Skip to content

Posts tagged ‘Louis Columbus’ blog’

Oct 5

Gartner’s $247.5B security forecast makes post-quantum firewall refreshes the only upgrade through 2030

Gartner information security forecast 2024 to 2030 showing spending rising from $192.9 billion to $372.8 billion by software, services, network and consumer security, with six KPI tiles below the chart for 2026 and 2030 totals, new spending, the firewall revision, 2027 firewall growth and securing AI
Security spending climbs to $372.8B by 2030, and post-quantum firewall refreshes drew the only upgrade. Click any chart to open it full size. Source: Gartner (G00862059, Sept. 24, 2026), analysis by softwarestrategiesblog.com.

The 3Q26 Gartner information security forecast raised exactly one growth rate.

Gartner now projects firewall equipment spending to grow 13.4% in 2027 in constant currency, up from the 7.8% in its June forecast. Network security equipment overall rises to 12.8% from 8.7%. Post-quantum cryptography (PQC) is the cause. Many installed firewalls can’t run the new algorithms, which forces early replacement.

Every other business category in the 41-category forecast kept the constant-currency outlook it had 91 days earlier.

Published September 24, the forecast puts worldwide end-user spending at $247.5 billion in 2026, up 13.6% in current U.S. dollars and 12.7% in constant currency.

Spending reaches $372.8 billion by 2030. Gartner frames that as $373 billion and a 10.8% compound annual growth rate in constant currency from 2025 through 2030.

I built this analysis from Gartner’s 3Q26 report (G00862059), the full detailed dataset of 13,489 rows covering 47 countries, 9 regions, 41 categories and 7 years, and a line-by-line comparison against the 2Q26 file Gartner released in June (G00855892).

For the 2Q26 update that first counted securing AI inside the forecast, see Gartner’s $248.2B security forecast makes securing AI the only segment accelerating through 2030.

Each bar in the hero chart stacks four parts of Gartner’s forecast in current U.S. dollars. Navy is business security software, mid-blue is security services, sky blue is network security and light blue is consumer security software. Bold figures above the bars give each year’s total, with Gartner’s constant-currency growth rate in italics.

Six tiles underneath carry the 2026 and 2030 totals, the $125.4 billion in new spending between 2026 and 2030, the 2030 firewall revision in constant currency, the change in Gartner’s 2027 firewall growth forecast and the securing AI trajectory.

Both the 56% software share and the $80.5 billion software tile include consumer security software.
Read more

Sep 21

Gartner’s $239B AI forecast: Agentic workflows take half of GenAI model revenue

Detailed 2024–2030 GenAI revenue chart with annual spending, agentic shares and dollar allocations; intermediate agentic shares are explicitly labeled SSB scenarios.
Gartner publishes the agentic share of GenAI model revenue for 2025 (5%) and 2030 (50%). The 2024 and 2026 to 2029 bars are my estimates and are labeled SSB. By 2030, agentic revenue reaches about $69.6 billion of $139.2 billion. Source: Gartner, G00855897 and G00861842. Chart and analysis by softwarestrategiesblog.com.

Agentic workflows will drive 50% of generative AI model revenue by 2030, up from 5% in 2025. Gartner published that projection on September 17, 2026, in its forecast analysis of the generative AI models market (G00861842). The number changes how every enterprise buyer should read the firm’s $239 billion AI platforms and models forecast.

Multistep reasoning, tool integration, and repeated validation steps multiply the inference events behind every completed business process. Gartner puts the impact at $38 billion in additional spending by 2030 from scaling agentic workflows alone.

Falling inference prices won’t offset it. Cheaper units unlock deeper automation, and deeper automation drives up token volume per task faster than prices fall. Gartner calls this a structural tailwind for GenAI model spending.

That consumption flywheel sits inside a market growing from $39 billion in 2025 to $239 billion by 2030 at a 42.8% compound rate, per Gartner’s June 25 forecast (G00855897). I built this analysis from both Gartner reports and Gartner’s country-level dataset, which covers 1,316 rows across 9 regions and 7 years. For the agentic spending crossover that sets up this post, see Gartner’s $5.95 trillion AI forecast puts the chatbot era on a 2027 deadline (August 5, 2026).

Model revenue is also one of the streams that has to pay for the infrastructure build-out. How far it falls short is the subject of my AI revenue gap comparison across Gartner, Goldman, Bain and JPMorgan.
Read more

Apr 1

Gartner’s $246.2B Security Forecast shows 10 categories growing 2x to 3x the market

$30.6 billion in new security spending in a single year. Gartner's 1Q26 Information Security forecast projects $246.2 billion in 2026 spending across 41 categories. Cloud Security Posture Management leads at 33.4% growth, followed by Threat Intelligence at 27.3% and Cloud Access Security Brokers at 27.2%. Two legacy categories are declining. I analyzed the full dataset to rank the 10 fastest-growing categories by growth rate and what they mean for CISO budgets.

Read more

Mar 28

$3.6 Billion in Crunchbase funding, $96 Billion in M&A, and 10 Agentic AI security startups Reshaping 2026

Palo Alto Networks spent $29 billion acquiring three companies. ServiceNow spent $11.6 billion on three more. Alphabet paid $32 billion for Wiz. The startups building agentic AI defenses raised $3.6 billion. Total MCP security funding for 17,000+ deployed servers: $40 million. Then RSAC 2026 happened.

Read more

Mar 24

Gartner’s $244.2B security forecast shows enterprises spend 17x more on AI tools than securing AI itself

Analyst on a video call beside monitors showing Gartner's $244.2 billion 2026 security spending forecast and a 17x comparison

Update: Gartner’s 2Q26 forecast, revised July 21, 2026, puts 2026 information security spending at $248.2 billion. Read the current analysis.

Inside the $244.2 billion security market: agentic AI adoption outpaces defenses 8 to 1, cloud security grows at 28.8%, and enterprises spend 17x more on AI tools than on securing the AI itself

Gartner forecasts worldwide AI spending will reach $2.52 trillion in 2026, a 44% increase year-over-year. Worldwide IT spending will hit $6.15 trillion. Within that massive build-out, information security spending accelerates to $244.2 billion, up 13.3%.

The headline looks healthy. Look closer, and it isn’t. I’ve been tracking Gartner’s information security forecast through multiple quarterly updates, and the trajectory keeps steepening. But the spending acceleration is masking a deeper problem: enterprises are deploying AI agents into production far faster than they are securing them.

  1. The 40% / 6% gap

Gartner predicts 40% of enterprise applications will include task-specific AI agents by the end of 2026. Up from less than 5% in January. These are not chatbots. Gartner’s examples include autonomous cybersecurity response agents that scan network traffic, analyze system logs, and initiate responses without human intervention.

Only roughly 6% of organizations report having an advanced AI security strategy in place, according to vendor-sourced research from BigID’s 2025 AI Risk and Readiness study. Even adjusting for methodology differences between vendor and analyst research, the gap is stark. Agents are entering production at roughly 7-8x the rate organizations are building governance around them.

Gartner’s 4Q25 AI spending forecast created a dedicated agentic AI market segment for the first time. The spending lines are dramatic. Agentic AI overtakes chatbot and assistant spending by 2027. By 2029, agentic AI will reach $752.7 billion at a 119% compound annual growth rate. Chatbot spending peaks at $264.7 billion, then declines. That crossover point is where the security model breaks, because chatbots operate within human-supervised sessions. Agents don’t.

Gartner named agentic AI oversight the number-one cybersecurity trend for 2026 in its February report (my breakdown of all six trends here). A separate Gartner poll of 147 CIOs found 24% had already deployed AI agents and 50% were actively experimenting. Guardian agents, AI systems designed to monitor and govern other AI agents, are projected to capture 10-15% of the agentic AI market by 2030.

