Posts tagged ‘cybersecurity market’

Why Gartner and IDC are $86B apart on 2027 cybersecurity spending

Four research firms have now published cybersecurity spending forecasts for 2027. Their numbers do not agree, and the disagreement itself is more instructive than any one total. Gartner’s 3Q26 forecast puts worldwide information security end-user spending at $276.1 billion in 2027. IDC’s latest published figure is $361.9 billion. Omdia has 2026 at $315 billion but keeps its 2027 figure behind a paywall. Forrester surveys the people who hold the budgets instead of sizing the market, and 60% of them expect at least a 5% increase next year.

Put side by side, the spread looks like a dispute about demand. Growth rates say otherwise. Every firm’s 2026 rate lands between 12.7% and 13.6%, while each 2027 rate sits between 11.2% and 12.4%. What separates a $276 billion market from a $362 billion one is what each firm decides to count. This post reconciles the four cybersecurity spending forecasts for 2027, shows where the scope differences come from and identifies the one place where the firms genuinely disagree. That place is the pace of deceleration after 2027.

Five takeaways from the cybersecurity spending forecasts for 2027

• The 2027 gap is $86 billion, and it is almost entirely definitional. IDC’s $361.9 billion includes security hardware and spans 38 technology markets across 28 industries. Gartner’s $276.1 billion covers 41 categories of security software, security services and network security equipment but no other hardware. Neither firm is wrong. Each draws the market boundary in a different place.
• Growth is the point of agreement. Gartner has 2026 at 12.7% in constant currency (13.6% in current dollars) and 2027 at 11.2%. IDC’s V2 release has 2026 at 13.2% and its event page has 2027 at 12.4%. Omdia also has 2026 at 13%. Any of the four cybersecurity spending forecasts for 2027 would describe the same healthy, low-teens market.
• Omdia’s services share is the biggest single difference. Omdia puts services at roughly two-thirds of cybersecurity spending, against a 37.8% services share in Gartner’s forecast. In dollar terms, Omdia’s June 2026 services figure of $204.8 billion is $111 billion above Gartner’s $93.5 billion. That alone is more than the entire gap between the two firms’ totals.
• The real disagreement is after 2027. Gartner’s constant-currency growth path declines every year, falling from 12.7% in 2026 until it reaches 9.6% in 2030. That is a 10.8% compound rate for 2025 to 2030. IDC describes a “12.5% five-year path to $512.9B by 2030.” By 2030 the two long-range numbers are $140 billion apart.
• Forrester’s budget signal improved year over year. In its 2027 planning survey, 16% of security decision-makers expect a budget increase above 10%, while 44% expect 5% to 10%. A year earlier the figures were 15% and 40%. Budgets are growing faster in the minds of the people who set them than a year ago.

What each firm’s cybersecurity spending forecasts say for 2026 and 2027

The table below holds the figures each firm has made public, together with the scope that goes with them. Read the scope column first, because the totals mean little without it. Gartner’s number is end-user spending in current dollars from the detailed forecast file. IDC’s figures come from two places. Its V2 Worldwide Security Spending Guide release gives $310.42 billion for 2026. A separate IT Security event page then gives $361.9 billion for 2027 and $512.9 billion for 2030. Omdia’s 2026 figure appears in its October 1, 2026 channel analysis. Forrester’s numbers are survey percentages rather than dollars.

The published figures side by side

One caution on IDC’s published figures

IDC’s own public figures do not fully reconcile. A 2027 total of $361.9 billion that is “up 12.4% year on year” implies a 2026 base of about $322 billion. That is about $11.6 billion above the $310.42 billion in the V2 release. A 12.5% five-year path to $512.9 billion implies a 2025 base near $285 billion, while the V2 growth rate implies $274 billion. The likeliest explanation is that the event page draws on a later version of the guide. I show both as published and treat them as two snapshots rather than one series.

