Posts tagged ‘ZTNA’

Oct 5

Gartner’s $247.5B security forecast makes post-quantum firewall refreshes the only upgrade through 2030

Gartner information security forecast 2024 to 2030 showing spending rising from $192.9 billion to $372.8 billion by software, services, network and consumer security, with six KPI tiles below the chart for 2026 and 2030 totals, new spending, the firewall revision, 2027 firewall growth and securing AI — Security spending climbs to $372.8B by 2030, and post-quantum firewall refreshes drew the only upgrade. Click any chart to open it full size. Source: Gartner (G00862059, Sept. 24, 2026), analysis by softwarestrategiesblog.com.

The 3Q26 Gartner information security forecast raised exactly one growth rate.

Gartner now projects firewall equipment spending to grow 13.4% in 2027 in constant currency, up from the 7.8% in its June forecast. Network security equipment overall rises to 12.8% from 8.7%. Post-quantum cryptography (PQC) is the cause. Many installed firewalls can’t run the new algorithms, which forces early replacement.

Every other business category in the 41-category forecast kept the constant-currency outlook it had 91 days earlier.

Published September 24, the forecast puts worldwide end-user spending at $247.5 billion in 2026, up 13.6% in current U.S. dollars and 12.7% in constant currency.

Spending reaches $372.8 billion by 2030. Gartner frames that as $373 billion and a 10.8% compound annual growth rate in constant currency from 2025 through 2030.

I built this analysis from Gartner’s 3Q26 report (G00862059), the full detailed dataset of 13,489 rows covering 47 countries, 9 regions, 41 categories and 7 years, and a line-by-line comparison against the 2Q26 file Gartner released in June (G00855892).

For the 2Q26 update that first counted securing AI inside the forecast, see Gartner’s $248.2B security forecast makes securing AI the only segment accelerating through 2030.

Each bar in the hero chart stacks four parts of Gartner’s forecast in current U.S. dollars. Navy is business security software, mid-blue is security services, sky blue is network security and light blue is consumer security software. Bold figures above the bars give each year’s total, with Gartner’s constant-currency growth rate in italics.

Six tiles underneath carry the 2026 and 2030 totals, the $125.4 billion in new spending between 2026 and 2030, the 2030 firewall revision in constant currency, the change in Gartner’s 2027 firewall growth forecast and the securing AI trajectory.

Both the 56% software share and the $80.5 billion software tile include consumer security software.

Gartner information security forecast puts 2026 at $247.5B and 2030 at $372.8B

Gartner splits the market into security software, security services and network security. Software keeps gaining share in every year of the forecast.

Each column in the chart below adds to 100% of total spending. Navy is security software, including consumer. Mid-blue is security services and sky blue is network security.

A panel on the right lists each market’s 2024 and 2030 spending and share. I calculated the shares from Gartner’s current-dollar figures.

Security software share rising from 49.6% in 2024 to 55.6% in 2030 while services fall from 39.3% to 33.6% — Share of worldwide information security spending by market, 2024 to 2030, current U.S. dollars. Data from Gartner G00862059 (September 2026). Shares calculated by softwarestrategiesblog.com.

Total market 2026. $247.5 billion, up $29.7 billion from $217.7 billion in 2025.

Security software 2026. $126.9 billion including $9.0 billion of consumer security software. Software reaches $207.4 billion by 2030, 55.6% of all spending, up from 49.6% in 2024.

Security services 2026. $93.5 billion. Services reach $125.4 billion by 2030, but their share falls from 39.3% in 2024 to 33.6%. Constant-currency CAGR is 7.5%, the slowest of the three markets.

Network security 2026. $27.0 billion, growing 15.0% in constant currency. It reaches $40.0 billion by 2030. Gartner raised the 2025 to 2030 CAGR for this market to 10.9%, up from 9.8% in 2Q26.

2026 to 2030 net new spending. $125.4 billion. Security software captures $80.5 billion of it, or 64%. Services add $31.9 billion. Network security adds $13.0 billion.

Gartner’s near-term call is unchanged from June. Growth slows to 11.2% in 2027 in constant currency, then decelerates to 9.6% by 2030.

Gartner names security service edge (SSE), cloud-native application protection platforms (CNAPPs), cloud security posture management, cloud access security brokers, web application firewalls, encryption and enterprise data loss prevention as the areas where 2027 budgets will grow.

It also expects AI trust, risk and security management (AI TRiSM) adoption to rise as generative AI use widens data, application and governance risk.

Post-quantum firewall refreshes drew the only growth upgrade

Gartner’s revision table compares 3Q26 against 2Q26 for all 11 subsegments. Ten of them show 0.0% growth-rate change in every year from 2026 through 2030. Network security equipment is the exception, at +4.1 points in 2027, +1.1 in 2028, +0.4 in 2029 and -0.2 in 2030.

I ran the same comparison across all 41 categories in the detailed files. In constant currency, firewall equipment is the only category Gartner raised.

It gains $1.08 billion in 2027, $1.50 billion in 2028, $1.77 billion in 2029 and $1.84 billion in 2030. The other 40 categories, including consumer security software, match the June file to the dollar in constant currency.

In the chart below, each bar is the firewall equipment increase in constant currency. Because no other category moved, the bars are also the net change for the whole market. The total is unchanged in 2025 and 2026 and turns positive in 2027, when the firewall upgrade starts.

Gartner 3Q26 versus 2Q26 information security forecast revisions in constant currency, showing firewall equipment as the only category raised, by $1.08 billion in 2027 rising to $1.84 billion in 2030, with all other 40 categories unchanged — 3Q26 vs. 2Q26 revisions by year in constant currency. Firewall equipment is the only category Gartner raised; the other 40 are unchanged. Data from Gartner G00862059 and G00855892. Revision math by softwarestrategiesblog.com.

Gartner states the cause directly. “Postquantum cryptography (PQC) requirements will drive premature hardware refreshes, initially among government, financial and defense organizations, due to the inability of many existing firewalls to support the processing demands and crypto-agility required through software or firmware updates,” the report says.

Gartner’s timing is specific. The report says “selected products may support algorithms such as FIPS 203/ML-KEM by late 2026.” Broader vendor availability follows in 2027. By 2028, Gartner expects every major firewall vendor to offer PQC-capable platforms.

Gartner expects at least 20% of customers in government, financial services and defense to upgrade in 2027, rising to more than 30% in 2028.

Firewall equipment growth in 2027 raised to 13.4% from 7.8% in Gartner's 2Q26 forecast — Firewall equipment spending and year-over-year growth, 2Q26 vs. 3Q26 forecasts, constant currency. Data from Gartner G00862059 and G00855892. Chart by softwarestrategiesblog.com.

In the top panel, the chart compares firewall equipment spending in Gartner’s 2Q26 forecast (light blue) with 3Q26 (sky blue), in constant currency. Revised values carry dark-blue labels and the 2027 and 2030 increases are marked above the bars.

Year-over-year growth sits in the bottom panel, with June’s forecast dashed and September’s solid. Both lines match through 2026, split in 2027 and converge by 2030.

That shift shows up in one year. In June, Gartner expected firewall equipment growth to fall from 16.1% in 2026 to 7.8% in 2027. Now 2027 growth holds at 13.4%.

Gartner’s revision lifts the 2027 firewall market from $20.8 billion to $21.9 billion in constant currency, and the 2030 market from $25.7 billion to $27.6 billion.

In current dollars firewall equipment reaches $28.6 billion by 2030, still the largest network security category by a wide margin.

Every region gets the upgrade at nearly the same rate. Each region’s 2030 firewall forecast rose between 6.9% and 7.8%. North America takes $834 million of the $1.84 billion. Europe takes $414 million. Together they account for 68%.

Each bar in the next chart is one region’s 2030 firewall revision in constant currency. The label shows the dollar increase, that region’s share of the $1.84 billion total and its revised 2030 firewall market. Sky-blue bars mark North America and Europe. Lighter bars are the other seven regions.

2030 firewall revision by region with North America adding $834 million and Europe $414 million — 2030 firewall equipment revision by region, 3Q26 vs. 2Q26, constant currency. Data from Gartner G00862059 and G00855892. Revision math by softwarestrategiesblog.com.

Why a firmware update will not close the gap

Gartner’s argument rests on hardware. Many installed firewalls cannot meet PQC processing and crypto-agility demands through software or firmware updates. The engineering behind that is straightforward. ML-KEM public keys and ciphertexts are larger than the elliptic-curve exchanges they replace, and hybrid key exchange runs both algorithms in the same handshake.

A firewall that inspects encrypted traffic at line rate has to absorb that overhead on every session.

Federal policy points the same way. The National Security Agency’s CNSA 2.0 guidance says traditional networking equipment such as VPNs and routers should “support and prefer CNSA 2.0 by 2026, and exclusively use CNSA 2.0 by 2030.”

According to Keyfactor’s summary of the federal timeline, new National Security System acquisitions are expected to be CNSA 2.0-compliant by default from January 1, 2027, and NIST IR 8547 proposes deprecating RSA, ECDSA, EdDSA and Diffie-Hellman at the 112-bit security level after 2030, with disallowance in 2035.

Vendor roadmaps line up with Gartner’s 2027 inflection. Cisco’s Secure Firewall PQC roadmap targets ML-KEM support in Secure Firewall Threat Defense 10.5 and ASA 9.25 for general availability in late 2026.

ML-DSA signature support is planned for FTD/ASA 11.0 in the second half of 2027, and SLH-DSA support is also planned for 11.0.

Gartner names the sectors with procurement mandates first. That is why the revision lands in 2027 and fades by 2030. Gartner models the refresh as a pull-forward, with 2030 growth now slightly below the June forecast at 6.8% versus 7.0%.