Forrester’s 2026 cybersecurity predictions go further: an agentic AI deployment will cause a publicly disclosed data breach this year, leading to employee dismissals. Senior analyst Paddy Harrington frames it as a cascade of failures, not a single point of error. That prediction landed in October 2025. Nothing since has made it less likely.

  1. $244.2 billion, and where it goes

Gartner’s 4Q25 information security forecast projects global spending reaching $244.2 billion in 2026, up 13.3% year-over-year. That is acceleration, not continuation. Gartner’s forecast trajectory has been steepening for multiple quarters. It follows a year where many CISOs focused on consolidating tools rather than buying new ones.

The allocation matters more than the total (please click on the graphic to expand for easier reading):

Gartner 4Q25 Information Security forecast table of subsegment sizing to 2029, led by cloud security posture management at a 31.3% CAGR

Cloud security at 28.8% growth is the fastest subsegment by a wide margin. CSPM alone carries a 31.3% CAGR. These represent organizations reacting to attack surfaces that expanded when workloads moved to the cloud faster than security controls followed.

Managed security services at 11.1% tells a workforce story the spending headline misses. The ISC2 documented a global cybersecurity workforce gap of 4.8 million professionals in October 2024. That gap grew 19% year-over-year while the active workforce flatlined at 5.5 million. A quarter of organizations reported cybersecurity layoffs. So they’re buying SOC capacity from managed providers instead. The spending growth in managed services is a staffing problem wearing a procurement mask.

The 17:1 spending asymmetry

Gartner’s 4Q25 AI spending forecast splits the AI cybersecurity market into two sub-segments for the first time. AI-amplified security, using AI to defend the enterprise, reached $49 billion in 2025. Securing AI itself, protecting the models, training data, inference pipelines, agent workflows, and decision outputs, stood at $2.8 billion. That is 5.5% of the AI cybersecurity market.

Enterprises are investing 17 times more in AI-powered security tools than in securing the AI on which those tools run. Gartner projects over 75% of enterprises will use AI-amplified cybersecurity products by 2028, up from less than 25% in 2025. The tools are getting funded. What the tools actually depend on to function is not.

  1. Quantum crosses the 5% budget threshold

Forrester predicts quantum security spending will exceed 5% of overall IT security budgets in 2026. Five percent sounds modest until you consider what it represents: the shift from research line items to actual procurement.

That means consulting engagements for quantum migration planning. Cryptographic discovery tools to figure out which systems need replacing first. Post-quantum algorithm testing across live production environments. Gartner calls post-quantum cryptography a force that demands organizations identify, manage, and replace traditional encryption methods now. Not eventually. Gartner’s 3Q26 forecast carries that logic into hardware, and my analysis of the $247.5 billion security forecast shows post-quantum firewall refreshes as the only hardware upgrade Gartner expects through 2030. The encryption market is growing at 2.0x according to the 4Q25 forecast, and the planning horizon is 2030. Starting migration in 2028 means compounding rip-and-replace costs every quarter of delay.

Forrester also predicts the EU will establish its own known exploited vulnerability database in 2026. Regulatory fragmentation adds cost. For enterprises operating across jurisdictions, quantum migration planning cannot be separated from compliance architecture.

  1. 57% of employees are already using shadow AI

A smaller Gartner survey of 175 employees conducted between May and November 2025 found that 57% use personal GenAI accounts for work. A third admitted to uploading sensitive information to tools their organizations have not sanctioned.

I keep coming back to this stat because it reframes the entire agentic AI security conversation. The firewalls most enterprises rely on were built for human-to-application communication. Protocols like MCP now enable agent-to-agent interaction at a scale and speed those tools were never designed to see. Machine identities outnumber human employees by more than 80 to 1 in most enterprises, according to CyberArk. Traditional IAM was not built for nonhuman actors operating autonomously.

Gartner’s cybersecurity trends report identifies IAM adaptation for AI agents as a top-six trend for 2026, specifically calling out identity registration, credential automation, and policy-driven authorization for machine actors. Failure to address these issues will lead to greater access-related cybersecurity incidents as autonomous agents become more prevalent.

The investment context: AI in the trough, security in the gap

Gartner places AI in the Trough of Disillusionment throughout 2026. AI will most often be sold by incumbent software providers rather than bought as part of new moonshot projects. ROI predictability has to improve before enterprises scale their deployments.

Forrester’s 2026 predictions reinforce this: enterprises will defer 25% of planned AI spending into 2027 as financial rigor slows production deployments and kills proofs of concept. Fewer than one-third of decision-makers can tie AI value to their organization’s financial growth.

Yet Gartner’s IT spending forecast shows server spending accelerating at 36.9% year-over-year and data center spending surging 31.7% past $650 billion. GenAI model spending grows at 80.8%. The infrastructure build-out is not slowing even as enterprise application adoption pauses.

Infrastructure spending runs hot. Application-layer AI spending cools. Security spending accelerates into the gap between adoption speed and governance readiness. The $244.2 billion flowing into information security is the cost of operating in an environment where AI agents are proliferating faster than the controls designed to govern them.

What these numbers add up to

For two decades, enterprise security assumed a human on the other end of every session, every credential request, every decision. That assumption is collapsing. The autonomous agent accessing your production database at 3 AM doesn’t authenticate the way your SOC analyst does, doesn’t respect the same governance boundaries, and operates at speeds no human reviewer can match.

What makes this moment different from previous security inflection points is the speed asymmetry. When cloud migration created new attack surfaces, enterprises had years to adapt. The shift from on-prem to cloud took a decade. The shift from human-operated to agent-operated environments is measured in quarters. Gartner didn’t even have a dedicated agentic AI spending segment until this forecast cycle. By the next one, the crossover will have already happened.

The practical question for 2026 is not whether to invest in AI security. That decision has been made by the spending trajectory. It is whether to govern AI agents proactively, before the first publicly disclosed agentic breach forces a reactive scramble, or to wait and pay the premium that every late mover in cybersecurity history has paid. Forrester has already predicted which outcome is more likely this year. The 17:1 ratio suggests most enterprises are betting on the wrong side of that question.

Sources

Gartner Forecast: Information Security, Worldwide, 2023–2029, 4Q25 (December 18, 2025)

Gartner Forecast Analysis: Information Security, Worldwide, 2026 (February 5, 2026)

Gartner Forecast: AI Spending, Worldwide, 2024–2029, 4Q25 (December 2025)

Gartner, Top Trends in Cybersecurity for 2026 (February 5, 2026)

Gartner, Worldwide AI Spending Will Total $2.52 Trillion in 2026 (January 15, 2026)

Gartner, Worldwide IT Spending to Grow 10.8% in 2026 (March 2026)

Gartner, 40% of Enterprise Apps Will Feature AI Agents by 2026 (August 26, 2025)

Gartner, Guardian Agents Will Capture 10-15% of Agentic AI Market by 2030 (June 11, 2025)

Forrester Predictions 2026: Cybersecurity and Risk (October 28, 2025)

Forrester, Global Tech Spend Will Grow 7.8% in 2026 (February 2, 2026)

Forrester, 2026 Technology & Security Predictions (October 28, 2025)

ISC2, 2024 Cybersecurity Workforce Study (October 2024)

CyberArk, Machine Identities Report (April 2025)

BigID, AI Risk & Readiness in the Enterprise (2025)

Feb 26

Roundup of agentic AI forecasts and market estimates, 2026

Roundup of agentic AI forecasts and market estimates, 2026

Agentic AI spending is projected to reach $201.9 billion in 2026 (Gartner), overtaking chatbot spending by 2027.  Four independent firms size the standalone market at $7–8 billion with 40%+ CAGRs. But adoption lags the money: only 23% of organizations have scaled agent deployments (McKinsey), and 40% of projects face cancellation by 2027 (Gartner).

