was acquired in November 2025. For CISOs evaluating this category, the vendor field is young and fragmented. Half of the funded companies were founded in 2024 or later. Where VC is ahead of Gartner Three categories show the opposite pattern. In Consent & Preference Management, OneTrust alone has raised $2.1 billion against a $2.0 billion Gartner projection. In Threat Intelligence, $3.16 billion in VC against a $6.9 billion projection, but Dataminr ($1.24B) and ReliaQuest ($1.13B) account for 75% of the total. In ZTNA, Cato Networks’ $1.1 billion alone represents 57% of all category funding. ▼ GRAPHIC: GRAPHIC 4 — Concentration risk donut charts (insert after VC-ahead section) ▼ Figure 4: Single-company concentration in CWPP, ZTNA, and Threat Intelligence funding. The concentration risk matters. Strip out the single largest company in each oversupplied category and the gap ratios invert. Consent without OneTrust: $510 million, Gap Ratio 3.9:1. Threat Intelligence without Dataminr and ReliaQuest: $790 million, Gap Ratio 8.7:1. ZTNA without Cato: $835 million, Gap Ratio 7.7:1. M&A is filling the gaps VC won’t When startups cannot fill the gap, platform vendors acquire. The $3.6 billion in agentic AI security funding and $96 billion in M&A I tracked in March tells this story at scale. Palo Alto Networks assembled $29 billion in acquisitions. ServiceNow spent $11.6 billion. Alphabet closed $32 billion for Wiz. Veeam acquired Securiti.ai for $1.725 billion, removing the leading subject rights automation vendor from the independent market. Forrester’s 2026 cybersecurity budget data confirms the same pattern from the buyer side. Security budgets are growing, but the spend is concentrating in fewer, larger platform purchases. What this means for CISOs In underfunded categories, build internally or accept platform vendor lock-in. CSPM, vulnerability assessment, and CWPP all have Gap Ratios above 12:1. Fewer funded startups means fewer competitive alternatives. If your preferred vendor gets acquired, as Wiz, Securiti.ai, and Balbix all were, your roadmap depends on the acquirer’s priorities, not yours. In oversupplied categories, use the competition for better pricing. ZTNA, threat intelligence, and consent management have abundant VC-backed alternatives. Negotiate harder. Run competitive evaluations with three or more vendors. The funding data tells you which categories give you leverage. Watch for single-company concentration. Chainguard holds 70% of all CWPP startup funding. Cato holds 57% of ZTNA. OneTrust holds 80% of consent management. If any of these companies pivots, gets acquired, or fails, the category funding picture changes overnight. Bottom line Gartner projects $93.2 billion in 2030 spending across the 10 fastest-growing security categories. Venture capital has funded $11.2 billion in startups since January 2025. The 8.3:1 blended gap tells you the overall story. The category-level ratios tell you where to act. Cloud security posture management, vulnerability assessment, and cloud workload protection are growing at 2x to 3x the market average but remain underfunded relative to Gartner’s projections. Two categories, firewall equipment and pure-play CASB, have no startup investment at all. Platform vendors are filling gaps through acquisition at a pace that is reshaping every competitive evaluation. This is the third quarter I have tracked Gartner’s security forecast against independent funding data. The gap between enterprise demand and startup supply keeps widening. Gartner’s 2Q26 forecast lands in July. I will break down the updated Gap Ratios the week it drops. I wrote a shorter editorial take on what these gaps mean for CISO budgets on my Substack. Source: Gartner, Information Security Market Current Outlook, Worldwide, 1Q26 (G00846158), March 2026. Growth rates in constant currency. Dollar figures in current U.S. dollars. Funding data from CB Insights, Crunchbase, PitchBook, Statista. Cross-referenced against company press releases. Analysis by Software Strategies Blog.

The master table: Gartner forecast vs. startup funding by category

I mapped each Gartner category against every cybersecurity startup that raised equity or debt since January 2025. Each company is assigned to one primary category to avoid double-counting. Gap Ratio is the Gartner 2030 market projection divided by total VC raised. Higher means wider gap.

# Gartner Security Category 2025-26 GR 5yr CAGR 2030 Proj Startups Total VC Gap Ratio Verdict
1 Cloud Access Security Brokers (CASB) 27.2% 24.3% $7.1B 4 $182M 39:1 Critical Gap
2 Firewall Equipment (NGFW/FWaaS) 15.9% 9.1% $26.7B 0 $0 ∞ Incumbent Lock
3 Cloud Security Posture Mgmt (CSPM) 33.4% 27.6% $16.2B 6 $752M 21.5:1 Underfunded
4 Vulnerability Assessment 15.7% 12.0% $6.4B 6 $306M 20.9:1 Underfunded
5 Cloud Workload Protection (CWPP) 25.9% 21.0% $16.1B 8 $1.28B 12.6:1 Underfunded
6 Subject Rights Request Automation 16.2% 12.3% $2.3B 2 $240M 9.6:1 M&A Absorbed
7 Network Detection & Response (NDR) 15.6% 12.4% $4.1B 4 $701M 5.9:1 Moderate Gap
8 Zero Trust Network Access (ZTNA) 23.0% 20.9% $6.4B 10 $1.94B 3.3:1 VC Ahead
9 Threat Intelligence 27.3% 21.1% $6.9B 12 $3.16B 2.2:1 Oversupplied
10 Consent & Preference Mgmt 22.1% 18.6% $2.0B 7 $2.61B 0.8:1 Oversupplied

Source: Gartner 1Q26 Information Security Market Current Outlook (G00846158, March 2026). Growth rates in constant currency. Funding data from CB Insights, Crunchbase, PitchBook. Analysis by Software Strategies Blog, April 2026.

The table splits cleanly into three tiers. Five categories are underfunded or locked out (Gap Ratio above 9:1). Two sit in the middle. Three are oversupplied or ahead of the Gartner signal.