After two increases, the 2026 number dips

I have tracked Gartner’s 2026 security number through four quarterly updates. The 4Q25 update projected $244.2 billion. 1Q26 raised it to $246.2 billion. 2Q26 raised it again to $248.2 billion. 3Q26 is the first update in that run to come in lower, at $247.5 billion.

Gartner 2026 worldwide information security spending as published in each quarterly update: $244.2 billion in 4Q25, $246.2 billion in 1Q26, $248.2 billion in 2Q26 and $247.5 billion in 3Q26 — Gartner’s 2026 worldwide information security spending as published in each quarterly update, current U.S. dollars. Data from Gartner 4Q25, 1Q26, 2Q26 (G00855892) and 3Q26 (G00862059) forecasts. The y-axis starts at $240 billion to make the revisions visible.

Each bar in the chart above is the 2026 total as published in one quarterly update. The labels inside the bars show the change from the previous update, at +$2.0 billion, +$2.0 billion and -$0.8 billion.

An axis starting at $240 billion keeps the revisions visible. All four estimates sit within 2% of each other.

The entire $788 million drop is currency, not lower demand. Gartner’s revision table puts the 2026 change at -$788 million in current dollars, with 0.0% change in every 2026 growth rate. In the detailed files, the 2026 total is unchanged in constant currency.

Japan shows the currency effect most clearly. Its 2030 forecast is $1.37 billion lower in current dollars than in June, yet $49 million higher in constant currency, all of it from the firewall increase.

Gartner’s notes flag exchange-rate volatility, Strait of Hormuz disruption expected to continue into 2027, energy prices more than 50% above pre-war levels and the risk that inflation and rising interest rates erode business confidence.

Gartner expects the conflict’s main near-term effect on IT spending to be a rebalancing of sourcing, vendor relationships and regional exposure rather than a material cut.

Where the $125.4 billion in new spending goes

Growth rates show where momentum is. Dollar additions show where budgets actually move. Fifteen of the 41 categories capture 76% of all new spending between 2026 and 2030.

Bars in the next chart show the dollars each of the 15 largest categories adds between 2026 and 2030, colored by market. The indigo line, read on the right axis, is the cumulative share of the $125.4 billion total.

It reaches 15% with the first category, 46% after five, 65% after ten and 76% after fifteen.

Pareto chart of 15 security categories capturing 76% of $125.4 billion in new spending from 2026 to 2030 — Net new spending added between 2026 and 2030 by category, current U.S. dollars, with cumulative share. Data from Gartner G00862059. Dollar additions and shares calculated by softwarestrategiesblog.com.

Other security software, including securing AI. +$19.2 billion, from $18.3 billion to $37.5 billion. The largest single dollar gain in the forecast.

Endpoint protection platforms (enterprise). +$11.7 billion, from $21.3 billion to $32.9 billion.

Cloud security posture management. +$9.8 billion, from $6.3 billion to $16.1 billion.

Firewall equipment. +$8.8 billion, from $19.7 billion to $28.6 billion. Post-quantum refreshes make firewalls the fourth-largest source of new dollars, ahead of cloud workload protection.

Cloud workload protection platforms. +$8.2 billion, from $7.5 billion to $15.7 billion.

Managed security operations. +$7.0 billion, from $15.6 billion to $22.7 billion. The largest services gain.

Five categories alone account for $57.8 billion, or 46% of new spending. Three of them sit in cloud security or in other security software, where Gartner counts securing AI. Endpoint protection and the firewall, a category many security leaders had written off as a replacement-cycle business, make up the other two.

The 10 fastest-growing categories through 2030

Ranked by 2025 to 2030 CAGR in constant currency, cloud security takes the top three spots. Gartner’s cloud security subsegment grows from $16.6 billion in 2026 to $38.4 billion by 2030, a 24.1% CAGR and the fastest of the 11 subsegments.

In the chart, bar length is each category’s 2025 to 2030 CAGR in constant currency. The label gives the CAGR and the category’s 2026 and 2030 market size in current dollars.

Navy marks security software and sky blue marks network security. The dashed line is the 10.8% market CAGR, so every bar crosses it by at least 1.2 points.

Ten fastest-growing security categories led by cloud security posture management at a 27.6% CAGR — Top 10 of 41 categories by 2025-2030 CAGR in constant currency, with 2026 and 2030 market sizes in current U.S. dollars. Data from Gartner G00862059. Ranking by softwarestrategiesblog.com.

Cloud security posture management. 27.6% CAGR. $6.3 billion in 2026 to $16.1 billion in 2030.
Cloud access security brokers. 24.3%. $2.8 billion to $6.5 billion.
Cloud workload protection platforms. 21.0%. $7.5 billion to $15.7 billion.
Zero trust network access. 20.9%. $3.0 billion to $6.4 billion. The fastest-growing network security category.
Threat intelligence. 19.0%. $3.1 billion to $6.1 billion.
Consent and preference management. 18.6%. $1.0 billion to $2.0 billion.
Other security software, including securing AI. 18.5%. $18.3 billion to $37.5 billion.
Network detection and response. 12.4%. $2.6 billion to $4.1 billion.
Subject rights request automation. 12.3%. $1.5 billion to $2.3 billion.
Vulnerability assessment. 12.0%. $4.1 billion to $6.4 billion.

Gartner’s own opportunity map plots the 11 subsegments on two axes. The horizontal axis is the 2025 to 2030 CAGR. The vertical axis is dollars added over the same period. Bubble size is the 2030 market. The dashed vertical line marks the overall 10.8% CAGR.

Cloud security and other security software sit alone on the right, the only two subsegments growing faster than 15%. Infrastructure protection is the largest subsegment at $62.7 billion by 2030 and adds the most dollars, about $26 billion, while growing at the market average.

Gartner Figure 1 bubble chart of 2030 information security segment opportunities by size and growth — Figure 1: Information Security Market Opportunities, 2030 Segment Forecast. Source: Gartner, G00862059 (September 2026). Original figure by Gartner. Commentary and independent analysis by softwarestrategiesblog.com. Please click to expand.

Securing AI becomes the largest line item in 2029

Gartner places securing AI inside other security software. The report sizes the market for securing AI ecosystems and AI agents at $3 billion in 2026 and $16 billion by 2030, citing its companion analysis, Forecasting the $16.4 Billion Opportunity in Securing AI.

That makes securing AI about 16% of the other security software category in 2026 and about 43% by 2030, by my calculation.

Of the $19.2 billion the category adds over the period, roughly $13 billion comes from securing AI. The rest of the category grows from about $15.3 billion to about $21.5 billion.

Other security software is also the only category whose growth accelerates every year of the forecast, from 16.3% in 2026 to 20.1% in 2030 in constant currency. It passes enterprise endpoint protection in 2029, $31.1 billion against $30.1 billion, and finishes 2030 at $37.5 billion against $32.9 billion.

By 2030 securing AI alone, at $16 billion, is roughly the size of cloud security posture management ($16.1 billion), managed detection and response ($15.7 billion) or cloud workload protection ($15.7 billion), and larger than SIEM ($11.2 billion).

Gartner’s second AI number is larger. Gartner’s AI-amplified security forecast projects AI-amplified security, meaning existing security products with AI built in, rising from $49 billion in 2026 to $204 billion by 2030.

I covered the full AI-amplified forecast in Gartner’s AI security forecast exposes 162x services growth that still trails software 2 to 1 in new spending.

Each bar in the next chart equals Gartner’s 3Q26 total for that year. The navy segment is Gartner’s AI-amplified security spending. The light-blue segment is everything else in the information security market, calculated by subtracting AI-amplified spending from the total.

Each segment shows its dollars and its share of that year’s total. The indigo note repeats Gartner’s securing AI figures, which sit inside other security software rather than in the AI-amplified total.

Everything else, the light-blue segment, shrinks from $182.9 billion (95%) in 2024 to $168.4 billion (45%) in 2030, even as the total nearly doubles.

AI-amplified security rising from 20% of security spending in 2026 to 55% in 2030 — AI-amplified security spending as a share of total information security spending, 2024 to 2030. Data from Gartner, Forecast Analysis: AI-Amplified Security, Worldwide, 2026 (August 2026) and Gartner G00862059 (September 2026). The share combines two Gartner forecasts and is an illustrative softwarestrategiesblog.com calculation, not a Gartner-published ratio.

Set against the 3Q26 totals, AI-amplified spending rises from 20% of the market in 2026 to 39% in 2028, 47% in 2029 and 55% in 2030. Treat that as an illustration of direction, since the two forecasts were built separately.

By the end of the decade, most security dollars will buy products where AI does part of the detection, triage or response work.

Gartner’s report expects AI code security assistants and cybersecurity AI assistants to automate event triage, false-positive reduction and code remediation, and it expects organizations to shift from reactive defense toward continuous threat exposure management (CTEM).

North America is 53% of 2030 spending, and China grows fastest

On the left, the chart shows each region’s 2030 spending in current dollars and its share of the world total. On the right is each region’s 2025 to 2030 CAGR in constant currency. The dashed line marks the 10.8% world rate, and indigo marks China and Japan, the two fastest-growing regions.

2030 security spending by region with North America at $197.7 billion and China growing fastest at 15.4% — 2030 information security spending by region in current U.S. dollars and 2025-2030 CAGR in constant currency. Data from Gartner G00862059. Shares calculated by softwarestrategiesblog.com.

North America. $129.2 billion in 2026, 52.2% of the world. $197.7 billion by 2030, 53.0%. 11.4% CAGR. The United States alone reaches $181.1 billion in 2030.

Europe. $64.0 billion in 2026 to $91.3 billion by 2030. 8.6% CAGR, the slowest of the nine regions.

China. $10.7 billion in 2026, up 24.5% in current dollars. $18.7 billion by 2030. 15.4% CAGR, the fastest region.