Fortune Business Insights projects $7.29 billion in 2025, reaching $139.19 billion by 2034 at 40.5% CAGR. Precedence Research sizes it at $7.55 billion in 2025, growing to $199.05 billion by 2034 at 43.84% CAGR. MarketsandMarkets puts the figure at $7.06 billion in 2025, reaching $93.20 billion by 2032 at 44.6% CAGR. Deloitte’s TMT Predictions 2025 estimates $8.5 billion in 2026, growing to $35 to $45 billion by 2030.

Every major forecast agrees on direction. None agrees on scale. The standalone agentic AI market lands between $7 billion and $8.5 billion. Gartner’s broader view, counting agentic capabilities embedded across enterprise software, reaches $201.9 billion in 2026. That 25x gap is not a contradiction. It is a measurement problem, and the takeaways below reflect both realities. The following are the key takeaways from agentic AI forecasts published in 2026 so far:

Two later comparisons extend this roundup: AI infrastructure spending forecasts compared (October 2026), which tracks the 2030 build-out numbers, and AI revenue gap forecasts compared, which follows the returns on that spending.

Key takeaways

Worldwide AI spending will reach $2.52 trillion in 2026, growing 44% year-over-year. That number jumped roughly $500 billion from the September forecast, which had pegged the market just above $2 trillion. Infrastructure takes $1.37 trillion, 54% of total spend. AI software follows at $452.5 billion, up 60%. AI services add $588.6 billion. AI-optimized servers alone account for $421.6 billion, growing to 49%. Gartner expects spending to grow by another 30% in 2027 and surpass $3 trillion. I have tracked these forecasts through multiple iterations. The revisions keep going in one direction. Source: Gartner press release, January 15, 2026

Table 1: Gartner worldwide AI spending by market, 2025 to 2027, in millions of dollars, rising from $1,757,152M to $3,336,690M, January 2026

 

Gartner projects $4.71 trillion in global AI spending by 2029. The fastest growth isn’t in infrastructure. Synthetic data generation leads all categories at 178% CAGR, followed by the broader AI Data market at 155%. Agentic AI compounds at 119%, expanding from $15 billion to $753 billion by 2029. AI Infrastructure, the largest category by dollars, grows at just 29%. The money is following the bottlenecks. Source:  Gartner 4Q25: $4.71T AI Market Proves Agentic AI and Data Readiness Are the Only Race That Matters, Software Strategies Blog, January 22, 2026 Link: https://softwarestrategiesblog.com/2026/01/22/gartner-4q25-agentic-ai-data-readiness-4-71t-market/

Bar chart of Gartner AI spending categories by 2024 to 2029 growth rate, led by synthetic data generation at 178.29% CAGR, AI data at 155.35% and agentic AI at 118.73%

 

The AI cybersecurity market is predicted to hit $51.3 billion in 2026, nearly doubling from $25.9 billion in 2025. But the category masks a structural imbalance. AI-amplified security, where AI defends the enterprise, captures 94.5% of spending at $48.5 billion. Securing AI, where the enterprise defends its own AI systems, gets $2.8 billion. Enterprises are investing 17x more in using AI as a security tool than in protecting the AI itself. Both sub-segments grow at similar CAGRs (74% vs. 72%), which means the dollar gap widens every year. By 2029, AI-amplified security reaches $160.4 billion, while securing AI hits just $11.6 billion. One is a tool. The other is the thing that needs protecting. Source: Gartner Forecasts Agentic AI Will Overtake Chatbot Spending by 2027, Software Strategies Blog, February 16, 2026 Link: https://softwarestrategiesblog.com/2026/02/16/gartner-forecasts-agentic-ai-overtakes-chatbot-spending-2027/

Table: Gartner AI cybersecurity spending 2024 to 2029, securing AI growing from $777M to $11,571M and AI-amplified security from $10,039M to $160,437M, 74% combined CAGR

 

AI Data sits alone in the upper-right quadrant of Gartner’s spending map, compounding at 155% CAGR with 277% growth in 2026. AI Cybersecurity and AI Models cluster above 67% CAGR. AI Infrastructure anchors the chart as the largest bubble, but grows at just 29%. Global AI spending reaches $1.8 trillion in 2025 and $4.7 trillion by 2029. The acceleration is not in compute. It is in data readiness, security architecture, and agentic capabilities. By 2028, software with agentic capabilities crosses 50% of total application software spend, up from 2% in 2024. Non-agentic software spending starts declining in 2027. Source:Data Readiness and Security Are Driving AI’s $4.7 Trillion Run, Software Strategies Blog, December 22, 2025 Link: https://softwarestrategiesblog.com/2025/12/22/data-readiness-security-driving-ai-4-7-trillion/

Gartner bubble chart of worldwide AI spending by market plotting 2026 growth against 2024 to 2029 CAGR, with AI data the fastest-growing segment and AI infrastructure the largest

Gartner’s AI spending forecast reaches $2.53 trillion in 2026 and $4.71 trillion by 2029. Eight markets. One pattern. AI Infrastructure dominates absolute dollars at $1.37 trillion in 2026 but grows at just 29% CAGR. AI Data, the smallest segment at $3.1 billion, compounds at 155%. AI Cybersecurity nearly doubles to $51.3 billion. AI Software hits $452.5 billion, growing 60% year-over-year as agentic capabilities reshape the category. The growth rates tell you where the bottlenecks are breaking. Source: Data Readiness and Security Are Driving AI’s $4.7 Trillion Run, Software Strategies Blog, December 22, 2025 Link: https://softwarestrategiesblog.com/2025/12/22/data-readiness-security-driving-ai-4-7-trillion/

Table: Gartner AI spending forecast by market, 2024 to 2029, in billions of dollars, total rising from $1,143.5B to $4,709.2B at 32.7% CAGR, 4Q25 update December 2025

Nearly nine in ten organizations now use AI in at least one business function, up from 78% a year ago, but nearly two-thirds have not begun scaling it across the enterprise. Only 6% qualify as high performers where AI contributes more than 5% to EBIT. Sixty-two percent of organizations are at least experimenting with AI agents, yet in no individual business function are more than 10% scaling them. High performers are three times more likely than peers to fundamentally redesign workflows and three times more likely to have senior leaders demonstrating ownership of AI initiatives. More than one-third of high performers commit over 20% of their digital budgets to AI, and about three-quarters have reached the scaling phase, versus one-third of other organizations. Source: McKinsey / QuantumBlack, The state of AI in 2025: Agents, innovation, and transformation, November 2025

McKinsey chart: share of organizations using AI in at least one business function rose from 20% in 2017 to 88% in 2025, with generative AI use at 79%; 7% report fully scaled AI

Valued at $638.23 billion in 2024, the global AI market is projected to reach $3,680.47 billion by 2034, expanding to a CAGR of 19.20%. North America holds 31.80% market share. The software segment dominates at 51.40%, while machine learning leads by technology at 36.70%. Healthcare is expected to record the highest CAGR of 36.50% across end-use segments. Among regions, Asia-Pacific is expected to grow at 19.8% CAGR from 2025 to 2034, with AI projected to add up to $3 trillion to the region’s GDP by 2030, driven by national AI strategies in China, India, and Japan. Source: Precedence Research, AI Market Size, Growth & Trends, September 2025

Precedence Research bar chart: artificial intelligence market size growing from $638.23B in 2024 to $3,680.47B in 2034

Nearly $7 trillion. That’s the capital outlay data centers will require by 2030 to keep pace with demand for compute power. Of that, $5.2 trillion goes toward AI-ready facilities and $1.5 trillion toward traditional IT workloads. Global demand for data center capacity could almost triple by 2030, with about 70% of new demand coming from AI workloads. Three investment scenarios range from $3.7 trillion (constrained demand) to $7.9 trillion (accelerated demand, adding 205 incremental GW). The 60% majority of investment—$3.1 trillion—flows to technology developers and designers producing chips and computing hardware. Source: McKinsey, The cost of compute: A $7 trillion race to scale data centers, April 2025