I update this comparison every quarter as Gartner releases new forecast data. Get the next one in your inbox.

The 3 widest gaps

Gap #1: CASB — 39:1, and the category is disappearing

Gartner projects cloud access security brokers reaching $7.1 billion by 2030 at a 24.3% CAGR. Total startup funding since January 2025: $182 million across just 4 companies.

Company Total Funding Last Round Lead Investor HQ Founded
Reco $85M $30M Series B Zeev Ventures New York 2020
Seraphic Security $44M $29M Series A GreatPoint Ventures Palo Alto / Israel 2020
Nudge Security $35M $22.5M Series A Cerberus Ventures Austin, TX 2021
Spin.AI $18M+ Undisclosed (K1) K1 Investment Mgmt Palo Alto 2017

The gap is structural, not cyclical. Pure-play CASB startups no longer exist as a standalone category. The buying motion has shifted to SASE platforms. Cato Networks raised $409 million in a Series G in June 2025, but that money funds a unified SASE platform spanning CASB, ZTNA, and SD-WAN.

For CISOs, the implication is direct. If your CASB requirement is standalone, your vendor options are Netskope, Skyhigh, Forcepoint, and a handful of sub-$50 million startups. Expect fewer competitive bids and less pricing leverage than in categories where VC is abundant.

Gap #2: CSPM — 21.5:1, the fastest-growing category is still starved

Cloud security posture management is the single fastest-growing category in Gartner’s entire information security forecast. 33.4% growth in 2026. $16.2 billion by 2030 at a 27.6% five-year CAGR. Total startup funding: $752 million across 6 companies.

Company Total Funding Last Round Lead Investor HQ Founded
Upwind Security $430M $250M Series B Bessemer Venture Partners San Francisco 2022
Noma Security $132M $100M Series B Evolution Equity Partners New York / Tel Aviv 2023
Sentra $100M+ $50M Series B Key1 Capital New York / Tel Aviv 2021
Native Security $42M $31M Series A Ballistic Ventures Tel Aviv / Seattle 2024
Mondoo $32.5M $17.5M Series A Ext HV Capital San Francisco 2020
AccuKnox $15M $4M Venture DreamIt Ventures Menlo Park 2020

Upwind alone accounts for 57% of all CSPM startup capital. It hit unicorn status at a $1.5 billion valuation in January 2026. But one company cannot fill a $16.2 billion market.

Alphabet’s $32 billion acquisition of Wiz in March 2026 removed the largest independent cloud security company from the startup market entirely. In my analysis of $3.6 billion in agentic AI security funding, I tracked how M&A is filling gaps that VC has not. CSPM is a category where that pattern is accelerating.

Gap #3: Vulnerability Assessment — 20.9:1, the most active seed-stage category

Gartner projects vulnerability assessment at $6.4 billion by 2030. Total VC: $306 million across 6 companies.

Company Total Funding Last Round Lead Investor HQ Founded
Zafran Security $130M $60M Series C Menlo Ventures New York 2022
Seemplicity $82M+ $50M Series B Sienna Venture Capital Tel Aviv 2020
Cogent Security $53M $42M Series A Bain Capital Ventures San Francisco 2024
Nucleus Security $20M+ $20M Series C Undisclosed Tampa, FL 2018
Onit Security $11M $11M Seed Hetz Ventures Tel Aviv 2025
ZAST.AI ~$10M $6M Pre-A Hillhouse Capital Seattle 2024

 

This is the category with the most active early-stage investment. Cogent Security and Onit Security both use AI agents for autonomous vulnerability remediation. Zafran tripled ARR since its prior round. The agentic AI thesis is landing hardest in vulnerability management, and the funding trail shows it.

Balbix, which had raised $98.6 million, was acquired in November 2025. For CISOs evaluating this category, the vendor field is young and fragmented. Half of the funded companies were founded in 2024 or later.

Where VC is ahead of Gartner

Three categories show the opposite pattern. In Consent & Preference Management, OneTrust alone has raised $2.1 billion against a $2.0 billion Gartner projection. In Threat Intelligence, $3.16 billion in VC against a $6.9 billion projection, but Dataminr ($1.24B) and ReliaQuest ($1.13B) account for 75% of the total. In ZTNA, Cato Networks’ $1.1 billion alone represents 57% of all category funding.

The concentration risk matters. Strip out the single largest company in each oversupplied category and the gap ratios invert. Consent without OneTrust: $510 million, Gap Ratio 3.9:1. Threat Intelligence without Dataminr and ReliaQuest: $790 million, Gap Ratio 8.7:1. ZTNA without Cato: $835 million, Gap Ratio 7.7:1.

M&A is filling the gaps VC won’t

When startups cannot fill the gap, platform vendors acquire. The $3.6 billion in agentic AI security funding and $96 billion in M&A I tracked in March tells this story at scale. Palo Alto Networks assembled $29 billion in acquisitions. ServiceNow spent $11.6 billion. Alphabet closed $32 billion for Wiz. Veeam acquired Securiti.ai for $1.725 billion, removing the leading subject rights automation vendor from the independent market.

Forrester’s 2026 cybersecurity budget data confirms the same pattern from the buyer side. Security budgets are growing, but the spend is concentrating in fewer, larger platform purchases.

What this means for CISOs

In underfunded categories, build internally or accept platform vendor lock-in. CSPM, vulnerability assessment, and CWPP all have Gap Ratios above 12:1. Fewer funded startups means fewer competitive alternatives. If your preferred vendor gets acquired, as Wiz, Securiti.ai, and Balbix all were, your roadmap depends on the acquirer’s priorities, not yours.

In oversupplied categories, use the competition for better pricing. ZTNA, threat intelligence, and consent management have abundant VC-backed alternatives. Negotiate harder. Run competitive evaluations with three or more vendors. The funding data tells you which categories give you leverage.