Why IDC’s cybersecurity spending forecasts run $63 billion above Gartner’s in 2026 and $86 billion above in 2027

Start with what each firm counts. Gartner’s forecast is end-user spending across three markets. Security software is $126.9 billion in 2026, security services $93.5 billion and network security equipment $27.0 billion. That equipment is also the only hardware in a forecast Gartner publishes as 41 categories across 47 country and sub-regional rows. The 2026 total still includes $9.0 billion of consumer security software. Once the consumer line is stripped out, the business-only figure is $238.4 billion for 2026 and $266.8 billion for 2027.

IDC built its Worldwide Security Spending Guide on a wider frame. It covers 38 technology markets, including security hardware beyond network appliances, and then slices them by 28 industries and 48 countries. IDC said in March that software would be more than half of its $308 billion 2026 total and grow fastest, at 14%. The October V2 release lifted 2026 to $310.42 billion and the growth rate to 13.2%. That combination means IDC revised 2025 down and 2026 up at the same time.

Both firms tell roughly the same software-led growth story, although about differently sized markets. A $63 billion gap in 2026 that holds its proportion in 2027 is what a fixed scope difference looks like. Demand disagreements leave a different trail. If IDC saw stronger demand than Gartner, the gap would widen quickly. It does widen, but slowly, and almost entirely because of the long-range growth assumption discussed below.

Omdia’s two-thirds services share is the largest definitional split

Omdia’s $315 billion looks close to IDC’s $310 billion, but it gets there by a different route. Omdia says technology, meaning licenses, subscriptions and appliances, is roughly one-third of cybersecurity spending. Services spanning advisory, design and managed security are the other two-thirds. Its June 2026 figures were $106.4 billion for technology and $204.8 billion for services, out of $311 billion.

Gartner’s forecast inverts that ratio. Software plus network security equipment is $153.9 billion in 2026, $47.5 billion more than Omdia’s technology figure. Gartner’s security services total of $93.5 billion sits $111.3 billion below Omdia’s services figure, and that one difference is larger than the $63.5 billion gap between Omdia’s June total and Gartner’s.

Managed security shows how far apart the definitions sit. Gartner’s Managed Security Services subsegment is $32.3 billion in 2026, with managed detection and response at $11.5 billion of that and security operations at $15.6 billion. Omdia’s managed security services figure for 2026 is $106 billion, growing 14%, as cited by WithSecure’s MSP Cybersecurity Buyer’s Guide from Omdia’s MSSP Trends and Predictions. That one number is larger than Gartner’s entire security services market. Omdia is counting partner-delivered services that Gartner either books as product revenue or leaves outside the forecast.

For anyone selling security services, the implication is simple. Omdia’s figures describe the partner economy, and Gartner’s describe the services revenue that vendors recognize on their own books. Both are real answers, but to different questions.

The one real disagreement is how fast growth slows after 2027

Once scope is set aside, the four cybersecurity spending forecasts agree on 2027 and differ on what follows. Gartner’s constant-currency growth falls every year in the 3Q26 file, from 12.7% in 2026 to 11.2% in 2027, 10.4% in 2028, 10.0% in 2029 and 9.6% in 2030, so the compound rate for 2025 to 2030 works out to 10.8%. The market adds $28.7 billion in 2027 and then $96.7 billion over the following three years, which is strong growth on a decelerating path.

IDC’s published path barely decelerates. After 13.2% in 2026 and 12.4% in 2027, the firm describes a 12.5% five-year compound rate to $512.9 billion by 2030. Getting from $361.9 billion in 2027 to $512.9 billion in 2030 requires 12.3% a year for three more years, which is flat growth rather than a slide toward single digits. By 2030 the gap between IDC’s compound rate and Gartner’s year-on-year rate reaches 2.9 percentage points.

Why the 2030 numbers are $140 billion apart

That difference compounds, so the dollar gap widens every year. In 2027 the two totals are $86 billion apart, and by 2030 the distance reaches $140 billion, or about 38% of Gartner’s own 2030 total. Had IDC’s figure grown at Gartner’s rates from 2027 instead, it would reach about $489 billion in 2030. The gap would then be $116 billion, leaving $24 billion that comes from the growth assumption alone.