McKinsey chart of estimated global data center capacity demand in gigawatts, continued momentum scenario, rising from 82 GW in 2025 to 219 GW in 2030, a 3.5x increase driven by AI workloads

Inference already consumed half of all AI compute in 2025. That number will grow to two-thirds in 2026 and reach 75% of all AI compute needs by 2030. Global data center capacity is projected to nearly double from 103 gigawatts to 200 GW by 2030, yet U.S. data centers already face a capacity shortfall exceeding 11 GW, with the cumulative gap expected to exceed 40 GW by 2028. North American data center capacity alone will increase eightfold, from 5.6 GW in 2024 to 44 GW by 2030. Operators are increasingly deploying edge facilities closer to end users to reduce latency as inference-dominated workloads drive a fundamental redesign of data center architectures. Source: Avid Solutions, 13 Data Center Growth Projections, January 2026

Grand View Research bar chart: AI inference market growing from $113.5B in 2025 to $253.7B in 2030

 

Generative AI could add the equivalent of $2.6 trillion to $4.4 trillion annually to the global economy, increasing the projected impact of all AI by 15 to 40%. About 75% of the value falls across four areas: customer operations, marketing and sales, software engineering, and R&D. Half of today’s work activities could be automated between 2030 and 2060, with a midpoint in 2045—roughly a decade earlier than previously estimated. When embedding effects in existing software are included, the total economic benefit rises to $6.1 trillion to $7.9 trillion annually. Source: McKinsey, The economic potential of generative AI, June 2023

McKinsey chart of AI's potential impact on the global economy in trillions of dollars, with generative AI adding $2.6T to $4.4T on top of $11.0T to $17.7T from advanced analytics and machine learning

The global AI market hit $294.16 billion in 2025 and is projected to grow to $2,480.05 billion by 2034, at a CAGR of 26.60%. The Banking, financial services and insurance (BFSI) segment holds 18.90% market share, while healthcare is expected to record the highest CAGR of 36.50%. In the U.S. alone, the AI market was estimated at $146.09 billion in 2024 and is predicted to reach $851.46 billion by 2034. The number of AI companies funded globally in 2024 totaled 2,049, with U.S.-funded companies accounting for 1,143, signaling strong investor confidence in the sector’s expansion potential. Source: Fortune Business Insights, AI Market Size, Growth & Trends by 2034

Fortune Business Insights infographic: artificial intelligence market valued at $294.16B in 2025 and $375.93B in 2026, projected at $2,480.05B by 2034 at a 26.60% CAGR

Big Tech’s AI capex hit $405 billion in 2025, up from a $250 billion estimate at the start of the year. Sell-side analysts have underestimated AI spending every quarter for two years running. A decade ago, Big Tech’s trailing-twelve-month capex was $24 billion—15x less than today. AI data center costs are projected at $3 trillion to $8 trillion, with gigawatt capacity expected to grow 3.5x by 2030. Source: IO Fund, Big Tech’s $405B Bet, November 2025

I/O Fund bar chart of Big Tech capex revisions, January 2025 versus September 2025: Microsoft $89.9B to $117.5B, Meta $52.3B to $71.0B, Alphabet $62.6B to $92.0B, Amazon $96.4B to $125.0B

The global AI market was valued at $371.71 billion in 2025 and is projected to reach $2,407.02 billion by 2032, growing at a CAGR of 30.6%. Hyperscalers accounted for 53% of chip purchases in 2023, spurring 156% market growth from 2023 to 2024. While demand from hyperscalers is expected to moderate, growth of 41% is still forecast from 2025 to 2026. Enterprises are moving from cloud reliance to in-house AI infrastructure investments, particularly for cost-effective inference solutions, as edge AI gains traction through AI-enabled PCs and mobile devices. Source: Markets and Markets, AI Market Report 2025-2032

MarketsandMarkets snapshot: artificial intelligence market size $371.71B in 2025 growing to $2,407.02B by 2032 at 30.6% CAGR, Asia Pacific the fastest-growing region

At $602 billion projected for 2026, hyperscaler capex has entered uncharted territory. Amazon, Microsoft, Google, and Meta will each exceed $100 billion individually, pushing capital intensity to 45-57% of revenue. Total hyperscaler capex from 2025-2027 is projected at $1.15 trillion, more than double the $477 billion spent from 2022-2024. Morgan Stanley and JP Morgan suggest the technology sector may need to issue $1.5 trillion in new debt over the next few years to finance AI infrastructure construction. The sheer scale of debt issuance mirrors patterns seen during the fiber-optic buildout of the late 1990s. Source: Multiple sources compiled by Introl, January 2026

Table of 2025 capex and 2026 projections for Amazon ($125B), Microsoft (about $95B), Google (about $75B), Meta ($66B to $72B) and Oracle (about $15B), most of it for AI infrastructure

The number of software companies using consumption-based pricing more than doubled between 2015 and 2024, as AI introduces new variable costs that make traditional perpetual licenses obsolete. SaaS remains dominant, but the next wave is outcome-aligned pricing that scales with actual AI usage. Software businesses that successfully adopt consumption-based pricing aligned with usage and outcomes may be better positioned to capture AI-driven value and differentiate themselves in a rapidly evolving market where the cost of each AI inference adds a new variable to the P&L. Source: McKinsey, AI adjusts the software bill, January 27, 2026

McKinsey chart: enterprise software pricing model by type, 2016 to 2028, showing consumption-based pricing taking share from perpetual and on-premises subscription licenses

Data center capacity needs for AI and non-AI workloads could almost triple by 2030, with AI capacity increasing 3.5 times and making up roughly 70% of the total. Under a continued-momentum scenario, total capacity demand rises from 82 GW in 2025 to 219 GW by 2030, with incremental AI capacity ranging from 13 GW in 2025 to 31 GW in 2030, totaling 124 GW of new AI capacity. Non-AI workloads grow from 38 GW to 64 GW over the same period. Average power densities in AI-ready data centers have more than doubled in just two years and are expected to rise nearly four times by 2027. Source: McKinsey, Data center demands (Week in Charts), May 2025

McKinsey chart of estimated global data center capacity demand in gigawatts, 2025 to 2030, split between AI and non-AI workloads, with AI workloads reaching 156 GW by 2030

U.S. data-center spending exceeded half a trillion dollars in 2025. The U.S. and China drove a massive expansion in AI-related computing capacity through 2024, with the U.S. pulling further ahead in the first half of 2025. AI-related trade accounted for nearly half of all merchandise trade growth in that period, despite representing only 15% of total trade volume. The infrastructure boom is reshaping international commerce, with surging demand for servers, graphics cards, and related components essential to AI training and inference now a dominant force in global supply chains. Source: Federal Reserve Board, FEDS Notes: The Global Trade Effects of the AI Infrastructure Boom, February 2026

Federal Reserve charts of existing AI supercomputer capacity through H1 2025 and planned capacity through 2030 in quintillion calculations per second for the U.S., China, EU and rest of world, Epoch AI data

The generative AI market is expanding from $71.36 billion in 2025 to $890.59 billion by 2032, at a CAGR of 43.4%. North America accounted for 43.05% of global revenue in 2025. Text remains the dominant data modality due to its foundational role in enterprise workflows, while the services segment is gaining traction for scalability and cost-effectiveness. Foundation model delivery platforms verticalized adoption across industries, and the rapid scaling of AI-native infrastructure are the three key forces driving the market as of 2025. The 43.4% CAGR makes this one of the fastest-expanding technology subsegments in history. Source: MarketsandMarkets, Generative AI Market Report, Global Forecast to 2032

MarketsandMarkets snapshot: generative AI market size $71.36B in 2025 growing to $890.59B by 2032 at 43.4% CAGR, Asia Pacific the fastest-growing region