Watch for single-company concentration. Chainguard holds 70% of all CWPP startup funding. Cato holds 57% of ZTNA. OneTrust holds 80% of consent management. If any of these companies pivots, gets acquired, or fails, the category funding picture changes overnight.

Bottom line

Gartner projects $93.2 billion in 2030 spending across the 10 fastest-growing security categories. Venture capital has funded $11.2 billion in startups since January 2025. The 8.3:1 blended gap tells you the overall story. The category-level ratios tell you where to act.

Cloud security posture management, vulnerability assessment, and cloud workload protection are growing at 2x to 3x the market average but remain underfunded relative to Gartner’s projections. Two categories, firewall equipment and pure-play CASB, have no startup investment at all. Platform vendors are filling gaps through acquisition at a pace that is reshaping every competitive evaluation.

This is the third quarter I have tracked Gartner’s security forecast against independent funding data. The gap between enterprise demand and startup supply keeps widening. Gartner’s 2Q26 forecast lands in July. I will break down the updated Gap Ratios the week it drops. I wrote a shorter editorial take on what these gaps mean for CISO budgets on my Substack.

Source: Gartner, Information Security Market Current Outlook, Worldwide, 1Q26 (G00846158), March 2026. Growth rates in constant currency. Dollar figures in current U.S. dollars. Funding data from CB Insights, Crunchbase, PitchBook, Statista. Cross-referenced against company press releases. Analysis by Software Strategies Blog.

 

Apr 1

Gartner’s $246.2B Security Forecast shows 10 categories growing 2x to 3x the market

$30.6 billion in new security spending in a single year. Gartner's 1Q26 Information Security forecast projects $246.2 billion in 2026 spending across 41 categories. Cloud Security Posture Management leads at 33.4% growth, followed by Threat Intelligence at 27.3% and Cloud Access Security Brokers at 27.2%. Two legacy categories are declining. I analyzed the full dataset to rank the 10 fastest-growing categories by growth rate and what they mean for CISO budgets.

Read more

Mar 24

Gartner’s $244.2B security forecast shows enterprises spend 17x more on AI tools than securing AI itself

Analyst on a video call beside monitors showing Gartner's $244.2 billion 2026 security spending forecast and a 17x comparison

Update: Gartner’s 2Q26 forecast, revised July 21, 2026, puts 2026 information security spending at $248.2 billion. Read the current analysis.

Inside the $244.2 billion security market: agentic AI adoption outpaces defenses 8 to 1, cloud security grows at 28.8%, and enterprises spend 17x more on AI tools than on securing the AI itself

Gartner forecasts worldwide AI spending will reach $2.52 trillion in 2026, a 44% increase year-over-year. Worldwide IT spending will hit $6.15 trillion. Within that massive build-out, information security spending accelerates to $244.2 billion, up 13.3%.

The headline looks healthy. Look closer, and it isn’t. I’ve been tracking Gartner’s information security forecast through multiple quarterly updates, and the trajectory keeps steepening. But the spending acceleration is masking a deeper problem: enterprises are deploying AI agents into production far faster than they are securing them.

  1. The 40% / 6% gap

Gartner predicts 40% of enterprise applications will include task-specific AI agents by the end of 2026. Up from less than 5% in January. These are not chatbots. Gartner’s examples include autonomous cybersecurity response agents that scan network traffic, analyze system logs, and initiate responses without human intervention.

Only roughly 6% of organizations report having an advanced AI security strategy in place, according to vendor-sourced research from BigID’s 2025 AI Risk and Readiness study. Even adjusting for methodology differences between vendor and analyst research, the gap is stark. Agents are entering production at roughly 7-8x the rate organizations are building governance around them.

Gartner’s 4Q25 AI spending forecast created a dedicated agentic AI market segment for the first time. The spending lines are dramatic. Agentic AI overtakes chatbot and assistant spending by 2027. By 2029, agentic AI will reach $752.7 billion at a 119% compound annual growth rate. Chatbot spending peaks at $264.7 billion, then declines. That crossover point is where the security model breaks, because chatbots operate within human-supervised sessions. Agents don’t.

Gartner named agentic AI oversight the number-one cybersecurity trend for 2026 in its February report (my breakdown of all six trends here). A separate Gartner poll of 147 CIOs found 24% had already deployed AI agents and 50% were actively experimenting. Guardian agents, AI systems designed to monitor and govern other AI agents, are projected to capture 10-15% of the agentic AI market by 2030.

Forrester’s 2026 cybersecurity predictions go further: an agentic AI deployment will cause a publicly disclosed data breach this year, leading to employee dismissals. Senior analyst Paddy Harrington frames it as a cascade of failures, not a single point of error. That prediction landed in October 2025. Nothing since has made it less likely.

  1. $244.2 billion, and where it goes

Gartner’s 4Q25 information security forecast projects global spending reaching $244.2 billion in 2026, up 13.3% year-over-year. That is acceleration, not continuation. Gartner’s forecast trajectory has been steepening for multiple quarters. It follows a year where many CISOs focused on consolidating tools rather than buying new ones.

The allocation matters more than the total (please click on the graphic to expand for easier reading):

Gartner 4Q25 Information Security forecast table of subsegment sizing to 2029, led by cloud security posture management at a 31.3% CAGR

Cloud security at 28.8% growth is the fastest subsegment by a wide margin. CSPM alone carries a 31.3% CAGR. These represent organizations reacting to attack surfaces that expanded when workloads moved to the cloud faster than security controls followed.

Managed security services at 11.1% tells a workforce story the spending headline misses. The ISC2 documented a global cybersecurity workforce gap of 4.8 million professionals in October 2024. That gap grew 19% year-over-year while the active workforce flatlined at 5.5 million. A quarter of organizations reported cybersecurity layoffs. So they’re buying SOC capacity from managed providers instead. The spending growth in managed services is a staffing problem wearing a procurement mask.