Japan. $12.6 billion in 2026 to $22.2 billion by 2030. 13.1% CAGR, second fastest, with 17.6% constant-currency growth in 2026.

Emerging markets. Emerging Asia/Pacific grows at 11.1%, Sub-Saharan Africa at 10.5%, Latin America at 9.3%, and the Middle East and North Africa at 9.1%.

At the country level, China (16.2%), Indonesia (13.9%), Japan (13.1%) and Taiwan (12.4%) post the fastest constant-currency CAGRs among the 47 countries in the file.

All 41 categories, ranked

Growth rates spread wide across the full ranking. Seven categories grow faster than 18% a year. Twenty-nine grow below the 10.8% market rate. Two shrink.

Bars rank all 41 categories by 2025 to 2030 CAGR in constant currency. Each bar carries its CAGR, and the right-hand column lists the category’s 2030 market size in current dollars. Click the chart to open it full size.

Navy is security software, mid-blue is security services and sky blue is network security. Indigo marks the two shrinking categories, and a dashed line marks the 10.8% market rate.

All 41 Gartner security categories ranked by CAGR, with network access control and IDPS shrinking — All 41 information security categories ranked by 2025-2030 CAGR in constant currency, with 2030 market size in current U.S. dollars. Data from Gartner G00862059. Ranking by softwarestrategiesblog.com.

Network access control declines at a 17.7% CAGR, from $922 million in 2026 to $382 million in 2030. Intrusion detection and prevention systems fall at 8.3% a year, from $785 million to $548 million.

Both sit inside network security equipment, the same subsegment where firewalls, zero trust network access and network detection and response all grow. My read is that standalone network appliances are being absorbed into firewall platforms and ZTNA, which is consistent with Gartner’s comments on platform consolidation.

User authentication grows at 3.1%, the slowest positive rate in the forecast, while access management grows at 9.2% to $12.1 billion and identity governance and administration at 10.2% to $7.1 billion. My read is that identity spending is shifting from the login event to governing who and what holds access.

A reading note on Gartner’s Table 1

Readers working from the PDF of the Gartner information security forecast should check the growth columns in Table 1. For the last three rows, the growth rates appear offset by one row. The table shows 16.3% to 20.1% growth next to security consulting services and 9.0% to 5.6% next to other security software.

Gartner’s detailed dataset shows the reverse. Other security software accelerates from 16.3% to 20.1%, security consulting services slows from 9.6% to 5.0%, and security professional services slows from 9.0% to 5.6%. The dollar values in the table are correct. Every growth rate in this post comes from the detailed file.

What security leaders should do with this forecast

Inventory every firewall and VPN concentrator for PQC capability now. Gartner’s refresh window opens in 2027 for government, financial services and defense. Organizations that sell into those sectors, or connect to them, will face the same questions in their own procurement and supplier reviews. Ask vendors which appliance generations support ML-KEM in hardware at full inspection throughput, and get the answer in writing.

Budget the refresh as a 2027 and 2028 capital item. Gartner’s revision adds $1.08 billion to 2027 and another $0.43 billion in 2028, then only $0.26 billion and $0.07 billion more in 2029 and 2030. Waiting for 2029 means buying when lead times and pricing reflect peak demand.

Plan for securing AI as a line item, not a pilot. At $16 billion by 2030, securing AI will be comparable in size to CSPM and MDR. Governance gaps are already visible. Gartner’s first AI governance hype cycle found 34% of enterprises govern AI with policies they only partly follow, which I covered in Gartner’s 2026 AI Governance Hype Cycle.

Push cloud security consolidation. CSPM, CASB and CWPP are the three fastest-growing categories, and Gartner lists SSE and CNAPP adoption alongside tool consolidation and cost control as 2027 budget priorities. Consolidating onto those platforms is the most direct way to fund the growth without adding consoles and contracts.

Re-test services contracts against AI-assisted operations. Services share drops from 39.3% to 33.6% by 2030. Managed security operations still adds $7.0 billion, so outsourcing is not shrinking. What changes is the mix of human hours and AI triage inside each contract, and pricing should reflect it.

Frequently asked questions

How much will worldwide information security spending be in 2026? Gartner forecasts $247.5 billion in 2026, up 13.6% in current U.S. dollars and 12.7% in constant currency.

How big will the security market be by 2030? $372.8 billion, which Gartner frames as $373 billion and a 10.8% constant-currency CAGR from 2025 through 2030.

What changed in the 3Q26 Gartner information security forecast? Firewall equipment growth for 2027 rose to 13.4% from 7.8% in constant currency, driven by post-quantum firewall refreshes. Every other business category kept its constant-currency outlook from June.

Which security category grows fastest? Cloud security posture management, at a 27.6% CAGR from 2025 to 2030, reaching $16.1 billion.

How large is the securing AI market? Gartner sizes securing AI at $3 billion in 2026 and $16 billion by 2030, counted inside other security software.

How I built this analysis

All market sizes are Gartner end-user spending from the 3Q26 detailed forecast file (G00862059), in current U.S. dollars unless noted. All growth rates and CAGRs are constant currency, matching Gartner’s reporting convention, with 2024 as the constant-currency base year.

Revisions compare the 3Q26 and 2Q26 (G00855892) detailed files category by category in constant currency, which separates forecast changes from exchange-rate effects. Dollar additions, shares, rankings, regional splits and the AI-amplified ratio are my calculations.

Securing AI figures ($3 billion in 2026, $16 billion by 2030) are Gartner’s, as stated in the 3Q26 report. The AI-amplified figures come from Gartner’s August 2026 AI-amplified security forecast.

Earlier analysis in this series:

For each month’s AI agent attacks, exploited CVEs and breaches with primary sources, see my monthly AI security news briefing.

This post is my personal analysis of Gartner’s information security research and does not represent my employer.

Sources

Gartner, Forecast: Information Security, Worldwide, 2024-2030, 3Q26, Shailendra Upadhyay, Christian Canales, Ruggero Contu, Frank Marsala, Rahul Yadav, 24 September 2026, G00862059.
Gartner, Forecast: Information Security, Worldwide, 2024-2030, 2Q26, June 2026, G00855892.
Gartner, Forecast Analysis: AI-Amplified Security, Worldwide, 2026, Shailendra Upadhyay, 4 August 2026, G00846160.
Gartner, Forecasting the $16.4 Billion Opportunity in Securing AI, Shailendra Upadhyay, 30 July 2026, G00853861.
NSA, Announcing the Commercial National Security Algorithm Suite 2.0, cybersecurity advisory, updated May 30, 2025.
NIST, IR 8547 (initial public draft), Transition to Post-Quantum Cryptography Standards, November 2024.
Cisco, Preparing for Post-Quantum Cryptography: The Secure Firewall Roadmap.
Keyfactor, Post-Quantum Readiness for Software Vendors: The Timeline Is Now Written Down.

Aug 17

Gartner’s AI security forecast exposes 162x services growth that still trails software 2 to 1 in new spending

Gartner AI-amplified security forecast, growth multiple versus net-new dollars by segment, 2024 to 2030

Growth multiple versus net-new dollars added, 2024 to 2030. The segment ranking inverts between the two measures.

Every chart and table in this analysis opens full size when you click it.

Security services inside Gartner’s AI-amplified security market were worth $364 million in 2024. Gartner now projects $59 billion by 2030. That is 162 times larger in six years, compounding at 133.5% annually, the steepest curve anywhere in the forecast. I have tracked this forecast through every quarterly update, and no segment has ever moved like this one.

What Is AI-Amplified Security?

Gartner’s term for the share of existing security spending flowing to products with AI built in. Endpoint protection, firewalls, identity, and network security that now embed AI-driven detection, autonomous remediation, and agent-based response. Not a new category. Existing budgets redirecting toward AI-native capabilities. The companion forecast for securing AI itself reaches $16.4 billion in 2030. Gartner publicly confirms the 75%-by-2028 adoption projection.

The share table and the dollar table tell different stories. Software’s share of this market falls from 87.1% to 61.3%, and services picks up almost every point software gives up. Read only that and you conclude software is losing. Run the arithmetic on net-new spending and software still collects $116.5 billion of the $194.4 billion the market adds between 2024 and 2030. That is 60 cents of every new dollar, and it puts software ahead of services 2 to 1 on net-new spending.

Both things are true at once, and the gap between them is where security budgets get set wrong.

The numbers come from Gartner’s Forecast Analysis: AI-Amplified Security, Worldwide, 2026 (G00846160, August 4, 2026) by Shailendra Upadhyay. It is the first time Gartner has split AI-amplified security into software, services, and network security across a full seven-year window. The totals reconcile cleanly with the 2Q26 AI spending forecast, which carried AI-amplified security at $204.5 billion in 2030 without breaking out the segments underneath it.

This is a slice of the security budget, not an addition to it

The note states plainly that AI-amplified security is a subset of the information security forecast and that the spending is not additive. It points readers to the 2Q26 information security forecast, the one where securing AI became the only accelerating segment, for the parent view.

Keep the two straight. AI-amplified security is AI defending the enterprise, and it reaches $204 billion by 2030. Securing AI is the enterprise defending its own models, pipelines, and agents, at $16.4 billion in the same year. Roughly twelve dollars of AI-powered defense for every dollar spent protecting the AI doing the defending.