The generative AI market reached $37.89 billion in 2025 and is projected to hit $1.2 trillion by 2035, a 37% compound annual growth rate. Transformer architectures account for more than 42% of technology revenue, driven by text-to-image and text-to-video applications. Software captures over 65% of total revenue. North America holds 41% of the market. Asia-Pacific is the fastest-growing region at a 27.6% CAGR through 2035. Financial services is expected to lead sector growth at 36.4%, fueled by fraud detection, risk management, and regulatory compliance demands. Source: Precedence Research, Generative AI Market Size, January 2026

Precedence Research bar chart: generative AI market size growing from $37.89B in 2025 to $1,206.24B in 2035

GPUs captured 89% of AI processor revenue in 2025, but FPGA and ASIC alternatives are growing at a 17% CAGR through 2031. Hardware accounted for 68% of all AI infrastructure spending last year. North America held 40% of the market, backed by $52.7 billion in CHIPS Act grants and hyperscalers operating roughly 60% of global AI compute capacity. Liquid cooling reached 18% of AI server racks as power densities crossed 100 kilowatts per rack, the threshold where air cooling fails. Asia-Pacific is projected to grow fastest at 16.4% CAGR through 2031, driven by China’s $50 billion semiconductor fund and $15 billion in hyperscaler commitments across India. Source: Mordor Intelligence, AI Infrastructure Market Size, Trends & Growth Drivers 2031

Mordor Intelligence snapshot: AI infrastructure market growing from $101.17B in 2026 to $202.48B in 2031 at 14.89% CAGR, with AMD, Intel, Nvidia, Microsoft Azure and AWS as major players

Nearly one in four Americans has already made a purchase through AI. Morgan Stanley Research estimates agentic shoppers will drive $190 billion to $385 billion in U.S. e-commerce spending by 2030, capturing 10% to 20% of market share. Grocery and consumer packaged goods lead adoption, with 49% of AI-assisted buyers transacting in those categories. AI shopping agent users are projected to reach 126 million by 2030, up from near zero today, while traditional e-commerce users decline from 264 million to 149 million over the same period. Source: Morgan Stanley Research, Agentic Commerce Market Impact Outlook, December 2025 Link: https://www.morganstanley.com/insights/articles/agentic-commerce-market-impact-outlook

Morgan Stanley Research charts of agentic share of e-commerce spend, 2026 to 2030: base case reaches 10% agentic by 2030, bull case reaches 20%

Jan 13

Gartner's 4Q25 Information Security forecast shows 15 categories capturing half of all new security spending through 2029

Gartner’s 4Q25 Information Security forecast shows 15 categories capturing half of all new security spending through 2029

Gartner's 4Q25 Information Security forecast shows 15 categories capturing half of all new security spending through 2029

Fifteen cybersecurity categories are growing up to three times faster than the overall market, capturing $48.7 billion in new spending by 2029.

That’s nearly half of the $98.4 billion the entire security market will add over the next four years. Cloud Security Posture Management leads the pack at 29.36% CAGR. Cloud Access Security Brokers follow at 24.81%.

Enterprises are fundamentally restructuring their security budgets, and the driver is brutal in its simplicity. Organizations now manage an average of 112 SaaS applications across multiple cloud providers. 82% of misconfigurations are caused by human error, according to Exabeam’s analysis. And Gartner estimates 99% of cloud security failures through 2025 will be the customer’s fault, primarily from these misconfigurations. Manual oversight breaks under this kind of scale. Enterprises are responding by investing in automation that manages what people can’t across hundreds of cloud accounts, thousands of APIs, and millions of attack vectors.

Gartner’s 4Q25 update delivers the clearest signal yet about where enterprise security budgets are heading. The overall information security market grows from $213.5 billion in 2025 to $311.9 billion by 2029 at 10.03% CAGR. These fifteen high-growth categories are expanding at 10.30% to 29.36% CAGR, capturing investment dollars at rates that dwarf legacy security spending patterns.

What makes these categories different

Every high-growth category eliminates manual bottlenecks that break under cloud-native workloads. CSPM scans configurations continuously. CASB provides visibility into unauthorized SaaS usage. ZTNA verifies every connection rather than trusting the network location. With 79% of organizations using multiple cloud providers, according to Spacelift’s research, manual processes create mathematical impossibilities.

These technologies prevent problems rather than clean up after them. CSPM catches misconfigurations before breaches. ZTNA eliminates the attack surface that VPNs create. Tokenization protects data even when systems get compromised. Security teams are finally getting ahead of threats instead of constantly playing catch-up.

And the ROI is quantifiable. IBM’s 2025 Cost of a Data Breach Report shows organizations using AI and automation extensively save $1.9 million per breach and reduce breach lifecycles by 80 days. U.S. breach costs average $10.22 million. These investments pay for themselves with a single prevented incident—a calculation CFOs understand.

Gartner's 4Q25 Information Security forecast shows 15 categories capturing half of all new security spending through 2029

The 15 categories reshaping enterprise security

1. Cloud Security Posture Management (CSPM) — 29.36% CAGR — $4.68B → $12.76B

CSPM platforms scan infrastructure continuously across AWS, Azure, and Google Cloud, automatically remediating misconfigurations before they become breaches. The 82% human error rate isn’t going to improve through training. Organizations managing 100+ cloud accounts need automation. CSPM adds $8.09 billion in new spending by 2029, the single largest dollar contribution among high-growth segments.

2. Cloud Access Security Brokers (CASB) — 24.81% CAGR — $2.30B → $5.58B

Here’s the brutal reality. Enterprises average 112 SaaS applications, but shadow IT accounts for 42% of all applications per JumpCloud’s data. IT stays blind to roughly 78 apps out of an average 187-app environment. The damage? 65% of shadow IT deployments result in data loss, and 52% lead to breaches, according to Mimecast research. CASBs restore visibility and control, growing to $5.58 billion by 2029.

3. Zero Trust Network Access (ZTNA) — 21.95% CAGR — $2.48B → $5.43B

ZTNA replaces the VPN model with application-specific access controls. Instead of network-level access, it provides application-specific connections verified for every request. Gartner predicts 70% of new remote access deployments will use ZTNA by 2025, up from less than 10% at the end of 2021. And 65% of companies plan to retire VPNs within one year per Cybersecurity Insiders data. This represents a wholesale rethinking of secure access. The perimeter-based model is dying. Good riddance.

4. Threat Intelligence — 21.73% CAGR — $2.58B → $5.69B

Modern threat intelligence platforms fuse telemetry from open-source intelligence, dark-web monitoring, vendor feeds, and internal logs. Machine learning prioritizes indicators based on organizational relevance. IBM data shows organizations integrating threat intelligence reduce detection and escalation costs while cutting incidents by 30%. The market reaches $5.69 billion by 2029 as enterprises shift from passive threat feeds to automated response integration.

5. Cloud Workload Protection Platforms (CWPP) — 21.53% CAGR — $5.98B → $13.11B

Traditional endpoint security can’t protect containers that spin up and vanish in seconds. Serverless functions executing for milliseconds? Legacy tools weren’t designed for that. CWPP solutions instrument workloads directly at the kernel or hypervisor level, monitoring system calls, file access, and network connections in real-time. The 21.53% CAGR reflects the rapid shift toward microservices and Kubernetes. As workloads migrate into container clusters, protecting them becomes a survival-level priority.

6. Consent and Preference Management — 20.22% CAGR — $0.81B → $1.64B

GDPR fines surpassed €5.88 billion by January 2025, according to DLA Piper’s annual survey. California’s CCPA penalties keep climbing. The California Privacy Protection Agency recently fined Todd Snyder $345,178 for inadequate opt-out and privacy request processes. Manual consent workflows can’t meet regulatory deadlines across jurisdictions. Automated platforms centralize preferences across web, mobile, and API endpoints while providing auditable logs for regulators.