That leaves the 2028 to 2030 call as a call about AI. Either AI-driven security demand sustains low-teens growth, or platform consolidation and budget pressure pull it toward 10%. Consolidation is the Gartner case, while sustained AI demand is IDC’s. Gartner’s own forecast assumptions also back that reading. By 2029 it expects 52% of organizations to use fewer than 10 cybersecurity tools, up from 21% in 2025, according to Forecast Analysis: Information Security, Worldwide, 2026 (G00838442).

Forrester measures budgets, not markets, and the mood improved

Forrester built its Budget Planning Guide 2027: Security And Risk Leaders Must Confront The AI Cost Explosion from a survey of more than 2,600 business and technology decision-makers. The guide produces no market size, and that is useful here. Budgets include headcount, training, insurance and now what Forrester calls “token economics,” the inference costs of running AI inside security operations, none of which any vendor forecast counts.

The headline is a modest, consistent improvement. For 2027, 60% of security decision-makers expect their budgets to rise by at least 5%, with 16% expecting more than 10% and 44% expecting 5% to 10%. A year earlier the same questions for 2026 returned 55%, split 15% and 40%. Across all technology decision-makers, 82% expect budgets to rise in 2027, although the regional detail for 2026 showed how uneven that optimism was. Only 9% of North American security leaders expected more than 10% growth, against 14% in Europe and 22% in Asia Pacific.

Forrester’s budget composition data explains why its figures do not map onto Gartner’s or IDC’s cybersecurity spending forecasts for 2027. Citing Information Services Group data for 2025, Forrester says software is about 40% of security budgets. That outpaces hardware and outsourcing combined and, in Forrester’s wording, exceeds personnel-related costs by 11%. Read as percentage points, that puts personnel near 29% of the budget, the second-largest line a CISO carries and one that no market forecast includes. A security budget growing 5% to 10% is consistent with a vendor market growing 11% to 13%, provided staff costs grow more slowly than software and services. Two years of consolidation and automation point that way.

What Gartner’s CISO research adds to the demand picture

Gartner’s own planning research for the same cycle points the same way, and it adds two cost drivers that none of the market forecasts isolates. CISO Agenda Priority: Align Cybersecurity Investment With Board Risk Appetite (G00862663) states that the cybersecurity challenge “is no longer primarily a budget problem” and that boards are deliberately increasing risk appetite to accelerate AI adoption. The money is there, so the argument is about where it goes.

On staffing, the 2027 Planning Guide for Cybersecurity (G00856222) says the SOC workforce will transform rather than shrink as AI agents arrive. Gartner projects that by 2028 security operations teams will employ 50% more engineers than traditional analysts, which keeps Forrester’s personnel line intact even as vendor spending grows. The Cybersecurity Executive Outlook, 4Q26 (G00861818) reports that 51% of CISOs have not begun any post-quantum cryptography activity and predicts that organizations that do not begin piloting PQC by 2027 will pay 200% higher costs for full migration. Those are reasons for 2027 budgets to keep rising regardless of how a market is scoped.

The securing-AI gap is wider than the market gap

The sharpest divergence between the cybersecurity spending forecasts for 2027 is in the newest category. Gartner’s securing-AI forecast appears in Forecasting the $16.4 Billion Opportunity in Securing AI (G00853861) and carries into the 2Q26 and 3Q26 information security forecasts. It has spending on securing AI at about $3 billion in 2026 before rising to $16 billion in 2030. That implies growth of roughly 52% a year, although from a small base. The category sits inside Gartner’s security software total rather than beside it.

IDC’s IT Security event page states that spending on securing AI will reach $58.3 billion in 2027, “compounding at 37.8% a year.” It calls this “the fastest-moving segment in security.” The source is IDC’s Worldwide Artificial Intelligence Security Spending Forecast, 2025-2029. That 2027 figure is 3.6 times Gartner’s 2030 figure, three years earlier.