Key findings

$204.5 billion by 2030, up from $10.0 billion in 2024. A 65.3% CAGR and 20.4x expansion. Gartner projects that by 2028, over 75% of enterprises will use AI-amplified cybersecurity products for most use cases, up from less than 25% in 2025. AI inside the product is table stakes, not a differentiator.
Security services grows from $364 million to $59.0 billion. Share climbs from 3.6% to 28.9%, absorbing 25.3 of the 25.8 points software gives up. The skills gap is the engine.
Security software reaches $125.3 billion and still wins the dollars. Share drops 25.8 points, but software adds $116.5 billion in net-new spending against services’ $58.7 billion. Services leads on rate and share. Software leads on absolute money.
Network security reaches $20.1 billion at a 66.8% CAGR. Its share dips to 8.3% in 2027 before recovering to 9.8% in 2030. Autonomous agents for network security operations are the catalyst.
The largest annual increment lands at the end. The market adds $14.3 billion in 2024-25 and $44.0 billion in 2029-30. Growth rates fall from 143% to 27% over the same span. Budget to increments, not rates.
72% of organizations already deploy AI with a third-party vendor. Only 27% rely primarily on internal resources, per Gartner’s 2025 AI Buying Behavior Survey of 556 respondents. That split is where the services forecast comes from.
Code analysis leads GenAI security adoption at 22% in production. Combined in-use and piloting reaches 52%. Threat hunting sits at 18% in use with the highest planning rate of any use case at 44%.
About one-third of network security tasks are automated today. Even fewer use AI. That gap is where the $20.1 billion network security forecast originates.

Gartner AI-amplified security market by segment, US dollars, 2024 to 2030

AI-amplified security by segment, 2024 to 2030.

Gartner AI-amplified security market forecast by segment, US dollars millions, 2024 to 2030

Why services is the story, and where that story stops

Gartner’s 2025 AI Buying Behavior Survey quantifies the build-versus-buy split across 556 respondents. 57% deploy AI using both internal resources and third-party vendors. 27% rely primarily on internal resources. 15% go primarily through third-party vendors. Add the first and third and 72% of AI deployments already run through an outside partner.

Services did not grow 162x because buyers developed a taste for consultants. It grew because most organizations cannot staff the alternative. ISC2 measured a global cybersecurity workforce gap of 4.8 million professionals in its 2024 study, a gap that widened 19% year over year while the active workforce stayed flat. Gartner’s note describes service providers investing heavily to claim early leadership and running well ahead of their own clients in applying AI internally.

Here is the part the share chart hides. Software still captures 59.9% of all net-new spending in this market through 2030, against 30.2% for services and 9.9% for network security. A vendor reading the share decline as an exit signal would be misreading it. The software line is growing 14.3x in absolute terms while losing share to a segment growing from almost nothing.

Some CISOs will argue that services dependency creates lock-in they will pay for later. That argument is sound. It also lost. Gartner’s own numbers show in-house operation of AI security tooling has not scaled for the majority, and the 72% third-party figure is the receipt.

Growth rates decelerate while dollar increments keep climbing

Year-over-year growth falls from 142.7% in 2024-25 to 27.4% in 2029-30. That deceleration is normal for a market scaling from $10 billion to $204 billion. Services alone stays above 35% every year of the forecast, ending at 35.1% in 2029-30 after starting at 403%.

Year-over-year growth rate by segment.

Net-new dollars move the opposite direction. The market adds $14.3 billion in 2024-25, $38.0 billion in 2027-28, and $44.0 billion in 2029-30. Growth rates fall by four-fifths. Annual dollar increments triple. A business case anchored to “the market grows 143%” reads as broken by 2028. A business case anchored to “the market adds $38 billion that year” still holds.

Net-new AI-amplified security spending added per year, services versus software and network

Net new spending added per year, split by services versus software and network.

Look at the split inside those bars. In 2029-30, services contributes $15.4 billion of the $44.0 billion increment. Software and network contribute $28.7 billion. Even in the final year of the forecast, when services carries its highest share of the market, it is still the minority of new money.

The structural shift that defines this forecast

Software’s share falls 25.8 points across the forecast period. Services absorbs 25.3 of them. Network security ends roughly where it started, though not in a straight line, dipping to 8.3% in 2027 before recovering to 9.8% by 2030.

AI-amplified security segment share shift, 2024 to 2030

Segment share of the total AI-amplified security market.

The mechanism is staffing, not preference. Organizations bought AI security software intending to run it themselves. The services curve records what happened next. The $3.6 billion in venture funding flowing to agentic AI security startups confirms where the market believes the answer sits, and the acquisition wave underneath it says incumbents agree.

GenAI security adoption is broader than the in-use numbers suggest

Gartner’s 2025 Cybersecurity Innovations in AI Risk Management and Use Survey polled 302 cybersecurity leaders between March 21 and May 9, 2025. Fewer than 25% of organizations use GenAI for cybersecurity today. More than 60% are piloting or planning it. Gartner warns that without a clear strategy, many of these initiatives land as superficial implementations with high project turnover, driven by executive pressure rather than operational need.

Piloting is not aspiration. It means budget allocated, vendor selected, and a proof of concept running. Combine in-use and piloting and code analysis reaches 52%, user behavior analytics 51%, vulnerability detection 47%, and incident response 46%. The $204 billion endpoint assumes most of those pilots convert.

GenAI cybersecurity adoption by use case.

Threat hunting carries the highest planning rate in the survey at 44%, against 18% in production. No other use case has that much committed intent sitting ahead of deployment. When those budgets convert, threat hunting moves fastest in the next survey update.

Autonomous agents move from concept to production in network security

Human-centric operating models cannot absorb the scale, threat velocity, and traffic diversity that AI-driven workloads generate. Gartner describes AI-amplified network security agents that operate without predetermined workflows, adapt to security events nobody scripted, and handle threat detection, policy enforcement, and incident response while people supervise and validate rather than execute.

The trust curve is the constraint. By 2029, Gartner projects 10% of organizations will run autonomous agents with no human oversight for network security operations, up from less than 1% in 2026. Ten percent in three years is not a mass market. It is enough to reprice the segment, and the $20.1 billion forecast reflects that repricing. For how these agent numbers stack against other estimates, see my roundup of agentic AI forecasts and market estimates.

One number in the note worth checking before you quote it

Gartner’s note carries two different 2026 figures. The opening summary describes the market rising from $49 billion in 2026 to $204 billion by 2030. A later passage describes it reaching $204 billion in 2030, up from $81 billion in 2026. Table 1 puts 2026 at $48.5 billion and 2027 at $81.2 billion.

The table is the authority, and $49 billion is the number consistent with it. It also matches the $48.5 billion AI-amplified figure I reported in March from the prior forecast cycle. Anyone quoting $81 billion as a 2026 figure is quoting 2027.

What this forecast changes for CISOs and security vendors

Reassess build versus buy, then budget for both. The 72% third-party figure is an organizational verdict on in-house feasibility. Plan services into the operating model rather than bolting it on. Do not read the share shift as permission to stop buying software, because software still takes 60% of the new dollars.
Anchor business cases to dollar increments. The market adds $38.0 billion in 2027-28 and $44.0 billion in 2029-30. Those numbers stay correct. Growth percentages will look wrong inside two years.
Move on threat hunting next. It has the highest planning rate in Gartner’s survey at 44% against 18% in production. Organizations that move before the pipeline converts will have more mature detection models when it does.
Grade vendors on services delivery, not just features. A pure software licensing model captures a shrinking share of a growing market. Gartner’s note is direct about the consequence, warning that vendors who fail to operationalize AI for real-time threat detection and adaptive defense risk rapid obsolescence.
Start network security agent pilots now. Gartner projects 10% trusted autonomy by 2029. That leaves three budget cycles to build guardrails, validation workflows, and the evidence trail an auditor will ask for. Waiting until 2028 means arriving late with an unproven control set.
Watch the governance layer in parallel. Gartner’s first Hype Cycle for AI Governance puts most security-relevant governance capabilities two to five years from mainstream adoption, which is the same window in which these agents reach production.

Bottom line

I have tracked Gartner’s information security forecast through multiple quarterly updates. This is the first time the firm has published segment-level detail underneath AI-amplified security, and the segments say more than the total does. Traditional security spending is reorganizing around AI-native capability, and the delivery model is reorganizing with it.

Every CISO reading this should ask one question of their AI security strategy. Is it built around software licensing or around services delivery? The honest answer for most organizations is that it needs to be built around both, weighted differently than it is today. Services is where the growth rate lives. Software is where the money still goes.

The risk of getting this wrong is not theoretical. Forrester predicts an agentic AI deployment will cause a publicly disclosed data breach this year, leading to employee dismissals, a prediction Infosecurity Magazine reported when senior analyst Paddy Harrington framed it as a cascade of failures rather than a single point of error. Gartner’s forecast prices the defense. It does not schedule it.

Related on Software Strategies Blog

Top 10 security categories where VC funding trails Gartner’s 2026 growth forecast (April 2026)
Gartner forecasts agentic AI will overtake chatbot spending by 2027 (February 2026)
Top 6 cybersecurity trends from Gartner’s 2026 Security Forecast (February 2026)
Gartner 4Q25: $4.71T AI market proves agentic AI and data readiness are the only race that matters (January 2026)
AI Security market 2025 funding data, top startups, and the ServiceNow factor (December 2025)
Data readiness and security are driving AI’s $4.7 trillion run (December 2025)
Top 10 fastest-growing segments from Gartner’s information security forecast, Q4 2024 (January 2025)

Source and methodology

All market sizing data from Gartner, Forecast Analysis: AI-Amplified Security, Worldwide, 2026, published August 4, 2026 (ID G00846160), by Shailendra Upadhyay. AI-amplified security is a subset of the information security forecast and this is not additive spending. Survey data from the 2025 Gartner AI Buying Behavior Survey (n=556, fielded November through December 2025 across North America, Western Europe, and Asia/Pacific, organizations with $50 million or more in enterprisewide revenue) and the 2025 Gartner Cybersecurity Innovations in AI Risk Management and Use Survey (n=302, fielded March 21 through May 9, 2025, organizations with $250 million or more in fiscal 2024 revenue). Gartner notes that neither survey represents global findings or the market as a whole.

