Despite reports of rising security budgets, many Chief Information Security Officers (CISOs) are still facing funding challenges. Research from the IANS and Artico Search indicates that average security budgets increased by 5% for 2026, a slight uptick from 4% last year. However, this growth is misleading, as the median budget growth remains stagnant at 0%. A concerning discrepancy emerges: though 64% of CISOs sought an increase, only 45% succeeded in getting additional funds, leaving over half without any budgetary growth.
The Funding Conundrum for CISOs
This information comes from a survey of over 500 security executives conducted between April and August 2026. The circumstances surrounding budget allocation reveal sharp contrasts based on organizational performance; those firms that exceeded revenue expectations by over 5% were much more likely to receive substantial budget increases—41% for these outperformers, compared to just 15% for those meeting expectations. Interestingly, organizations that did not perform well financially were more prone to budget cuts, with 22% of them reducing security spending. This situation raises questions about how budgetary decisions are made, often more reflective of a company’s overall financial health than the pressing security needs.
The disparity in budget increases based on company performance signals a troubling trend. When economic conditions are favorable, organizations prioritize security investments, which are often viewed as more valuable in the eyes of stakeholders. However, those in less favorable financial positions seem to neglect security needs rather than explore alternative funding sources. This disconnect reflects a broader issue within corporate governance where security isn't given the attention it deserves, despite heightened threats across the board. If you’re working in this space, it’s clear the narrative needs to shift toward more consistent funding regardless of immediate financial performance.
The Impact of Ownership Structure
Ownership structure also plays a significant role in budgeting outcomes. An impressive 71% of venture capital-backed companies managed to increase their security budgets, while only 52% of publicly listed companies could do the same. This difference may reflect the risk tolerance inherent in venture capital environments, where investors might prioritize long-term security investments as a hedge against potential data breaches that could harm reputation. Meanwhile, publicly traded firms often face immediate pressures from shareholders, leading to short-term thinking—security is sometimes sacrificed in favor of faster returns.
Government and nonprofit entities lagged notably, as they typically experienced the least significant budget increases. This trend is particularly concerning in the public sector, where security vulnerabilities can affect citizens’ personal information and critical infrastructure. The reduced focus on security budgets in these sectors indicates a chaotic prioritization process that doesn't align with risk levels or potential impact.
AI Spending Surges Within Security Budgets
As security budgets evolve, there is a notable shift toward artificial intelligence (AI). A staggering 69% of CISOs identified AI as their primary new funding priority. According to Steve Martano from IANS, "Security is gaining tailwinds from other investments in AI and broader technology, meaning some security capabilities are particularly funded out of someone else’s budget."
However, this funding isn’t as straightforward as it appears. Just 24% of organizations earmark AI spending as a separate budget line, while 38% have incorporated it within their overall security budget. Another 38% allocate AI funding through IT, data, or innovation budgets. This fragmented approach leads to significant underreported AI expenditures; those tracking AI spending separately saw growth reported about 70% of the time, compared to just 42% for those who bundled AI costs into general security budgets. Breaking this down, it’s clear that many organizations are operating in silos, failing to connect the dots between AI investments and their security posture.
Interestingly, the increasing financial commitment toward AI does not equate to reduced personnel costs. A remarkable 81% of CISOs foresee AI driving demand for new skills, with 69% believing existing staff levels won’t decrease. Martano points out that integrating AI into security measures often necessitates repurposed roles, emphasizing the need for team members capable of managing complex threats that AI alone cannot address. The paradox here is intriguing: while companies allocate more funds to automation, they must also invest heavily in workforce training and development to adapt to the changes that AI introduces.
Understanding AI Risks
The report also distinguishes between organizations committed to substantial AI security investments and those that are not. CISOs from companies planning a greater than 10% increase in AI security funding demonstrate a significantly higher level of understanding regarding AI risks, with 79% acknowledging this knowledge. Conversely, only 33% of organizations without planned AI spending reported a fair understanding of the associated risks. Furthermore, 70% of proactive spenders have established clear AI governance, compared to 34% among those with no specific AI funding plans. This indicates a direct correlation between investment in AI security and a deeper awareness of potential threats.
As organizations allocate more resources to AI security, they often do so within the context of larger security budgets. Among aggressive AI investors, 45% reported increasing their overall security budget by more than 5%, and 51% expect similar increments in the coming year. In stark contrast, only 12% of those not focused on AI management reported an increase, with a mere 9% predicting a rise in the next budget cycle. This asymmetry highlights that organizations dedicated to AI aren't just buying technology; they’re redefining their security strategies.
Looking Ahead: The Future of Security Budgets
For CISOs navigating these turbulent budgetary waters, the report advises a proactive approach: explicitly assign AI its own budget line and monitor costs closely in anticipation of the next fiscal planning cycle. Organizations must see past short-term financial gains to understand the long-term investment security truly represents. The shift toward AI and other advanced technologies reflects a growing recognition that traditional security frameworks may not hold up against emerging threats. Recognizing this reality could be this sector’s most pivotal wake-up call.
What this means for you, if you’re involved in security management, is that the budgetary landscape isn’t simply about more money for tools. It’s about strategic allocation, cross-departmental collaboration, and a fundamental shift in how security is perceived within organizations. As threats evolve, so too must the budgets that oversee them. The delicate balance between funding priorities and actual security needs will continue to be scrutinized, potentially reshaping how organizations safeguard their digital frontiers.