A gap of that size comes from definitions. IDC’s event page does not say what the $58.3 billion counts, and its scale points to a far broader set of spending than Gartner’s, plausibly including AI-enabled security tooling and services. Gartner’s securing-AI line covers only the spend on protecting AI models, agents and data. A third number, Gartner’s AI-amplified security forecast, reaches $204 billion by 2030 and is a different construct again. The firm’s February analysis says so itself, stating that AI-amplified security “is not additive spending and will not change security spending” (G00838442). I covered it in an earlier post linked below. Anyone quoting an “AI security market size” needs to say which of these three definitions they mean.

Nearly half of the gap sits in the United States

Regional detail shows where IDC’s extra scope lands. IDC’s March release put the United States at $150 billion for 2026. Gartner’s 3Q26 file has the United States at $119.5 billion, so the $30.5 billion difference is nearly half of the $63 billion gap between the two totals. Gartner then has the US rising to $133.6 billion in 2027 and $181.1 billion in 2030.

Europe is closer than the worldwide totals imply. IDC has Western Europe at $69 billion, while Gartner’s Europe region, which includes Central and Eastern European countries, sums to $64.0 billion. Even a broader Gartner region lands $5 billion below a narrower IDC one. In Asia/Pacific excluding Japan and China, IDC’s $26 billion sits $8.3 billion above the $17.7 billion in Gartner’s Mature and Emerging Asia/Pacific regions combined. As a ratio, that is the widest regional gap of the three. IDC runs at 1.47 times Gartner’s figure there, against 1.26 in the United States and 1.08 in Europe.

The US-heavy gap fits the scope story, because the United States has the deepest market for security hardware, managed services and industry-specific security spending. Those are also the three areas where IDC’s definitions extend furthest beyond Gartner’s.

How to use four cybersecurity spending forecasts for 2027 that do not agree

• Pick the forecast that matches your question, then stay with it. Vendor revenue planning and competitive share analysis belong on Gartner’s end-user spending basis, because that is how most public security vendors are benchmarked. Channel and services strategy belongs on Omdia’s partner-centric total, while hardware-inclusive or industry-vertical sizing belongs on IDC. Switching bases mid-analysis is how a 12% growth market gets misreported as a 30% one.
• Quote growth rates before you quote totals. The four cybersecurity spending forecasts agree that 2026 grows 12.7% to 13.6% and 2027 grows 11.2% to 12.4%. Those are the defensible numbers, while totals carry scope assumptions that most audiences will not check.
• Treat 2028 to 2030 as the open question. Gartner’s path heads for 9.6% growth by 2030 while IDC’s stays near 12.5%. Plans built on the IDC trajectory have about $140 billion more market to divide by 2030 than plans built on Gartner. Watch Gartner’s 4Q26 update and IDC’s next guide version for which way the 2028 numbers move.
• Use Forrester as the demand-side check. The share of security leaders expecting at least a 5% budget increase rose from 55% to 60%. If it keeps rising, the vendor forecasts’ low-teens growth has budget support. A decline would instead make Gartner’s deceleration the base case.
• Never cite an AI security market size without its definition. $3 billion, $16 billion, $58.3 billion and $204 billion are all current analyst figures for some version of “AI security.” They describe four different things.

Frequently asked questions

What do the cybersecurity spending forecasts say the market is worth in 2027?

Among the published cybersecurity spending forecasts for 2027, Gartner’s is the lowest at $276.1 billion in worldwide information security end-user spending. That is up 11.6% in current dollars and 11.2% in constant currency. IDC’s published figure is $361.9 billion, up 12.4%. The $86 billion difference reflects IDC’s broader scope, which includes security hardware across 38 technology markets, and the two firms’ 2027 growth rates sit within 1.2 points of each other.

Why do IDC’s cybersecurity spending forecasts run higher than Gartner’s for 2027?