CAGR, growth multiples, market share percentages, year-over-year growth rates, incremental spending, net-new dollar allocation, and combined adoption rates computed by Software Strategies Blog from Gartner’s published segment data. Segment values are independently rounded by Gartner and do not always sum to the stated totals. All charts are original visualizations created by Software Strategies Blog.

For each month’s AI agent attacks, exploited CVEs and breaches with primary sources, see my monthly AI security news briefing.

This post is my personal reflection on Gartner’s AI-amplified security research from an industry analyst perspective. It does not represent my employer.

Jul 6

Gartner securing AI forecast, 2Q26: securing AI turns Other Security Software into the only accelerating segment, 16.3% to 20.1% by 2030

Gartner’s $248.2B security forecast makes securing AI the only segment accelerating through 2030

Gartner's 2Q26 information security forecast puts 2026 spending at $248.2B and adds securing AI for the first time, making other security software the only segment accelerating through 2030.

Apr 8

Top 10 security categories where VC funding trails Gartner’s 2026 growth forecast, Crunchbase data

Two of Gartner’s 10 fastest-growing security categories have zero venture-backed startups. Firewall equipment, a $26.7 billion market by 2030, and pure-play cloud access security brokers, projected at $7.1 billion, are controlled entirely by incumbent vendors. No startup has raised a dollar in either category since January 2025.

I cross-referenced Gartner’s 1Q26 Information Security forecast against CB Insights, Crunchbase, and PitchBook funding data for every one of the 10 fastest-growing security categories. The question: where is venture capital following Gartner’s growth signal, and where is it missing?

The answer is stark. $93.2 billion in projected 2030 spending across these 10 categories. $11.2 billion in total VC raised by 59 funded startups. That is an 8.3:1 gap between where enterprise demand is heading and where startup capital is flowing. In 5 of 10 categories, the gap exceeds 12:1. As I detailed in last week’s analysis of the 10 fastest-growing categories, growth is concentrating in cloud infrastructure, proactive intelligence, and privacy compliance. The VC data tells you whether anyone is building what CISOs need to buy.

“Cybersecurity leaders are navigating uncharted territory this year as these forces converge, testing the limits of their teams in an environment defined by constant change,” said Alex Michaels, Director at Gartner. The spending data confirms it. The startup funding data shows the supply side has not caught up.

The master table: Gartner forecast vs. startup funding by category

I mapped each Gartner category against every cybersecurity startup that raised equity or debt since January 2025. Each company is assigned to one primary category to avoid double-counting. Gap Ratio is the Gartner 2030 market projection divided by total VC raised. Higher means wider gap.

#	Gartner Security Category	2025-26 GR	5yr CAGR	2030 Proj	Startups	Total VC	Gap Ratio	Verdict
1	Cloud Access Security Brokers (CASB)	27.2%	24.3%	$7.1B	4	$182M	39:1	Critical Gap
2	Firewall Equipment (NGFW/FWaaS)	15.9%	9.1%	$26.7B	0	$0	∞	Incumbent Lock
3	Cloud Security Posture Mgmt (CSPM)	33.4%	27.6%	$16.2B	6	$752M	21.5:1	Underfunded
4	Vulnerability Assessment	15.7%	12.0%	$6.4B	6	$306M	20.9:1	Underfunded
5	Cloud Workload Protection (CWPP)	25.9%	21.0%	$16.1B	8	$1.28B	12.6:1	Underfunded
6	Subject Rights Request Automation	16.2%	12.3%	$2.3B	2	$240M	9.6:1	M&A Absorbed
7	Network Detection & Response (NDR)	15.6%	12.4%	$4.1B	4	$701M	5.9:1	Moderate Gap
8	Zero Trust Network Access (ZTNA)	23.0%	20.9%	$6.4B	10	$1.94B	3.3:1	VC Ahead
9	Threat Intelligence	27.3%	21.1%	$6.9B	12	$3.16B	2.2:1	Oversupplied
10	Consent & Preference Mgmt	22.1%	18.6%	$2.0B	7	$2.61B	0.8:1	Oversupplied

Source: Gartner 1Q26 Information Security Market Current Outlook (G00846158, March 2026). Growth rates in constant currency. Funding data from CB Insights, Crunchbase, PitchBook. Analysis by Software Strategies Blog, April 2026.

The table splits cleanly into three tiers. Five categories are underfunded or locked out (Gap Ratio above 9:1). Two sit in the middle. Three are oversupplied or ahead of the Gartner signal.

I update this comparison every quarter as Gartner releases new forecast data. Get the next one in your inbox.

The 3 widest gaps

Gap #1: CASB — 39:1, and the category is disappearing

Gartner projects cloud access security brokers reaching $7.1 billion by 2030 at a 24.3% CAGR. Total startup funding since January 2025: $182 million across just 4 companies.

Company	Total Funding	Last Round	Lead Investor	HQ	Founded
Reco	$85M	$30M Series B	Zeev Ventures	New York	2020
Seraphic Security	$44M	$29M Series A	GreatPoint Ventures	Palo Alto / Israel	2020
Nudge Security	$35M	$22.5M Series A	Cerberus Ventures	Austin, TX	2021
Spin.AI	$18M+	Undisclosed (K1)	K1 Investment Mgmt	Palo Alto	2017

The gap is structural, not cyclical. Pure-play CASB startups no longer exist as a standalone category. The buying motion has shifted to SASE platforms. Cato Networks raised $409 million in a Series G in June 2025, but that money funds a unified SASE platform spanning CASB, ZTNA, and SD-WAN.

For CISOs, the implication is direct. If your CASB requirement is standalone, your vendor options are Netskope, Skyhigh, Forcepoint, and a handful of sub-$50 million startups. Expect fewer competitive bids and less pricing leverage than in categories where VC is abundant.

Gap #2: CSPM — 21.5:1, the fastest-growing category is still starved

Cloud security posture management is the single fastest-growing category in Gartner’s entire information security forecast. 33.4% growth in 2026. $16.2 billion by 2030 at a 27.6% five-year CAGR. Total startup funding: $752 million across 6 companies.

Company	Total Funding	Last Round	Lead Investor	HQ	Founded
Upwind Security	$430M	$250M Series B	Bessemer Venture Partners	San Francisco	2022
Noma Security	$132M	$100M Series B	Evolution Equity Partners	New York / Tel Aviv	2023
Sentra	$100M+	$50M Series B	Key1 Capital	New York / Tel Aviv	2021
Native Security	$42M	$31M Series A	Ballistic Ventures	Tel Aviv / Seattle	2024
Mondoo	$32.5M	$17.5M Series A Ext	HV Capital	San Francisco	2020
AccuKnox	$15M	$4M Venture	DreamIt Ventures	Menlo Park	2020

Upwind alone accounts for 57% of all CSPM startup capital. It hit unicorn status at a $1.5 billion valuation in January 2026. But one company cannot fill a $16.2 billion market.

Alphabet’s $32 billion acquisition of Wiz in March 2026 removed the largest independent cloud security company from the startup market entirely. In my analysis of $3.6 billion in agentic AI security funding, I tracked how M&A is filling gaps that VC has not. CSPM is a category where that pattern is accelerating.

Gap #3: Vulnerability Assessment — 20.9:1, the most active seed-stage category

Gartner projects vulnerability assessment at $6.4 billion by 2030. Total VC: $306 million across 6 companies.

Company	Total Funding	Last Round	Lead Investor	HQ	Founded
Zafran Security	$130M	$60M Series C	Menlo Ventures	New York	2022
Seemplicity	$82M+	$50M Series B	Sienna Venture Capital	Tel Aviv	2020
Cogent Security	$53M	$42M Series A	Bain Capital Ventures	San Francisco	2024
Nucleus Security	$20M+	$20M Series C	Undisclosed	Tampa, FL	2018
Onit Security	$11M	$11M Seed	Hetz Ventures	Tel Aviv	2025
ZAST.AI	~$10M	$6M Pre-A	Hillhouse Capital	Seattle	2024

This is the category with the most active early-stage investment. Cogent Security and Onit Security both use AI agents for autonomous vulnerability remediation. Zafran tripled ARR since its prior round. The agentic AI thesis is landing hardest in vulnerability management, and the funding trail shows it.

Balbix, which had raised $98.6 million, was acquired in November 2025. For CISOs evaluating this category, the vendor field is young and fragmented. Half of the funded companies were founded in 2024 or later.

Where VC is ahead of Gartner

Three categories show the opposite pattern. In Consent & Preference Management, OneTrust alone has raised $2.1 billion against a $2.0 billion Gartner projection. In Threat Intelligence, $3.16 billion in VC against a $6.9 billion projection, but Dataminr ($1.24B) and ReliaQuest ($1.13B) account for 75% of the total. In ZTNA, Cato Networks’ $1.1 billion alone represents 57% of all category funding.

The concentration risk matters. Strip out the single largest company in each oversupplied category and the gap ratios invert. Consent without OneTrust: $510 million, Gap Ratio 3.9:1. Threat Intelligence without Dataminr and ReliaQuest: $790 million, Gap Ratio 8.7:1. ZTNA without Cato: $835 million, Gap Ratio 7.7:1.

M&A is filling the gaps VC won’t

When startups cannot fill the gap, platform vendors acquire. The $3.6 billion in agentic AI security funding and $96 billion in M&A I tracked in March tells this story at scale. Palo Alto Networks assembled $29 billion in acquisitions. ServiceNow spent $11.6 billion. Alphabet closed $32 billion for Wiz. Veeam acquired Securiti.ai for $1.725 billion, removing the leading subject rights automation vendor from the independent market.

Forrester’s 2026 cybersecurity budget data confirms the same pattern from the buyer side. Security budgets are growing, but the spend is concentrating in fewer, larger platform purchases.