The 17:1 spending asymmetry

Gartner’s 4Q25 AI spending forecast splits the AI cybersecurity market into two sub-segments for the first time. AI-amplified security, using AI to defend the enterprise, reached $49 billion in 2025. Securing AI itself, protecting the models, training data, inference pipelines, agent workflows, and decision outputs, stood at $2.8 billion. That is 5.5% of the AI cybersecurity market.

Enterprises are investing 17 times more in AI-powered security tools than in securing the AI on which those tools run. Gartner projects over 75% of enterprises will use AI-amplified cybersecurity products by 2028, up from less than 25% in 2025. The tools are getting funded. What the tools actually depend on to function is not.

  1. Quantum crosses the 5% budget threshold

Forrester predicts quantum security spending will exceed 5% of overall IT security budgets in 2026. Five percent sounds modest until you consider what it represents: the shift from research line items to actual procurement.

That means consulting engagements for quantum migration planning. Cryptographic discovery tools to figure out which systems need replacing first. Post-quantum algorithm testing across live production environments. Gartner calls post-quantum cryptography a force that demands organizations identify, manage, and replace traditional encryption methods now. Not eventually. Gartner’s 3Q26 forecast carries that logic into hardware, and my analysis of the $247.5 billion security forecast shows post-quantum firewall refreshes as the only hardware upgrade Gartner expects through 2030. The encryption market is growing at 2.0x according to the 4Q25 forecast, and the planning horizon is 2030. Starting migration in 2028 means compounding rip-and-replace costs every quarter of delay.

Forrester also predicts the EU will establish its own known exploited vulnerability database in 2026. Regulatory fragmentation adds cost. For enterprises operating across jurisdictions, quantum migration planning cannot be separated from compliance architecture.

  1. 57% of employees are already using shadow AI

A smaller Gartner survey of 175 employees conducted between May and November 2025 found that 57% use personal GenAI accounts for work. A third admitted to uploading sensitive information to tools their organizations have not sanctioned.

I keep coming back to this stat because it reframes the entire agentic AI security conversation. The firewalls most enterprises rely on were built for human-to-application communication. Protocols like MCP now enable agent-to-agent interaction at a scale and speed those tools were never designed to see. Machine identities outnumber human employees by more than 80 to 1 in most enterprises, according to CyberArk. Traditional IAM was not built for nonhuman actors operating autonomously.

Gartner’s cybersecurity trends report identifies IAM adaptation for AI agents as a top-six trend for 2026, specifically calling out identity registration, credential automation, and policy-driven authorization for machine actors. Failure to address these issues will lead to greater access-related cybersecurity incidents as autonomous agents become more prevalent.

The investment context: AI in the trough, security in the gap

Gartner places AI in the Trough of Disillusionment throughout 2026. AI will most often be sold by incumbent software providers rather than bought as part of new moonshot projects. ROI predictability has to improve before enterprises scale their deployments.

Forrester’s 2026 predictions reinforce this: enterprises will defer 25% of planned AI spending into 2027 as financial rigor slows production deployments and kills proofs of concept. Fewer than one-third of decision-makers can tie AI value to their organization’s financial growth.

Yet Gartner’s IT spending forecast shows server spending accelerating at 36.9% year-over-year and data center spending surging 31.7% past $650 billion. GenAI model spending grows at 80.8%. The infrastructure build-out is not slowing even as enterprise application adoption pauses.

Infrastructure spending runs hot. Application-layer AI spending cools. Security spending accelerates into the gap between adoption speed and governance readiness. The $244.2 billion flowing into information security is the cost of operating in an environment where AI agents are proliferating faster than the controls designed to govern them.

What these numbers add up to

For two decades, enterprise security assumed a human on the other end of every session, every credential request, every decision. That assumption is collapsing. The autonomous agent accessing your production database at 3 AM doesn’t authenticate the way your SOC analyst does, doesn’t respect the same governance boundaries, and operates at speeds no human reviewer can match.

What makes this moment different from previous security inflection points is the speed asymmetry. When cloud migration created new attack surfaces, enterprises had years to adapt. The shift from on-prem to cloud took a decade. The shift from human-operated to agent-operated environments is measured in quarters. Gartner didn’t even have a dedicated agentic AI spending segment until this forecast cycle. By the next one, the crossover will have already happened.

The practical question for 2026 is not whether to invest in AI security. That decision has been made by the spending trajectory. It is whether to govern AI agents proactively, before the first publicly disclosed agentic breach forces a reactive scramble, or to wait and pay the premium that every late mover in cybersecurity history has paid. Forrester has already predicted which outcome is more likely this year. The 17:1 ratio suggests most enterprises are betting on the wrong side of that question.

Sources

Gartner Forecast: Information Security, Worldwide, 2023–2029, 4Q25 (December 18, 2025)

Gartner Forecast Analysis: Information Security, Worldwide, 2026 (February 5, 2026)

Gartner Forecast: AI Spending, Worldwide, 2024–2029, 4Q25 (December 2025)

Gartner, Top Trends in Cybersecurity for 2026 (February 5, 2026)

Gartner, Worldwide AI Spending Will Total $2.52 Trillion in 2026 (January 15, 2026)

Gartner, Worldwide IT Spending to Grow 10.8% in 2026 (March 2026)

Gartner, 40% of Enterprise Apps Will Feature AI Agents by 2026 (August 26, 2025)

Gartner, Guardian Agents Will Capture 10-15% of Agentic AI Market by 2030 (June 11, 2025)

Forrester Predictions 2026: Cybersecurity and Risk (October 28, 2025)

Forrester, Global Tech Spend Will Grow 7.8% in 2026 (February 2, 2026)

Forrester, 2026 Technology & Security Predictions (October 28, 2025)

ISC2, 2024 Cybersecurity Workforce Study (October 2024)

CyberArk, Machine Identities Report (April 2025)

BigID, AI Risk & Readiness in the Enterprise (2025)

Feb 10

Top 6 cybersecurity trends from Gartner’s 2026 Security Forecast

Over 57% of employees are using personal GenAI accounts for work. A third of them admit to uploading sensitive data into tools their security teams haven’t approved. Meanwhile, agentic AI is proliferating through no-code platforms and vibe coding, creating attack surfaces most CISOs can’t see, let alone govern. And quantum computing? No longer a 10-year planning horizon. It’s a 2030 action deadline.

Gartner’s Top Trends in Cybersecurity for 2026 report, released February 5, 2026, identifies six forces reshaping how CISOs must operate. These cut across governance, AI adoption, identity, workforce, and cryptographic strategy simultaneously. None of them is incremental.

The trends report lands alongside Gartner’s updated Forecast: Information Security, Worldwide, 2023–2029, 4Q25 (G00843183, December 18, 2025) and the Forecast Analysis: Information Security, Worldwide, 2026 (G00838442, February 5, 2026), which together project global information security spending reaching $244.2 billion in 2026, up 13.3% in current U.S. dollars. I’ve tracked this forecast through multiple quarterly updates. The trajectory keeps steepening. The six trends below explain where that money is going and why.

“Cybersecurity leaders are navigating uncharted territory this year as these forces converge, testing the limits of their teams in an environment defined by constant change,” said Alex Michaels, Director Analyst at Gartner. “This demands new approaches to cyber risk management, resilience, and resource allocation.”

The spending backdrop: $244 billion and accelerating

Before getting into the six trends, context matters. Gartner’s 4Q25 forecast shows the three major security segments all growing at double-digit constant currency rates in 2026:

Table of Gartner 2026 security spending by segment, with security software at $123.5 billion or 50.6% of the total

Source: Gartner Forecast: Information Security, Worldwide, 2023–2029, 4Q25 Update (G00843183). Constant currency rates.

Cloud security remains the fastest-growing subsegment at 28.8% growth in 2026. Nothing else comes close. The combined cloud security market (cloud security posture management, cloud access security brokers, and cloud workload protection platforms) is projected to reach $32.4 billion by 2029, with a 25% CAGR in constant currency. I’ve been watching this subsegment accelerate for three quarters straight. CSPM alone is growing at a 31.30% CAGR.

 

Stacked area chart of Gartner cloud security spending across CSPM, CASB and CWPP growing from $7.9 billion in 2023 to $32.4 billion in 2029

Cloud security spending reaches $32.4 billion by 2029. CSPM leads at 31.30% CAGR. Source: Gartner 4Q25 Forecast. (Please click on the image to expand for easier reading)

Trend 1: Agentic AI demands cybersecurity oversight

This is the trend that touches everything else on this list. Employees and developers are deploying AI agents through no-code/low-code platforms and “vibe coding” at a pace that outstrips security governance. Unmanaged AI agent proliferation. Unsecured code. Compliance violations that most security teams don’t even have visibility into yet. That’s the picture Gartner is painting.

Gartner’s recommendation is blunt: cybersecurity leaders must identify both sanctioned and unsanctioned AI agents operating within their environments, enforce access controls and data guardrails, and develop incident response playbooks specific to agent-driven threats.

“While AI agents and automation tools are becoming increasingly accessible and practical for organizations to adopt, strategic cybersecurity planning for these technologies is essential,” said Michaels. Cybersecurity leaders must work cross-functionally to manage agentic AI adoption, identifying sanctioned and unsanctioned AI agents, enforcing data access controls, and developing incident response playbooks.

The spending data backs this up. Gartner’s 4Q25 forecast projects the AI-amplified security market reaching $160 billion by 2029, up from $49 billion in 2025. Gartner is clear that this isn’t additive spending. It represents the portion of existing security products that now embed AI capabilities. But the expectation tells the story: over 75% of enterprises will use AI-amplified cybersecurity products by 2028, up from less than 25% in 2025. Vendors that don’t embed AI will lose shelf space. (For more on AI security platforms, see Gartner’s Top Strategic Technology Trends for 2026, which predicts that over 50% of enterprises will use AI security platforms to protect their AI investments by 2028.)

Trend 2: Global regulatory volatility drives cyber resilience efforts

Regulators are getting personal. Boards and executives now face direct liability for compliance failures. Not just organizational fines, but individual accountability. The penalties for inaction have moved from theoretical to career-ending. Across multiple jurisdictions simultaneously.

Gartner advises cybersecurity leaders to formalize collaboration across legal, business, and procurement teams to establish clear accountability for cyber risk. Align control frameworks to recognized standards. Address data sovereignty concerns before they become enforcement actions. The organizations doing this well are treating regulatory preparedness as a core security function, not an annual compliance checkbox.

This is where the spending data gets interesting. Gartner’s forecast shows security consulting services growing from $24.2 billion (2024) to $36.6 billion (2029), adding $12.4 billion in five years. Security professional services follow a similar trajectory: $27.3 billion to $40.8 billion, adding $13.5 billion. Organizations are buying outside expertise because they can’t build regulatory competence fast enough in-house. I’ve been covering these numbers for three quarters, and the services growth is the part of the forecast that keeps surprising me.

Bar chart comparing Gartner information security spending by subsegment in 2024 and 2029, led by infrastructure protection at $58.5 billion

Infrastructure protection adds $26.4 billion between 2024 and 2029, the largest absolute growth of any subsegment. Source: Gartner 4Q25 Forecast. (Please click on the image to expand for easier reading)

Trend 3: Post-quantum computing moves into action plans

Gartner predicts advances in quantum computing will render the asymmetric cryptography that organizations rely on unsafe by 2030. Four years. That’s the window to adopt post-quantum cryptography alternatives before “harvest now, decrypt later” attacks start cashing in on data that adversaries are collecting today. In Gartner’s 3Q26 forecast that readiness work reaches budgets as post-quantum firewall refreshes, the only hardware upgrade Gartner expects through 2030.