IDC’s Worldwide Security Spending Guide counts hardware, software and services across 38 markets, 28 industries and 48 countries. Gartner counts security software, security services and network security equipment in 41 categories. Nearly half of the 2026 gap, $30.5 billion of $63 billion, is in the United States, because hardware, managed services and industry-specific spending are largest there.

What does Omdia forecast for cybersecurity spending?

Omdia’s October 2026 figure is $315 billion for 2026, up 13%, with technology about one-third and services about two-thirds. Its earlier June 2026 breakdown was $106.4 billion for technology and $204.8 billion for services on a $311 billion total. Omdia’s 2027 and five-year figures remain available only to subscribers, unlike its 2026 headline.

What does Forrester say about 2027 security budgets?

In Forrester’s Budget Planning Guide 2027 survey, 60% of security decision-makers expect at least a 5% budget increase for 2027. Of those, 16% expect more than 10% and 44% expect 5% to 10%. The previous year’s survey for 2026 returned 55%, 15% and 40%.

Are the cybersecurity spending forecasts for 2026 and 2027 rising or falling?

For 2026, every firm’s number is higher than when the year began. Gartner’s went from $244.2 billion in 4Q25 to $248.2 billion in 2Q26, then eased to $247.5 billion in 3Q26. IDC’s rose from $308 billion to $310.42 billion, while Omdia’s rose from $311 billion to $315 billion. For the longer range, Gartner forecasts growth slowing to 9.6% by 2030, while IDC’s published five-year rate holds at 12.5%.

How I built this analysis

I computed the Gartner figures from the detailed data file behind Forecast: Information Security, Worldwide, 2024-2030, 3Q26 (G00862059). That file contains 13,489 rows of end-user spending by year, region, country, market, subsegment and category, in both current and constant currency. Its accompanying report confirms the totals and the 2029 and 2030 growth rates, and Forecast Analysis: Information Security, Worldwide, 2026 (G00838442) supplies the forecast assumptions quoted above. CISO and planning-guide statements come from CISO Agenda Priority: Align Cybersecurity Investment With Board Risk Appetite (G00862663), 2027 Planning Guide for Cybersecurity (G00856222) and The Cybersecurity Executive Outlook, 4Q26 (G00861818). Totals, growth rates, segment shares, regional sums and the 2025-2030 CAGR are my calculations from that file. Securing-AI figures come from Forecasting the $16.4 Billion Opportunity in Securing AI (G00853861), as carried into the 2Q26 and 3Q26 forecasts.

Where the IDC, Omdia and Forrester figures come from

IDC figures are as published in its March 3, 2026 press release, its October 28, 2026 blog on the V2 release of the 2026 Worldwide Security Spending Guide, and its IT Security event page. That page cites the spending guide and the Worldwide Artificial Intelligence Security Spending Forecast, 2025-2029. The implied 2026 base of about $322 billion in the event-page series is my calculation rather than an IDC figure.

Omdia figures come from its October 1, 2026 channel analysis as well as the June 2026 figures published by Omdia’s Jay McBain. The managed security figure is as cited by WithSecure from Omdia’s MSSP Trends and Predictions. Forrester figures come from its Budget Planning Guide 2027 press release and coverage, together with its July 2025 Security Planning 2026 blog and its Predictions 2027 release. The Forrester personnel share of about 29% reads Forrester’s statement that software exceeds personnel-related costs by 11% as a percentage-point gap below the 40% software share. Read as a relative 11%, personnel would be about 36%, and either reading leaves personnel as the second-largest budget line.

I built all charts comparing the cybersecurity spending forecasts for 2027 from these figures and labeled each with its sources. Where a figure is an estimate or a derived value, the chart and text say so.

Related comparisons

• Gartner’s $247.5B security forecast makes post-quantum firewall refreshes the only upgrade through 2030
• Gartner’s $248.2B security forecast makes securing AI the only segment accelerating through 2030
• Gartner’s AI security forecast exposes 162x services growth that still trails software 2 to 1 in new spending
• Gartner’s $244.2B security forecast shows enterprises spend 17x more on AI tools than securing AI itself
• Top 10 insights from Forrester’s 2026 cybersecurity budget report
• Top 6 cybersecurity trends from Gartner’s 2026 Security Forecast
• AI infrastructure spending forecasts compared: every major firm raised its 2030 number in 2026

Sources

• Gartner, Forecast: Information Security, Worldwide, 2024-2030, 3Q26 (G00862059), detailed data file. Subscription required.
• Gartner, Forecast: Information Security, Worldwide, 2024-2030, 2Q26 Update (G00855892). Subscription required.
• Gartner, Forecasting the $16.4 Billion Opportunity in Securing AI (G00853861). Subscription required.
• Gartner, Forecast Analysis: Information Security, Worldwide, 2026 (G00838442). Subscription required.
• Gartner, CISO Agenda Priority: Align Cybersecurity Investment With Board Risk Appetite (G00862663). Subscription required.
• Gartner, 2027 Planning Guide for Cybersecurity (G00856222). Subscription required.
• Gartner, The Cybersecurity Executive Outlook, 4Q26 (G00861818). Subscription required.
• IDC, Worldwide Security Spending Guide press release, March 3, 2026: https://www.idc.com/resource-center/press-releases/wwsecuritysg/
• IDC, “Security Budgets Are Up. CEOs Still Rank It Their Top Tech Risk,” October 28, 2026: https://www.idc.com/resource-center/blog/security-budgets-are-up-ceos-still-rank-it-their-top-tech-risk/
• IDC, IT Security event page, “Five figures shaping the 2027 decision cycle”: https://www.idc.com/events/become-a-sponsor/it-security/
• IDC, Worldwide Artificial Intelligence Security Spending Forecast, 2025-2029 (US54233026): https://my.idc.com/getdoc.jsp?containerId=US54233026
• Omdia, “Navigating AI’s transformation of cybersecurity in the channel,” October 1, 2026: https://omdia.tech.informa.com/blogs/2026/sep/navigating-ais-transformation-of-cybersecurity-in-the-channel
• Omdia (Jay McBain), worldwide cybersecurity market 2026 figures, June 2026: https://www.linkedin.com/posts/jaymcbain_the-global-cybersecurity-market-will-hit-activity-7448484238804471808-50nb
• Omdia, Worldwide Cybersecurity Short-Term Forecasts by Quarter, 3Q26 (subscriber): https://omdia.tech.informa.com/om147788/worldwide-cybersecurity-short-term-forecasts-by-quarter–3q26
• WithSecure, MSP Cybersecurity Buyer’s Guide 2026, citing Omdia MSSP Trends and Predictions: https://www.withsecure.com/wp-content/uploads/2026/06/MSP_Buyers_Guide_2026.pdf
• Canalys, global cybersecurity forecast 2025 (via Trend Micro): https://www.trendmicro.com/content/dam/trendmicro/global/en/core/docs/report/rpt-canalys-globalcybersecurity_matrix.pdf
• Forrester, Budget Planning Guide 2027: Security And Risk Leaders Must Confront The AI Cost Explosion: https://www.forrester.com/report/budget-planning-guide-2027-security-and-risk-leaders-must-confront-the-ai-cost-explosion/RES197215
• Forrester, 2027 Budget Planning Guides press release, July 15, 2026: https://www.forrester.com/press-newsroom/forresters-2027-budget-planning-guides/
• IT Brief, “Forrester warns bigger AI budgets won’t fix weak ops,” July 17, 2026: https://itbrief.ie/story/forrester-warns-bigger-ai-budgets-won-t-fix-weak-ops
• Forrester, “Security Planning 2026: Budget To Manage Volatility,” July 15, 2025: https://www.forrester.com/blogs/security-planning-2026-budget-to-manage-volatility-seize-opportunities-and-avoid-threats/
• Forrester, Predictions 2027 release: https://investor.forrester.com/news-releases/news-release-details/forresters-2027-technology-and-security-predictions-ai-will/

This post is my personal analysis and does not represent my employer.