What this means for CISOs

In underfunded categories, build internally or accept platform vendor lock-in. CSPM, vulnerability assessment, and CWPP all have Gap Ratios above 12:1. Fewer funded startups means fewer competitive alternatives. If your preferred vendor gets acquired, as Wiz, Securiti.ai, and Balbix all were, your roadmap depends on the acquirer’s priorities, not yours.

In oversupplied categories, use the competition for better pricing. ZTNA, threat intelligence, and consent management have abundant VC-backed alternatives. Negotiate harder. Run competitive evaluations with three or more vendors. The funding data tells you which categories give you leverage.

Watch for single-company concentration. Chainguard holds 70% of all CWPP startup funding. Cato holds 57% of ZTNA. OneTrust holds 80% of consent management. If any of these companies pivots, gets acquired, or fails, the category funding picture changes overnight.

Bottom line

Gartner projects $93.2 billion in 2030 spending across the 10 fastest-growing security categories. Venture capital has funded $11.2 billion in startups since January 2025. The 8.3:1 blended gap tells you the overall story. The category-level ratios tell you where to act.

Cloud security posture management, vulnerability assessment, and cloud workload protection are growing at 2x to 3x the market average but remain underfunded relative to Gartner’s projections. Two categories, firewall equipment and pure-play CASB, have no startup investment at all. Platform vendors are filling gaps through acquisition at a pace that is reshaping every competitive evaluation.

This is the third quarter I have tracked Gartner’s security forecast against independent funding data. The gap between enterprise demand and startup supply keeps widening. Gartner’s 2Q26 forecast lands in July. I will break down the updated Gap Ratios the week it drops. I wrote a shorter editorial take on what these gaps mean for CISO budgets on my Substack.

Source: Gartner, Information Security Market Current Outlook, Worldwide, 1Q26 (G00846158), March 2026. Growth rates in constant currency. Dollar figures in current U.S. dollars. Funding data from CB Insights, Crunchbase, PitchBook, Statista. Cross-referenced against company press releases. Analysis by Software Strategies Blog.

Jan 13

Gartner’s 4Q25 Information Security forecast shows 15 categories capturing half of all new security spending through 2029

Fifteen cybersecurity categories are growing up to three times faster than the overall market, capturing $48.7 billion in new spending by 2029.

That’s nearly half of the $98.4 billion the entire security market will add over the next four years. Cloud Security Posture Management leads the pack at 29.36% CAGR. Cloud Access Security Brokers follow at 24.81%.

Enterprises are fundamentally restructuring their security budgets, and the driver is brutal in its simplicity. Organizations now manage an average of 112 SaaS applications across multiple cloud providers. 82% of misconfigurations are caused by human error, according to Exabeam’s analysis. And Gartner estimates 99% of cloud security failures through 2025 will be the customer’s fault, primarily from these misconfigurations. Manual oversight breaks under this kind of scale. Enterprises are responding by investing in automation that manages what people can’t across hundreds of cloud accounts, thousands of APIs, and millions of attack vectors.

Gartner’s 4Q25 update delivers the clearest signal yet about where enterprise security budgets are heading. The overall information security market grows from $213.5 billion in 2025 to $311.9 billion by 2029 at 10.03% CAGR. These fifteen high-growth categories are expanding at 10.30% to 29.36% CAGR, capturing investment dollars at rates that dwarf legacy security spending patterns.

What makes these categories different

Every high-growth category eliminates manual bottlenecks that break under cloud-native workloads. CSPM scans configurations continuously. CASB provides visibility into unauthorized SaaS usage. ZTNA verifies every connection rather than trusting the network location. With 79% of organizations using multiple cloud providers, according to Spacelift’s research, manual processes create mathematical impossibilities.

These technologies prevent problems rather than clean up after them. CSPM catches misconfigurations before breaches. ZTNA eliminates the attack surface that VPNs create. Tokenization protects data even when systems get compromised. Security teams are finally getting ahead of threats instead of constantly playing catch-up.

And the ROI is quantifiable. IBM’s 2025 Cost of a Data Breach Report shows organizations using AI and automation extensively save $1.9 million per breach and reduce breach lifecycles by 80 days. U.S. breach costs average $10.22 million. These investments pay for themselves with a single prevented incident—a calculation CFOs understand.

The 15 categories reshaping enterprise security

1. Cloud Security Posture Management (CSPM) — 29.36% CAGR — $4.68B → $12.76B

CSPM platforms scan infrastructure continuously across AWS, Azure, and Google Cloud, automatically remediating misconfigurations before they become breaches. The 82% human error rate isn’t going to improve through training. Organizations managing 100+ cloud accounts need automation. CSPM adds $8.09 billion in new spending by 2029, the single largest dollar contribution among high-growth segments.

2. Cloud Access Security Brokers (CASB) — 24.81% CAGR — $2.30B → $5.58B

Here’s the brutal reality. Enterprises average 112 SaaS applications, but shadow IT accounts for 42% of all applications per JumpCloud’s data. IT stays blind to roughly 78 apps out of an average 187-app environment. The damage? 65% of shadow IT deployments result in data loss, and 52% lead to breaches, according to Mimecast research. CASBs restore visibility and control, growing to $5.58 billion by 2029.

3. Zero Trust Network Access (ZTNA) — 21.95% CAGR — $2.48B → $5.43B

ZTNA replaces the VPN model with application-specific access controls. Instead of network-level access, it provides application-specific connections verified for every request. Gartner predicts 70% of new remote access deployments will use ZTNA by 2025, up from less than 10% at the end of 2021. And 65% of companies plan to retire VPNs within one year per Cybersecurity Insiders data. This represents a wholesale rethinking of secure access. The perimeter-based model is dying. Good riddance.

4. Threat Intelligence — 21.73% CAGR — $2.58B → $5.69B

Modern threat intelligence platforms fuse telemetry from open-source intelligence, dark-web monitoring, vendor feeds, and internal logs. Machine learning prioritizes indicators based on organizational relevance. IBM data shows organizations integrating threat intelligence reduce detection and escalation costs while cutting incidents by 30%. The market reaches $5.69 billion by 2029 as enterprises shift from passive threat feeds to automated response integration.

5. Cloud Workload Protection Platforms (CWPP) — 21.53% CAGR — $5.98B → $13.11B

Traditional endpoint security can’t protect containers that spin up and vanish in seconds. Serverless functions executing for milliseconds? Legacy tools weren’t designed for that. CWPP solutions instrument workloads directly at the kernel or hypervisor level, monitoring system calls, file access, and network connections in real-time. The 21.53% CAGR reflects the rapid shift toward microservices and Kubernetes. As workloads migrate into container clusters, protecting them becomes a survival-level priority.

6. Consent and Preference Management — 20.22% CAGR — $0.81B → $1.64B

GDPR fines surpassed €5.88 billion by January 2025, according to DLA Piper’s annual survey. California’s CCPA penalties keep climbing. The California Privacy Protection Agency recently fined Todd Snyder $345,178 for inadequate opt-out and privacy request processes. Manual consent workflows can’t meet regulatory deadlines across jurisdictions. Automated platforms centralize preferences across web, mobile, and API endpoints while providing auditable logs for regulators.

7. Subject Rights Request (SRR) Automation — 14.26% CAGR — $1.24B → $2.01B

When users demand “delete my data,” these platforms automate orchestration across internal systems and third-party vendors. Privacy laws grant individuals rights to access, correct, and delete personal data with strict compliance timelines. SRR automation prevents the penalties that result from manual processing failures at scale, especially as more jurisdictions implement data privacy regulations.

8. Network Detection and Response (NDR) — 13.44% CAGR — $2.15B → $3.37B

NDR platforms establish behavioral baselines using statistical analysis and machine learning. When anomalies appear (unusual lateral movement, data exfiltration attempts, command-and-control traffic), they raise alerts or automatically isolate systems. The mindset shift matters here. Rather than hoping to prevent all attacks, sophisticated organizations invest in rapid detection that minimizes damage when attackers inevitably breach perimeters. Prevention alone isn’t sufficient anymore.

9. Vulnerability Assessment — 13.02% CAGR — $3.48B → $5.60B

Quarterly vulnerability scans are obsolete in CI/CD pipelines deploying multiple times daily. Modern assessment platforms provide continuous scanning integrated with exploit intelligence to prioritize patches based on real-world risk. DevOps teams need vulnerability detection that keeps pace with their deployment cadence. Anything less creates unacceptable exposure windows.

10. Tokenization — 12.68% CAGR — $1.34B → $2.11B

Tokenization replaces sensitive data with non-reversible tokens that can’t be mathematically decoded. The urgency comes from quantum computing advances. NIST finalized post-quantum encryption standards in August 2024, including ML-KEM (formerly CRYSTALS-Kyber) and ML-DSA (formerly CRYSTALS-Dilithium). Attackers already practice “harvest now, decrypt later”—collecting encrypted data today for quantum decryption within five to ten years. Organizations must begin quantum-safe transitions now.

11. Endpoint Protection Platform (EPP) — 12.51% CAGR — $17.68B → $28.36B

The largest single category adds $10.68 billion in new spending as ransomware attacks surge. U.S. ransomware attacks increased 149% year-over-year—from 152 incidents in early 2024 to 378 in the same period of 2025, according to Cyble analysis. Next-generation EPP platforms use behavioral analytics and signatureless detection to stop ransomware before encryption begins, catching what traditional antivirus misses.

12. Secure Web Gateway (SWG) — 11.63% CAGR — $4.44B → $6.74B

Malicious sites appear and disappear in hours. Cloud-delivered SWGs update threat intelligence in real-time, protecting remote and hybrid workforces wherever they connect. Integration with ZTNA creates comprehensive security that follows users across devices and locations without relying on network perimeters that no longer exist.