7. Subject Rights Request (SRR) Automation — 14.26% CAGR — $1.24B → $2.01B

When users demand “delete my data,” these platforms automate orchestration across internal systems and third-party vendors. Privacy laws grant individuals rights to access, correct, and delete personal data with strict compliance timelines. SRR automation prevents the penalties that result from manual processing failures at scale, especially as more jurisdictions implement data privacy regulations.

8. Network Detection and Response (NDR) — 13.44% CAGR — $2.15B → $3.37B

NDR platforms establish behavioral baselines using statistical analysis and machine learning. When anomalies appear (unusual lateral movement, data exfiltration attempts, command-and-control traffic), they raise alerts or automatically isolate systems. The mindset shift matters here. Rather than hoping to prevent all attacks, sophisticated organizations invest in rapid detection that minimizes damage when attackers inevitably breach perimeters. Prevention alone isn’t sufficient anymore.

9. Vulnerability Assessment — 13.02% CAGR — $3.48B → $5.60B

Quarterly vulnerability scans are obsolete in CI/CD pipelines deploying multiple times daily. Modern assessment platforms provide continuous scanning integrated with exploit intelligence to prioritize patches based on real-world risk. DevOps teams need vulnerability detection that keeps pace with their deployment cadence. Anything less creates unacceptable exposure windows.

10. Tokenization — 12.68% CAGR — $1.34B → $2.11B

Tokenization replaces sensitive data with non-reversible tokens that can’t be mathematically decoded. The urgency comes from quantum computing advances. NIST finalized post-quantum encryption standards in August 2024, including ML-KEM (formerly CRYSTALS-Kyber) and ML-DSA (formerly CRYSTALS-Dilithium). Attackers already practice “harvest now, decrypt later”—collecting encrypted data today for quantum decryption within five to ten years. Organizations must begin quantum-safe transitions now.

11. Endpoint Protection Platform (EPP) — 12.51% CAGR — $17.68B → $28.36B

The largest single category adds $10.68 billion in new spending as ransomware attacks surge. U.S. ransomware attacks increased 149% year-over-year—from 152 incidents in early 2024 to 378 in the same period of 2025, according to Cyble analysis. Next-generation EPP platforms use behavioral analytics and signatureless detection to stop ransomware before encryption begins, catching what traditional antivirus misses.

12. Secure Web Gateway (SWG) — 11.63% CAGR — $4.44B → $6.74B

Malicious sites appear and disappear in hours. Cloud-delivered SWGs update threat intelligence in real-time, protecting remote and hybrid workforces wherever they connect. Integration with ZTNA creates comprehensive security that follows users across devices and locations without relying on network perimeters that no longer exist.

13. Web Application Firewalls (WAF) — 10.92% CAGR — $2.48B → $3.74B

Organizations expose hundreds of APIs and microservices—each a potential attack vector. Traditional network firewalls can’t inspect application-layer attacks like SQL injection, cross-site scripting, or API abuse. Modern WAFs use machine learning to differentiate legitimate user behavior from attack traffic without blocking customers. Getting that balance right is harder than it sounds.

14. Encryption — 10.64% CAGR — $1.35B → $1.98B

NIST’s standardization of quantum-resistant algorithms signals the urgency that organizations can no longer ignore. With quantum computing advances accelerating, encrypted data collected today faces decryption within a decade. Enterprises must transition to post-quantum cryptography now because full integration across complex environments takes years. This isn’t theoretical risk anymore.

15. Security Information and Event Management (SIEM) — 10.30% CAGR — $7.60B → $11.15B

AI transforms SIEM from reactive log collection to proactive threat hunting. The latest platforms embed unsupervised machine learning to detect zero-day attacks and automatically enrich alerts with context. Organizations using AI-powered automation save $1.9 million per breach and cut incident lifecycles by 80 days—turning security operations into a competitive advantage rather than a cost center.

Why this matters

Cloud complexity has proven exponential. With 79% of organizations using multiple cloud providers and managing hundreds of accounts, manual security processes break under the load. The 29.36% CAGR for CSPM isn’t market optimism. It’s organizational survival.

Shadow AI joins shadow IT as a core threatscape element. Shadow AI breaches cost $4.63 million—$670,000 more than standard incidents, according to IBM data. But AI also powers the best defenses, with automated security tools reducing breach lifecycles by 80 days. The same technology that creates vulnerabilities offers the most effective countermeasures.

Compliance costs keep accelerating. Between GDPR, CCPA, and emerging global regulations, manual compliance processes create escalating liability. Automated platforms turn regulatory requirements into competitive advantages by reducing fine exposure and accelerating data subject request responses.

Bottom Line

The organizations winning this transformation aren’t those with the largest security budgets. They’re the ones investing in the right categories at the right time. These fifteen segments define what modern security architecture looks like and capture nearly half of all new security spending through 2029.

Gartner’s 4Q25 data delivers a clear message. Security spending is shifting to automation-driven, zero-trust, cloud-native architectures. Organizations still relying on legacy approaches aren’t just falling behind. They’re accepting risks the market has already priced as unacceptable.

Source: Gartner Forecast: Information Security, Worldwide, 2023-2029, 4Q25 Update (Document G00843183, published December 18, 2025), showing overall market growth from $213.5B (2025) to $311.9B (2029) at 10.03% CAGR in constant currency.

 

 

Aug 25

Top Ten Insights from Forrester’s 2024 Cybersecurity Budget Benchmarks

Top Ten Insights from Forrester's 2024 Cybersecurity Budget Benchmarks

CISOs are being asked to do a lot more with less as their businesses are going all-in on new digital businesses that demand identity-based security while keeping budgets tight for securing infrastructure against attacks.

Cybersecurity budgets are, on average, just 5.7% of IT annual spending. That’s tight for many security teams. CISOs are rising to the challenge, however, and delivering revenue gains by protecting new digital businesses while keeping infrastructure safe. Achieving that is a quick way for CISOs to advance their careers.

Cybersecurity needs funding to match its business growth potential

The good news is that more CEOs and boards see cybersecurity as a business enabler. The challenge for CISOs, however, is that cybersecurity still gets funded purely for its defensive value – not its upside potential to drive growth.

Many security teams struggle to make ends meet in their budgets while still staying responsive to internal teams’ needs. Forrester’s 2024 Cybersecurity Benchmarks Global Report shows just how tight budgets can get for a CISO and their team. Project-related work and incident management are a constant balancing act for security teams, and keeping them both in check is key to staying under budget.

Top Ten Insights

Cybersecurity budgets are on the low side compared to the growing complexity of threats and risks organizations face.

That’s forcing CISOs to be selective about what they spend on and how they allocate limited resources. Add to that the average spend of $1,070 per enterprise user and $157,000 per cybersecurity employee, and cybersecurity teams have little, if any, room for inefficiencies.

The following are the top ten insights from Forrester’s latest cybersecurity benchmark report:

  • CISOs need to move out of the IT organization and report to their CEOs and board of directors to have a chance at a more realistic budget. Forrester finds that cybersecurity budgets increase when CISOs report directly to the CEO or board of directors. CISOs who can articulate the business value of cybersecurity, demonstrating how it can drive revenue and support strategic goals, are more likely to secure the necessary funding. This shift also reflects a growing recognition of cybersecurity’s strategic importance beyond mere IT operations.
  • Software will dominate cybersecurity budgets in 2024. The report reveals that 35.9% of cybersecurity budgets globally are allocated to software. This trend is particularly pronounced in large enterprises with up to 74,999 employees, where 39.4% of the budget is dedicated to software. Smaller organizations, conversely, spend a higher percentage on outsourcing services due to limited in-house capabilities, which underscores the scalability challenges smaller firms face in maintaining robust cybersecurity defenses.
Top Ten Insights from Forrester's 2024 Cybersecurity Budget Benchmarks

Source: Forrester 2024 Cybersecurity Benchmarks Global Report

  • Cybersecurity spending per user keeps climbing, reaching $1,070. This is another budget constraint CISOs have to factor into their total operations plans for a given year. Forrester notes that “the cybersecurity spend per enterprise user ranges from an average of $947 at extra-large organizations (75,000 or more users) to $1,210 at small organizations (fewer than 10,000 users).
  • Personnel costs consume 28% of the typical security budget. The report highlights that organizations are spending an average of $157,593 per cybersecurity employee. Full-time employees make up 73.5% of security teams, with the global average cost per contracted full-time equivalent (FTE) reaching $194,613. This significant expenditure on personnel underscores the critical role of skilled professionals in maintaining effective cybersecurity defenses.
Top Ten Insights from Forrester's 2024 Cybersecurity Budget Benchmarks
Source:  Forrester 2024 Cybersecurity Benchmarks Global Report
  • System Defense is the leading functional spend category in 2024. Forrester finds that 29% of functional spending is in System Defense alone. The funding levels approved for this category reflect the critical need to protect endpoints and mobile devices against increasingly sophisticated attacks. With adversaries innovating faster than enterprises can keep up, System Defense is a must-have to protect new digital businesses and infrastructure. The following graphic shows cybersecurity spending by functional domain.
Top Ten Insights from Forrester's 2024 Cybersecurity Budget Benchmarks
Source:  Forrester 2024 Cybersecurity Benchmarks Global Report
  • Identity and Access Management (IAM) takes up 21% of functional spending in the typical budget. Identity-driven attacks take many forms, from mass phishing to whale phishing, where senior executives of a company are targeted with tailored campaigns IAM also enhances operational efficiency and fraud reduction, making it a strategic investment for many organizations. Its broad applicability across both internal and customer-facing applications drives its substantial share of the cybersecurity budget.
  • Security analytics and incident handling reach 13% and 14%, respectively. Forrester notes that each of these separate services accounts for a relatively low percentage of the overall cybersecurity budget. Still, most organizations combine spending on these two categories into “detection and response.” Both areas combined equal 26% of the overall security budget, on average.
  • Getting compliance and governance right is a growing concern for many CISOs who are willing to spend their budget to stay in good standing with the SEC. The Security and Exchange Commission’s Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure adopted on July 26, 2023. The rules adopted by the SEC define a standardized process for cybersecurity disclosures for public companies. These rules require companies to disclose material cybersecurity incidents on Form 8-K or Form 6-K within four business days of determining the incident’s materiality. Additionally, companies must include cybersecurity risk management, strategy, and governance information in their annual reports (Forms 10-K and 20-F). The rules also mandate the use of Inline XBRL for tagging these disclosures.
  • Incident handling is on average, 13.5% of a global cybersecurity budget. This category is the most unpredictable, as it deals with responding to intrusions and breaches that cannot be forecasted. Spending on incident handling varies by company size, with small organizations (fewer than 10,000 employees) aligning with the global average of 13.5%. Larger organizations tend to allocate slightly less, likely due to more extensive preventative measures and diversified cybersecurity resources.
  • Privacy is core to customer trust today and gets funded, even in tough budgeting cycles. The two departments that use privacy-related solutions the most frequently are legal and marketing, which dedicate on average 12% of a cybersecurity budget to them. Forrester notes that this 12% figure is not the total privacy spend of an organization. Rather, the report says, “Data privacy spans multiple areas of the organization, including marketing and legal. Its share of the security budget doesn’t represent the total spending on privacy-related initiatives across the entire technology estate.

Balancing the scales of cybersecurity budgeting

The bottom line is that cybersecurity is a business decision and needs to be funded with that mindset. Organizations need to see the CISO role as a more board-level one so they can share their technology expertise in helping to manage risk.

It’s time for cybersecurity to be funded as a growth engine, not just one used for deterrence alone.

CISOs can balance the scales by looking for an opportunity to elevate their role to a CEO direct report and, ideally, be on the board to help guide their companies through an increasingly complex threat landscape.

Jul 7

GenAI and IoT security are core to Forrester's top 10 emerging technologies in 2024
1 Comment

GenAI and IoT security are core to Forrester’s top 10 emerging technologies in 2024

Predicting that generative AI (genAI) for visual content, genAI for language, TuringBots, and IoT security will be the four technologies that deliver the most immediate ROI in two years, Forrester’s Top 10 Emerging Technologies In 2024 reflects the urgency more businesses have for making AI pay while securing their most at-risk endpoints.

Rounding out Forrester’s ten emerging technologies are AI agents, autonomous mobility, edge intelligence, quantum security, extended reality (XR), and Zero Trust Edge (ZTE).

Forrester’s stack ranking of technologies by ROI potential

Advising clients to include ten emerging technologies on their radar and roadmap, Forrester has segmented them into short-term, medium-, and long-term groups based on their potential to deliver ROI. Three of the ten emerging technologies are cybersecurity related.

Technologies predicted to deliver the most significant ROI over the next two years

GenAI for visual content and language. Given how quickly genAI’s adoption is accelerating across enterprises via a myriad of cloud-based apps and tools, especially in marketing, digital design, and communications, it’s clear why Forrester predicted that genAI for visual content, genAI for language have the potential to deliver ROI in two years. Forrester notes that “genAI for language is already delivering value in customer support and content creation but continues to advance at a blinding pace. It is accelerating many other technologies as it goes.”

TuringBots are predicted to accelerate app development. The report states that these AI-powered software robots “help developers build applications that deliver more than just code generation” thanks to advancements in genAI for language. TuringBots are defined as “AI-powered software that augments application development teams’ automation and semiautonomous capabilities to plan, analyze, design, code, test, deliver, and deploy while providing assistive intelligence on code, development processes, and applications.”

IoT Security to secure the proliferating number and variety of endpoint devices. Forrester defines IoT security technology as including components that are “familiar to endpoint management and security: asset management, identity and access management (IAM), data security management, Zero Trust networking, and attack surface risk management.” Forrester predicts that deploying IoT security solutions will deliver expected business value within a year as vendors increasingly offer capabilities as part of other cybersecurity platforms.

GenAI and IoT security are core to Forrester's top 10 emerging technologies in 2024

Source: Forrester’s Top 10 Emerging Technologies In 2024

Emerging technologies predicted to deliver ROI in two to five years

AI agents. Forrester is seeing AI agent technology stacks include advanced deep learning techniques, including generative, predictive, and reinforcement learning, that enable greater context, analysis, strategy, and planning. Forrester believes their full realization is two to five years away, predicting that “organizations with large amounts of information and sizable human workforces will likely see the biggest and most immediate benefits.”

Autonomous mobility. Manufacturing and logistics are two industries shifting workloads from initial pilots into production, according to Forrester. Both industries are facing continued labor shortages, regulatory pressures, and rising costs and see the potential to improve traffic and supply chain management results. Key benefits include greater operational efficiencies across shop floors, improved regulatory compliance, enhanced worker productivity and safety, and more accurate data to track environmental sustainability efforts.

Edge intelligence. Edge intelligence, according to Forrester, is “the ability to collect data, make assumptions based on that data, and link that data to relevant, distributed, orchestrated, and contextually driven responses in a network of application, device, and communication ecosystems.” The report further defines the tech stack for edge intelligence as including streaming analytics, edge ML, federated ML, and real-time data management on intelligent devices and edge servers.

Quantum security. Reducing the risk of “harvest now, decrypt later” quantum attacks, providing increased cryptographic agility for the future, and improving digital signatures are a few of the many benefits quantum security delivers. Asymmetric and symmetric key generation, symmetric key distribution via QKD, digital signatures and certificate management, and keeping an accurate list of cryptographic algorithms are some of the most common uses. These benefits and use cases form the basis of Forrestter’s assigning quantum security into the mid-segment of their stack ranking.

GenAI and IoT security are core to Forrester's top 10 emerging technologies in 2024

Source: Forrester’s Top 10 Emerging Technologies In 2024

Emerging technologies predicted to deliver ROI in over five years

Extended reality (XR). Forrester defines XR as “a technology that overlays computer imagery on a user’s field of vision, with augmented reality (AR), mixed reality, and virtual reality (VR) technologies that are supported by the same developer tools, sensors, cameras, and simulation engines.” Their report notes that only 8% of US online adults own a virtual-reality headset, and just 16% have used an augmented-reality device or app. While XR is advancing in training and onboarding, companies are resisting investing in tools like these until they see broad adoption.

Zero Trust Edge (ZTE). ZTE technology has the potential to protect remote workers, retail outlets, and branch offices with embedded local security. Highly distributed enterprises with little variation between sites are predicted to see the greatest benefit first.

Conclusion

Forrester sees security as core to any organization seeking to maximize the value and ROI of emerging technologies.

Three cybersecurity technologies, IoT security, quantum security, and zero trust edge (ZTE)—form the foundation of the ten emerging technologies. “The inclusion of these security technologies underscores a crucial point: the future belongs to those with the foresight and will to invest in security now. As AI capabilities expand, so do the potential vulnerabilities that malicious actors can exploit,” writes Brian Hopkins, vice president, emerging tech portfolio at Forrester.

Defending endpoints need to start with a zero-trust framework that enforces least privileged access and monitors everything happening on the network while also enabling microsegmentation to reduce the blast radius of a potential cyberattack. Relying on legacy account and identity and access management (IAM) systems that assume trust across systems and within identity management data structures is a breach waiting to happen.

Forrester’s top ten emerging technologies show a progression from already having significant use cases and adoption to newer technologies that are nascent in the market. All share a common characteristic with security, however. As technologies get more complex and remain unproven, security technologies need to step up the use of new technologies to counter threats. Quantum security and zero trust edge correspond with the direction of the ten emerging technologies. They reflect the need to keep improving security to protect the best ROI possible with new technologies on the horizon.

Jul 7

Deloitte shares latest research into adversarial AI, ransomware in new report

Deloitte shares latest research into adversarial AI, ransomware in new report

Over the past year, 66% of organizations experienced at least one ransomware attack, with many suffering repeated breaches. According to Deloitte’s Annual Cyber Threat Trends report, ransomware, identity-based attacks, and sophisticated attack methods like zero-day exploits and AI-driven cyber espionage dominate a rapidly changing threat landscape.

Ransomware attackers specialize in making chaos pay

Attackers are using ransomware as a smash-and-grab strategy, often to finance other illegal operations. Cybercrime gangs, including those that are state-funded, rely on ransomware as a primary source of revenue as well.

Ransomware attackers aim to create widespread chaos across supply chains, amplifying the impact of their attacks. For example, United Healthcare paid a $22 million ransom in Bitcoin, demonstrating how greater disruption often leads to higher payouts.

“Sophisticated ransomware operators are increasingly using zero-day exploits as their initial access vector, with 36 percent of victims ransomed in this way. Valid credential compromise was the second most common entry point for ransomware attacks,” says Deloitte in the report.

“Phishing, remote attacks on public-facing infrastructure, and unauthorized remote desktop connections continue to be the primary sources of infiltration for ransomware,” writes Paul Furtado, Gartner vice president analyst, in a recent research report, How to Prepare for Ransomware Attacks.

Furtado notes that “bad actors are mining exfiltrated data to identify other potential sources of revenue,” further increasing the urgency to harden cyberdefenses against ransomware attacks. The following is a typical ransomware attack pattern as defined in the Gartner report.

Deloitte shares latest research into adversarial AI, ransomware in new report

Source: Gartner, How to Prepare for Ransomware Attacks, 16 April 2024

CrowdStrike’s threat intelligence teams regularly monitor every known ransomware variant. “RaaS kits are easy to find on the dark web, where they are advertised in the same way that goods are advertised on the legitimate web,” writes Kurt Baker in a blog post explaining RaaS. The post continues, “a RaaS kit may include 24/7 support, bundled offers, user reviews, forums, and other features identical to those offered by legitimate SaaS providers.”

The 2024 Annual Threat Assessment of the U.S. Intelligence Community found that “transnational organized criminals involved in ransomware operations are improving their attacks, extorting funds, disrupting critical services, and exposing sensitive data. Important U.S. services and critical infrastructure such as health care, schools, and manufacturing continue to experience ransomware attacks.”

Adversarial AI’s growing tradecraft

Deloitte’s research uncovered the growing use of adversarial AI for cyber espionage, finding it’s driving new forms of tradecraft in influence operations, social engineering, underground services, and collaboration.

Adversarial AI’s goal is to deliberately mislead AI and machine learning (ML) systems so they are ineffective for the use cases they’re being designed for. Adversarial AI refers to “the use of artificial intelligence techniques to manipulate or deceive AI systems. It’s like a cunning chess player who exploits the vulnerabilities of their opponent. These intelligent adversaries can bypass traditional cyber defense systems, using sophisticated algorithms and techniques to evade detection and launch targeted attacks.”

Deloitte shares latest research into adversarial AI, ransomware in new report

source: Deloitte Annual Cyber Threat Trends report

Influence operations are the most active threat vector of the three Deloitte is tracking. AI image deception and deepfake accuracy are accelerating faster than many existing detection technologies can keep up with.

Telesign’s 2024 Trust Index found just how wide the trust gap is becoming due to deep fakes and broader influence operations. 87% of Americans hold businesses accountable for digital privacy, yet only 34% trust them to use AI effectively to protect against fraud. Deepfakes and misinformation are driving a wedge of distrust between companies, the customers they serve, and citizens participating in elections this year.

Deloitte found that social engineering-based attacks are becoming more challenging to identify and stop. Nation-states are weaponizing LLMs and using genAI to improve their ability to launch large-scale social engineering attacks aimed at harvesting privileged access credentials and gaining control of thousands of identities in an enterprise at once.

The rapid growth of Voice Cloning-as-a-Service (VCaaS) tools powered by AI, which is used for vishing attacks to clone voices for financial fraud and unauthorized access, continues to defy easy detection. Cybercriminals and nation-state adversaries are quick to invest in new technologies that yield tradecraft that existing cybersecurity systems can’t decipher, and deepfakes are among the most undetectable today.

Preventing a ransomware attack

Start with a zero-trust mindset. Any trust-based connections in a network are a liability—a ransomware attack waiting to happen. Furtado advises, “Build and execute on a zero-trust strategy that reduces the risk of attackers abusing implicit trust in environments to achieve lateral movement, employ available exploits, and gain privilege escalation to deploy ransomware.”

Furtado’s recommendations reflect a strong zero-trust mindset that seeks to eliminate lateral movement, enforce least privilege access, and monitor all network activity while hardening identity and access management (IAM) security. In short, he’s advising having as strong of a zero-trust framework as possible in place to withstand a ransomware attack.

One of the core concepts of zero trust is to assume an attack has already penetrated the network. Furtado’s key takeaways from his recent report on ransomware include the following:

  • Have a complete preincident prevention strategy that includes workspace and endpoint protection, data protection, immutable backup, asset management, end-user awareness training, and strong identity and access management.

  • Implement a reliable asset management process to identify what needs to be protected and who is responsible, paying particular attention to legacy systems.

  • Establish a risk-based vulnerability management process that includes threat intelligence (TI) to address unpatched systems.

  • Implement both macro and micro network segmentation to minimize the blast radius of ransomware attacks.

  • Build and execute a zero-trust strategy to reduce the risk of attackers abusing implicit trust in environments.

  • Implement compliance scanning, penetration testing, and breach attack simulation (BAS) tools.

  • Remove local administrative privileges on endpoints and limit access to sensitive applications, including email, to prevent account compromise.

  • Prevent access to the command prompt and block the execution of PowerShell scripts on all user endpoints.

  • Implement strong authentication for privileged users, such as database and infrastructure administrators and service accounts, and log and monitor their activity.

« Older Entries
Newer Entries »