Organizations need to identify their cryptographic deployments, assess data sensitivity and lifespan, and prioritize cryptographic agility. That last phrase keeps coming up in my conversations with CISOs. The ability to swap encryption methods without re-architecting entire systems. Swapping an algorithm is one thing. Doing it across a production environment without downtime is an entirely different problem.

“Post-quantum cryptography is reshaping cybersecurity strategies by prompting organizations to identify, manage, and replace traditional encryption methods, while prioritizing cryptographic agility,” said Michaels. “By investing in these capabilities and prioritizing migration now, assets will be secured when quantum threats become a reality.“

The encryption market in Gartner’s 4Q25 forecast grows from $1.04 billion in 2023 to $2.04 billion by 2029 at an 11.95% CAGR. A 2.0x increase. For what has historically been one of the slower-growing security subsegments, that’s a significant acceleration. Quantum urgency is changing the math.

Trend 4: Identity and access management adapts to AI agents

AI agents are breaking traditional IAM models. Plain and simple. Identity registration and governance, credential automation, and policy-driven authorization weren’t designed for autonomous machine actors that can initiate actions, access data, and interact with systems without human intervention. The scale problem compounds fast: when every employee can deploy dozens of AI agents, the identity surface area explodes.

Gartner recommends a targeted, risk-based approach. Invest where gaps and risks are greatest. Leverage automation where possible. The practical starting point is understanding which AI agents carry the most privilege and the least oversight. Those are your highest-risk identities right now, and most organizations haven’t inventoried them.

The identity market is already significant. Gartner’s 4Q25 forecast shows identity access management growing from $18.7 billion (2024) to $29.0 billion (2029), adding $10.3 billion in five years. That’s before the full scale of agentic AI identity requirements hits the market. IAM vendors that solve machine-actor identity at scale will capture a disproportionate share of that $10.3 billion growth.

Trend 5: AI-driven SOC solutions destabilize operational norms

AI-enabled security operations centers are enhancing alert triage and investigation workflows. The technology works. But deploying AI into a SOC doesn’t automatically reduce headcount needs. It changes the skill mix. Analysts who excelled at manual triage need different capabilities to oversee AI-driven workflows. Organizations are discovering this the hard way. That’s an organizational transformation challenge, and throwing more technology at it doesn’t help.

“To realize the full potential of AI in security operations, cybersecurity leaders must prioritize people as much as technology,” said Michaels. “Strengthening workforce capabilities, implementing human-in-the-loop frameworks into AI-supported processes and aligning adoption with clear strategic objectives will be critical to maintaining resilience as SOCs evolve.”

The talent dimension makes this harder than it already sounds. ISC2’s 2024 Cybersecurity Workforce Study, published in October 2024, documented a global workforce gap of 4.8 million professionals, a 19% year-over-year increase. The active workforce flatlined at 5.5 million (up just 0.1%). The numbers are brutal: 25% of organizations reported cybersecurity layoffs in 2024. 37% faced budget cuts. 90% report skills shortages. 58% believe the shortage puts their organization at significant risk. On the spending side, managed security services are growing at 11.1% in 2026, the fastest rate in the services segment. Organizations can’t hire fast enough, so they’re buying managed SOC capacity instead.

Trend 6: GenAI breaks traditional cybersecurity awareness tactics

Existing security awareness programs are failing. Full stop. A Gartner survey of 175 employees conducted between May and November 2025 found that 57% use personal GenAI accounts for work purposes, while 33% admit to uploading sensitive information to tools their organizations haven’t sanctioned. Those numbers should alarm every CISO reading this. A third of your workforce is actively feeding proprietary data into tools you can’t audit.

Gartner recommends shifting from general awareness training to adaptive behavioral programs that include AI-specific tasks. Generic compliance videos won’t cut it here. The organizations getting this right are making approved GenAI tools easy to access and unsanctioned tools hard to justify. Trying to ban GenAI outright just drives usage underground and costs you talent.

Strengthening governance, embedding secure practices, and establishing clear policies for authorized GenAI use will reduce exposure to privacy breaches and intellectual property loss. The governance gap on GenAI usage is, in my view, the most underestimated risk on this entire list. Every other trend has a spending line item attached to it. This one requires behavioral change, which is harder to buy.

Total market trajectory: $173.5 billion to $323.5 billion

Gartner’s year-by-year spending trajectory shows the acceleration curve these six trends are riding:

Table of Gartner total information security spending from $173.5 billion in 2023 to $323.5 billion in 2029 with yearly growth

Source: Gartner Forecast: Information Security, Worldwide, 2023–2029, 4Q25 Update (G00843183, December 18, 2025). Current U.S. dollars.

 

Bar chart ranking 15 security categories by Gartner 2023 to 2029 CAGR, led by cloud security posture management at 31.30%

CSPM and CASB lead all security categories with 31% and 26% CAGR through 2029. Source: Gartner 4Q25 Forecast. (Please click on the image to expand for easier reading)

What this means for CISOs

Three of the six trends (agentic AI oversight, IAM for machine actors, and GenAI awareness) are fundamentally about the same problem: autonomous AI systems operating inside enterprise environments without adequate governance. The other three (regulatory volatility, post-quantum readiness, and AI-driven SOCs) are the structural forces those governance failures will collide with. That convergence is the signal about where 2026 budgets need to go.

The organizations that will navigate this environment successfully are doing three things simultaneously:

Mapping their AI agent footprint now. If you don’t know how many AI agents are operating across your environment, sanctioned and unsanctioned, you can’t govern what you can’t see. Gartner’s 75% AI-amplified product adoption projection by 2028 means this window for establishing control is narrow.

Building cryptographic agility into their architecture. The 2030 quantum deadline means migration planning starts in 2026, not 2028. The encryption market’s 2.0x growth reflects early movers. Late movers face rip-and-replace costs that compound every quarter they wait.

Investing in people alongside AI tooling. AI-enabled SOCs work when human operators have the skills to oversee them. The ISC2 data is unambiguous: a 4.8 million professional gap growing at 19% year-over-year. Managed security services growth at 11.1% tells you where CISOs are finding capacity.

Gartner’s numbers aren’t projections anymore. They’re procurement trends already hitting finance systems. The $244.2 billion flowing into information security this year will fund agentic AI governance, quantum migration, and SOC transformation, whether your organization participates or not.

Bottom line: CISOs planning for 2027 are watching their competitors buy the tools they’ll be scrambling for in 18 months. The data says move now.

Jan 13

Gartner's 4Q25 Information Security forecast shows 15 categories capturing half of all new security spending through 2029

Gartner’s 4Q25 Information Security forecast shows 15 categories capturing half of all new security spending through 2029

Gartner's 4Q25 Information Security forecast shows 15 categories capturing half of all new security spending through 2029

Fifteen cybersecurity categories are growing up to three times faster than the overall market, capturing $48.7 billion in new spending by 2029.

That’s nearly half of the $98.4 billion the entire security market will add over the next four years. Cloud Security Posture Management leads the pack at 29.36% CAGR. Cloud Access Security Brokers follow at 24.81%.

Enterprises are fundamentally restructuring their security budgets, and the driver is brutal in its simplicity. Organizations now manage an average of 112 SaaS applications across multiple cloud providers. 82% of misconfigurations are caused by human error, according to Exabeam’s analysis. And Gartner estimates 99% of cloud security failures through 2025 will be the customer’s fault, primarily from these misconfigurations. Manual oversight breaks under this kind of scale. Enterprises are responding by investing in automation that manages what people can’t across hundreds of cloud accounts, thousands of APIs, and millions of attack vectors.

Gartner’s 4Q25 update delivers the clearest signal yet about where enterprise security budgets are heading. The overall information security market grows from $213.5 billion in 2025 to $311.9 billion by 2029 at 10.03% CAGR. These fifteen high-growth categories are expanding at 10.30% to 29.36% CAGR, capturing investment dollars at rates that dwarf legacy security spending patterns.

What makes these categories different

Every high-growth category eliminates manual bottlenecks that break under cloud-native workloads. CSPM scans configurations continuously. CASB provides visibility into unauthorized SaaS usage. ZTNA verifies every connection rather than trusting the network location. With 79% of organizations using multiple cloud providers, according to Spacelift’s research, manual processes create mathematical impossibilities.

These technologies prevent problems rather than clean up after them. CSPM catches misconfigurations before breaches. ZTNA eliminates the attack surface that VPNs create. Tokenization protects data even when systems get compromised. Security teams are finally getting ahead of threats instead of constantly playing catch-up.

And the ROI is quantifiable. IBM’s 2025 Cost of a Data Breach Report shows organizations using AI and automation extensively save $1.9 million per breach and reduce breach lifecycles by 80 days. U.S. breach costs average $10.22 million. These investments pay for themselves with a single prevented incident—a calculation CFOs understand.

Gartner's 4Q25 Information Security forecast shows 15 categories capturing half of all new security spending through 2029

The 15 categories reshaping enterprise security

1. Cloud Security Posture Management (CSPM) — 29.36% CAGR — $4.68B → $12.76B

CSPM platforms scan infrastructure continuously across AWS, Azure, and Google Cloud, automatically remediating misconfigurations before they become breaches. The 82% human error rate isn’t going to improve through training. Organizations managing 100+ cloud accounts need automation. CSPM adds $8.09 billion in new spending by 2029, the single largest dollar contribution among high-growth segments.

2. Cloud Access Security Brokers (CASB) — 24.81% CAGR — $2.30B → $5.58B

Here’s the brutal reality. Enterprises average 112 SaaS applications, but shadow IT accounts for 42% of all applications per JumpCloud’s data. IT stays blind to roughly 78 apps out of an average 187-app environment. The damage? 65% of shadow IT deployments result in data loss, and 52% lead to breaches, according to Mimecast research. CASBs restore visibility and control, growing to $5.58 billion by 2029.

3. Zero Trust Network Access (ZTNA) — 21.95% CAGR — $2.48B → $5.43B

ZTNA replaces the VPN model with application-specific access controls. Instead of network-level access, it provides application-specific connections verified for every request. Gartner predicts 70% of new remote access deployments will use ZTNA by 2025, up from less than 10% at the end of 2021. And 65% of companies plan to retire VPNs within one year per Cybersecurity Insiders data. This represents a wholesale rethinking of secure access. The perimeter-based model is dying. Good riddance.

4. Threat Intelligence — 21.73% CAGR — $2.58B → $5.69B

Modern threat intelligence platforms fuse telemetry from open-source intelligence, dark-web monitoring, vendor feeds, and internal logs. Machine learning prioritizes indicators based on organizational relevance. IBM data shows organizations integrating threat intelligence reduce detection and escalation costs while cutting incidents by 30%. The market reaches $5.69 billion by 2029 as enterprises shift from passive threat feeds to automated response integration.

5. Cloud Workload Protection Platforms (CWPP) — 21.53% CAGR — $5.98B → $13.11B

Traditional endpoint security can’t protect containers that spin up and vanish in seconds. Serverless functions executing for milliseconds? Legacy tools weren’t designed for that. CWPP solutions instrument workloads directly at the kernel or hypervisor level, monitoring system calls, file access, and network connections in real-time. The 21.53% CAGR reflects the rapid shift toward microservices and Kubernetes. As workloads migrate into container clusters, protecting them becomes a survival-level priority.

6. Consent and Preference Management — 20.22% CAGR — $0.81B → $1.64B

GDPR fines surpassed €5.88 billion by January 2025, according to DLA Piper’s annual survey. California’s CCPA penalties keep climbing. The California Privacy Protection Agency recently fined Todd Snyder $345,178 for inadequate opt-out and privacy request processes. Manual consent workflows can’t meet regulatory deadlines across jurisdictions. Automated platforms centralize preferences across web, mobile, and API endpoints while providing auditable logs for regulators.

7. Subject Rights Request (SRR) Automation — 14.26% CAGR — $1.24B → $2.01B

When users demand “delete my data,” these platforms automate orchestration across internal systems and third-party vendors. Privacy laws grant individuals rights to access, correct, and delete personal data with strict compliance timelines. SRR automation prevents the penalties that result from manual processing failures at scale, especially as more jurisdictions implement data privacy regulations.

8. Network Detection and Response (NDR) — 13.44% CAGR — $2.15B → $3.37B

NDR platforms establish behavioral baselines using statistical analysis and machine learning. When anomalies appear (unusual lateral movement, data exfiltration attempts, command-and-control traffic), they raise alerts or automatically isolate systems. The mindset shift matters here. Rather than hoping to prevent all attacks, sophisticated organizations invest in rapid detection that minimizes damage when attackers inevitably breach perimeters. Prevention alone isn’t sufficient anymore.

9. Vulnerability Assessment — 13.02% CAGR — $3.48B → $5.60B

Quarterly vulnerability scans are obsolete in CI/CD pipelines deploying multiple times daily. Modern assessment platforms provide continuous scanning integrated with exploit intelligence to prioritize patches based on real-world risk. DevOps teams need vulnerability detection that keeps pace with their deployment cadence. Anything less creates unacceptable exposure windows.

10. Tokenization — 12.68% CAGR — $1.34B → $2.11B

Tokenization replaces sensitive data with non-reversible tokens that can’t be mathematically decoded. The urgency comes from quantum computing advances. NIST finalized post-quantum encryption standards in August 2024, including ML-KEM (formerly CRYSTALS-Kyber) and ML-DSA (formerly CRYSTALS-Dilithium). Attackers already practice “harvest now, decrypt later”—collecting encrypted data today for quantum decryption within five to ten years. Organizations must begin quantum-safe transitions now.

11. Endpoint Protection Platform (EPP) — 12.51% CAGR — $17.68B → $28.36B

The largest single category adds $10.68 billion in new spending as ransomware attacks surge. U.S. ransomware attacks increased 149% year-over-year—from 152 incidents in early 2024 to 378 in the same period of 2025, according to Cyble analysis. Next-generation EPP platforms use behavioral analytics and signatureless detection to stop ransomware before encryption begins, catching what traditional antivirus misses.

12. Secure Web Gateway (SWG) — 11.63% CAGR — $4.44B → $6.74B

Malicious sites appear and disappear in hours. Cloud-delivered SWGs update threat intelligence in real-time, protecting remote and hybrid workforces wherever they connect. Integration with ZTNA creates comprehensive security that follows users across devices and locations without relying on network perimeters that no longer exist.

13. Web Application Firewalls (WAF) — 10.92% CAGR — $2.48B → $3.74B

Organizations expose hundreds of APIs and microservices—each a potential attack vector. Traditional network firewalls can’t inspect application-layer attacks like SQL injection, cross-site scripting, or API abuse. Modern WAFs use machine learning to differentiate legitimate user behavior from attack traffic without blocking customers. Getting that balance right is harder than it sounds.

14. Encryption — 10.64% CAGR — $1.35B → $1.98B

NIST’s standardization of quantum-resistant algorithms signals the urgency that organizations can no longer ignore. With quantum computing advances accelerating, encrypted data collected today faces decryption within a decade. Enterprises must transition to post-quantum cryptography now because full integration across complex environments takes years. This isn’t theoretical risk anymore.

15. Security Information and Event Management (SIEM) — 10.30% CAGR — $7.60B → $11.15B

AI transforms SIEM from reactive log collection to proactive threat hunting. The latest platforms embed unsupervised machine learning to detect zero-day attacks and automatically enrich alerts with context. Organizations using AI-powered automation save $1.9 million per breach and cut incident lifecycles by 80 days—turning security operations into a competitive advantage rather than a cost center.

Why this matters

Cloud complexity has proven exponential. With 79% of organizations using multiple cloud providers and managing hundreds of accounts, manual security processes break under the load. The 29.36% CAGR for CSPM isn’t market optimism. It’s organizational survival.

Shadow AI joins shadow IT as a core threatscape element. Shadow AI breaches cost $4.63 million—$670,000 more than standard incidents, according to IBM data. But AI also powers the best defenses, with automated security tools reducing breach lifecycles by 80 days. The same technology that creates vulnerabilities offers the most effective countermeasures.

Compliance costs keep accelerating. Between GDPR, CCPA, and emerging global regulations, manual compliance processes create escalating liability. Automated platforms turn regulatory requirements into competitive advantages by reducing fine exposure and accelerating data subject request responses.

Bottom Line

The organizations winning this transformation aren’t those with the largest security budgets. They’re the ones investing in the right categories at the right time. These fifteen segments define what modern security architecture looks like and capture nearly half of all new security spending through 2029.

Gartner’s 4Q25 data delivers a clear message. Security spending is shifting to automation-driven, zero-trust, cloud-native architectures. Organizations still relying on legacy approaches aren’t just falling behind. They’re accepting risks the market has already priced as unacceptable.

Source: Gartner Forecast: Information Security, Worldwide, 2023-2029, 4Q25 Update (Document G00843183, published December 18, 2025), showing overall market growth from $213.5B (2025) to $311.9B (2029) at 10.03% CAGR in constant currency.

 

 

« Older Entries