13. Web Application Firewalls (WAF) — 10.92% CAGR — $2.48B → $3.74B

Organizations expose hundreds of APIs and microservices—each a potential attack vector. Traditional network firewalls can’t inspect application-layer attacks like SQL injection, cross-site scripting, or API abuse. Modern WAFs use machine learning to differentiate legitimate user behavior from attack traffic without blocking customers. Getting that balance right is harder than it sounds.

14. Encryption — 10.64% CAGR — $1.35B → $1.98B

NIST’s standardization of quantum-resistant algorithms signals the urgency that organizations can no longer ignore. With quantum computing advances accelerating, encrypted data collected today faces decryption within a decade. Enterprises must transition to post-quantum cryptography now because full integration across complex environments takes years. This isn’t theoretical risk anymore.

15. Security Information and Event Management (SIEM) — 10.30% CAGR — $7.60B → $11.15B

AI transforms SIEM from reactive log collection to proactive threat hunting. The latest platforms embed unsupervised machine learning to detect zero-day attacks and automatically enrich alerts with context. Organizations using AI-powered automation save $1.9 million per breach and cut incident lifecycles by 80 days—turning security operations into a competitive advantage rather than a cost center.

Why this matters

Cloud complexity has proven exponential. With 79% of organizations using multiple cloud providers and managing hundreds of accounts, manual security processes break under the load. The 29.36% CAGR for CSPM isn’t market optimism. It’s organizational survival.

Shadow AI joins shadow IT as a core threatscape element. Shadow AI breaches cost $4.63 million—$670,000 more than standard incidents, according to IBM data. But AI also powers the best defenses, with automated security tools reducing breach lifecycles by 80 days. The same technology that creates vulnerabilities offers the most effective countermeasures.

Compliance costs keep accelerating. Between GDPR, CCPA, and emerging global regulations, manual compliance processes create escalating liability. Automated platforms turn regulatory requirements into competitive advantages by reducing fine exposure and accelerating data subject request responses.

Bottom Line

The organizations winning this transformation aren’t those with the largest security budgets. They’re the ones investing in the right categories at the right time. These fifteen segments define what modern security architecture looks like and capture nearly half of all new security spending through 2029.

Gartner’s 4Q25 data delivers a clear message. Security spending is shifting to automation-driven, zero-trust, cloud-native architectures. Organizations still relying on legacy approaches aren’t just falling behind. They’re accepting risks the market has already priced as unacceptable.

Source: Gartner Forecast: Information Security, Worldwide, 2023-2029, 4Q25 Update (Document G00843183, published December 18, 2025), showing overall market growth from $213.5B (2025) to $311.9B (2029) at 10.03% CAGR in constant currency.

Nov 26

15 fastest-growing security categories in Gartner’s 3Q25 Information Security Forecast

Cloud Security Posture Management is growing at a 31.23% CAGR. Zero Trust Network Access at 23.25%. Threat Intelligence at 22.17%. The overall security market? Just 10.55%. Fifteen categories are outpacing the market by two to three times, collectively capturing $106 billion in new spending by 2029. Enterprise security budgets aren’t just expanding. They’re being redirected.

And the driver? Brutally simple.

Gartner estimates 99% of cloud security failures through 2025 will be the customer’s fault, primarily due to misconfigurations. Organizations are responding by investing aggressively in technologies that automate what humans simply can’t manage manually across hundreds of cloud accounts, thousands of APIs, and millions of potential attack vectors.

What these growth rates say about Gartner’s view of the market

These fifteen categories represent $106.4 billion in new spending by 2029, growing from today’s baseline. What do they have in common? Three characteristics that explain why enterprises are pouring money into them:

Automation at Scale. Every high-growth category automates processes that break when done manually, whether it’s scanning cloud configurations, managing consent across jurisdictions, or detecting behavioral anomalies in network traffic. There’s no other way to keep pace.
Proactive vs. Reactive. These technologies prevent problems rather than clean up after them. CSPM catches misconfigurations before breaches. ZTNA eliminates the attack surface that VPNs create. Tokenization protects data even if systems are compromised. Security teams are finally getting ahead of the threat curve instead of playing catch-up.
Measurable ROI. IBM’s 2025 Cost of a Data Breach Report shows organizations using AI and automation extensively save $1.9 million per breach and reduce breach lifecycle by 80 days. With U.S. breach costs hitting $10.22 million, these investments pay for themselves with a single prevented incident.

The 15 categories reshaping security architecture

1. Cloud Security Posture Management (CSPM) | 31.23% CAGR | $2.5B → $13.0B

CSPM tools continuously scan infrastructure across AWS, Azure, and Google Cloud. With 82% of misconfigurations caused by human error and organizations managing 100+ cloud accounts, CSPM automates what’s mathematically impossible to do manually. The market will reach $15.6 billion by 2032.

2. Cloud Access Security Brokers (CASB) | 25.82% CAGR | $1.5B → $5.8B

Here’s a reality check. Enterprises average 112 SaaS applications, but shadow IT, or unauthorized apps, accounts for 42% of all applications. IT remains unaware of one-third of the apps on its networks. The damage? 65% of shadow IT companies suffer data loss, and 52% experience breaches. CASBs transform this chaos into visibility and control.

3. Zero Trust Network Access (ZTNA) | 23.25% CAGR | $1.6B → $5.6B

ZTNA kills the VPN model. Instead of network access, it provides application-specific connections verified for every request. Gartner predicts 70% of new remote access deployments will use ZTNA by 2025. With 65% of companies planning to replace VPNs, this shift represents a wholesale rethinking of secure access. The perimeter-based model is dying. Good riddance.

4. Cloud Workload Protection Platforms (CWPP) | 22.78% CAGR | $3.9B → $13.5B

CWPP platforms secure everything from traditional VMs to containers that exist for milliseconds. Legacy endpoint security can’t protect ephemeral containers or serverless functions—it wasn’t designed for workloads that appear and disappear in seconds. The shift to microservices demands purpose-built security.

5. Consent and Preference Management | 22.39% CAGR | $0.5B → $1.7B

GDPR fines reached €5.88 billion by January 2025, according to the DLA Piper GDPR Fines and Data Breach Survey. California’s CCPA penalties continue climbing; the California Privacy Protection Agency fined Todd Snyder $345,178 for inadequate opt-out and privacy request processes. Manual handling can’t meet regulatory deadlines. Automation prevents massive fines.

6. Threat Intelligence | 22.17% CAGR | $1.8B → $5.8B

IBM data shows threat intelligence reduces detection and escalation costs by $1.63 million while cutting incidents by 30%. Modern platforms aggregate data about bad actors and vulnerabilities, transforming raw threat data into automated responses across security stacks. The days of threat feeds sitting in dashboards, unused, are over.

7. Subject Rights Request Automation | 16.53% CAGR | $0.8B → $2.1B

When users demand “delete my data,” these platforms automate the process across all systems. Manual handling doesn’t scale, not when you’re managing requests across multiple jurisdictions with different requirements and tight deadlines.

8. Tokenization | 14.26% CAGR | $1.0B → $2.2B

Tokenization replaces sensitive data with meaningless tokens that can’t be mathematically reversed. Why the urgency now? NIST standardized quantum-resistant algorithms, including ML-KEM (formerly CRYSTALS-Kyber), in August 2024. Organizations are preparing for quantum threats expected within five to ten years.

9. Network Detection and Response (NDR) | 14.05% CAGR | $1.6B → $3.5B

NDR platforms use AI to establish behavioral baselines and detect anomalies signaling compromise. Here’s the mindset shift: rather than hoping to prevent all attacks, innovative organizations invest in rapid detection that minimizes damage when sophisticated attackers inevitably get through. Prevention isn’t enough anymore.

10. Vulnerability Assessment | 13.98% CAGR | $2.6B → $5.7B

Cloud infrastructure changes constantly. Quarterly scans are obsolete before they finish. Modern platforms provide continuous scanning in CI/CD pipelines, prioritizing based on real-world exploit data. DevOps teams deploying daily need vulnerability detection that keeps pace. Anything less is theater.

11. Endpoint Protection Platform (EPP) | 13.61% CAGR | $13.5B → $29.1B

The largest category doubles to $29.1 billion as ransomware attacks surge. According to Cyble analysis cited by TechTarget, U.S. ransomware attacks increased by 149% year-over-year in the first five weeks of 2025. Manufacturing led targets with 638 attacks in 2023, per Statista data compiled by Fortinet. Next-gen EPP uses behavioral analytics to stop ransomware before encryption begins—catching what traditional antivirus misses.

12. Secure Web Gateway (SWG) | 13.26% CAGR | $3.3B → $7.0B

Malicious sites appear and disappear in hours. Cloud-delivered SWGs update threat intelligence in real-time, protecting remote workers wherever they connect. Integration with ZTNA creates comprehensive security that follows users across devices and locations. The old perimeter? It no longer exists.

13. Web Application Firewalls (WAF) | 11.93% CAGR | $2.0B → $3.8B

Organizations expose hundreds of APIs, each a potential attack vector. Traditional network firewalls can’t inspect application-layer attacks. Modern WAFs use machine learning to distinguish legitimate users from attackers without blocking customers. Getting that balance right is harder than it sounds.

14. Encryption | 11.90% CAGR | $1.0B → $2.0B

NIST’s standardization of quantum-resistant algorithms signals urgency. Attackers already practice “harvest now, decrypt later”—collecting encrypted data for future quantum decryption. Organizations must transition to post-quantum cryptography now, as full integration takes years. This isn’t theoretical risk anymore.

15. Security Information and Event Management (SIEM) | 11.74% CAGR | $5.8B → $11.3B

AI transforms SIEM from reactive to proactive. Organizations using AI-powered automation save $1.9 million per breach, according to IBM’s newsroom. Machine learning models identify attack patterns and detect zero-day threats before signatures exist, turning security operations into a competitive advantage.

The Investment Thesis behind the numbers

These growth rates reflect three converging realities:

Cloud Complexity Is Exponential. With 79% of organizations using multiple cloud providers and managing hundreds of accounts, manual security is mathematically impossible. The 31.23% CAGR for CSPM isn’t optimism, it’s survival.
AI Changes Everything. Shadow AI breaches cost $4.63 million, $670,000 more than standard incidents. But AI also powers the defense, with automated security tools reducing breach lifecycles by 80 days. The same technology that creates vulnerabilities offers the best defense.
Compliance Costs Are Skyrocketing. Between GDPR, CCPA, and emerging regulations, manual compliance is a liability that grows daily. Automation platforms turn regulatory requirements into competitive advantages.

The Bottom Line

The organizations winning this race aren’t those with the most significant security budgets; they’re those investing in the right categories at the right time. These fifteen segments aren’t just growing fast; they’re defining what modern security architecture looks like.

The message from Gartner’s data is unambiguous: security spending is shifting from reactive to proactive, from manual to automated, from perimeter-based to zero-trust. Organizations still relying on legacy approaches aren’t just falling behind; they’re accepting risks that the market has already priced as unacceptable.

Source: Gartner Information Security Forecast 3Q25 Update (Document G00839334), showing overall market growth from $215.8B (2025) to $322.2B (2029) at 10.55% CAGR

Mar 10

Gartner Predicts Solid Growth for Information Security, Reaching $287 Billion by 2027

Image created in DALL-E

AI continues to become more weaponized with nation-state attackers and cybercrime gangs experimenting with LLMs and gen AI-based attack tradecraft. The age of weaponized LLMs is here.

At the same time, multi-cloud-based infrastructures more businesses rely on are coming under attack. Exfiltrating any identity data available from endpoints and then traversing a network to gain more access by collecting more credential data is often the goal.

Cyberattacks that combine AI and social engineering are just beginning

Attackers have a version of human-in-the-middle, too, but their goal is to unleash AI’s offensive attack capabilities within social engineering campaigns. Last year’s social engineering-based attacks on MGM, Comcast, Shield Healthcare Group, and others serve as a case in point.

CrowdStrike’s 2024 Global Threat Report finds that cloud intrusions jumped 75% last year. There was a 76% increase in data theft victims named on data leak sites and a 60% increase in interactive intrusion campaigns. Worse, 75% of attacks were malware-free, making them difficult to identify and stop. There was also a 110% YoY increase in cloud-conscious cases.

PwC’s 2024 Digital Trust Insights Report finds that 97% of senior management teams have gaps in their cloud risk management plans. 47% say cloud attacks are their most urgent threat. One in three senior management teams is prioritizing cloud security as their top investment this year.

Gartner sees a more complex threatscape driving growth

Gartner’s Forecast: Information Security and Risk Management, Worldwide, 2021-2027, 4Q23 Update report predicts the information security and risk management market will grow from $185 billion in 2023 to $287 billion in 2027, attaining a compound annual growth rate of 11% in constant currency.

Nation-state attackers are picking up the pace of their stealthy AI arms race. They’re looking to score offensive first victories on an increasingly active digital battlefield. Gartner predicts that in 2027, 17% of the total cyberattacks and data leaks will involve generative AI.

Another key assumption driving Gartner’s latest forecast is that by 2025, user efficiency improvements will drive at least 35% of security vendors to offer large language model (LLM)-driven chat capabilities for users to interact with their applications and data, up from 1% in 2022.

Gartner has also factored in the surge in cloud attacks and the continued growth of hybrid workforces. One of their key assumptions driving the forecast is that “by the end of 2026, the democratization of technology, digitization, and automation of work will increase the total available market of fully remote and hybrid workers to 64% of all employees, up from 52% in 2021.”

Source: Gartner, Forecast Analysis: Information Security and Risk Management, Worldwide, Published February 29, 2024

Source: Gartner, Forecast Analysis: Information Security and Risk Management, Worldwide, Published 29 February 2024

Key takeaways from Gartner’s forecast

Market subsegments predicted to see the most significant growth through 2027 include the following:

Gartner has high expectations for Zero Trust Network Access (ZTNA) growth, stating the worldwide market was worth $575.7 million in 2021 and predicting it will soar to $3.99 billion in 2027, attaining a 31.6% CAGR in the forecast period.
Identity Access Management (IAM) is predicted to grow from $4 billion in 2021 to $11.1 billion in 2027, attaining a 17.6% CAGR. Identity Governance and Administration software is predicted to grow from $2.8 billion in 2021 to $5.77 billion in 2027, attaining a 12.8% CAGR.
Endpoint Protection Platforms (EPP) are predicted to grow from $9.8 billion in 2021 to $26.9 billion in 2027, achieving a 17.2% CAGR.
Threat Intelligence software is predicted to grow from $1.1 billion in 2021 to $2.79 billion in 2027, growing at a 15.6% CAGR through the forecast period.
Cloud Access Security Brokers (CASB) is predicted to grow from $928M in 2021 to $4.75 billion in 2027, attaining a CAGR of 30.2%. Gartner believes that the market share of cloud-native solutions will continue to grow. They are predicting that the combined market for cloud access security brokers (CASBs) and cloud workload protection platforms (CWPPs) will reach $12.8 billion in constant currency by 2027, up from $4.6 billion in 2022. Gartner continues to also see strong demand for cloud-based detection and response solutions that include endpoint detection and response (EDR) and managed detection and response (MDR).

Researching the intersection of AI, machine learning and cybersecurity in the enterprise

Posts tagged ‘ZTNA’

Gartner Predicts Solid Growth for Information Security, Reaching $287 Billion by 2027

Like this:

Email Subscription

Top Posts

This Blog’s Purpose

Pages

Categories

Search

Researching the intersection of AI, machine learning and cybersecurity in the enterprise

Posts tagged ‘ZTNA’

Gartner’s $247.5B security forecast makes post-quantum firewall refreshes the only upgrade through 2030

Gartner information security forecast puts 2026 at $247.5B and 2030 at $372.8B

Post-quantum firewall refreshes drew the only growth upgrade

Why a firmware update will not close the gap

After two increases, the 2026 number dips

Where the $125.4 billion in new spending goes

The 10 fastest-growing categories through 2030

Securing AI becomes the largest line item in 2029

North America is 53% of 2030 spending, and China grows fastest

All 41 categories, ranked

A reading note on Gartner’s Table 1

What security leaders should do with this forecast

Frequently asked questions

How I built this analysis

Sources

Share this:

Like this:

Gartner’s AI security forecast exposes 162x services growth that still trails software 2 to 1 in new spending

What Is AI-Amplified Security?

This is a slice of the security budget, not an addition to it

Key findings

Why services is the story, and where that story stops

Growth rates decelerate while dollar increments keep climbing

The structural shift that defines this forecast

GenAI security adoption is broader than the in-use numbers suggest

Autonomous agents move from concept to production in network security

One number in the note worth checking before you quote it

What this forecast changes for CISOs and security vendors

Bottom line

Related on Software Strategies Blog

Source and methodology

Share this:

Like this:

Gartner’s $248.2B security forecast makes securing AI the only segment accelerating through 2030

Top 10 security categories where VC funding trails Gartner’s 2026 growth forecast, Crunchbase data

The master table: Gartner forecast vs. startup funding by category

The 3 widest gaps

Gap #1: CASB — 39:1, and the category is disappearing

Gap #2: CSPM — 21.5:1, the fastest-growing category is still starved

Gap #3: Vulnerability Assessment — 20.9:1, the most active seed-stage category

Where VC is ahead of Gartner

M&A is filling the gaps VC won’t

What this means for CISOs

Bottom line

Share this:

Like this:

Gartner’s 4Q25 Information Security forecast shows 15 categories capturing half of all new security spending through 2029

What makes these categories different

The 15 categories reshaping enterprise security

1. Cloud Security Posture Management (CSPM) — 29.36% CAGR — $4.68B → $12.76B

2. Cloud Access Security Brokers (CASB) — 24.81% CAGR — $2.30B → $5.58B

3. Zero Trust Network Access (ZTNA) — 21.95% CAGR — $2.48B → $5.43B

4. Threat Intelligence — 21.73% CAGR — $2.58B → $5.69B

5. Cloud Workload Protection Platforms (CWPP) — 21.53% CAGR — $5.98B → $13.11B

6. Consent and Preference Management — 20.22% CAGR — $0.81B → $1.64B

7. Subject Rights Request (SRR) Automation — 14.26% CAGR — $1.24B → $2.01B

8. Network Detection and Response (NDR) — 13.44% CAGR — $2.15B → $3.37B

9. Vulnerability Assessment — 13.02% CAGR — $3.48B → $5.60B

10. Tokenization — 12.68% CAGR — $1.34B → $2.11B

11. Endpoint Protection Platform (EPP) — 12.51% CAGR — $17.68B → $28.36B

12. Secure Web Gateway (SWG) — 11.63% CAGR — $4.44B → $6.74B

13. Web Application Firewalls (WAF) — 10.92% CAGR — $2.48B → $3.74B

14. Encryption — 10.64% CAGR — $1.35B → $1.98B

15. Security Information and Event Management (SIEM) — 10.30% CAGR — $7.60B → $11.15B

Why this matters

Bottom Line

Share this:

Like this:

15 fastest-growing security categories in Gartner’s 3Q25 Information Security Forecast

What these growth rates say about Gartner’s view of the market

The 15 categories reshaping security architecture

The Investment Thesis behind the numbers

The Bottom Line

Share this:

Like this:

Gartner Predicts Solid Growth for Information Security, Reaching $287 Billion by 2027

Share this:

Like this: