Cybersecurity Market Statistics (2026)

Cybersecurity is now one of the largest line items in enterprise technology. Gartner puts worldwide end-user spending on information security at about $213 billion in 2025, up from $193 billion in 2024, roughly a 10% jump in a single year (see the chart below).

That is the software, services, and network-security tooling organizations buy to defend themselves. Broader research firms that also count internal staff, hardware, and consumer products cite even larger figures, from roughly $200 billion to $270 billion for 2025, depending on scope.

Spending splits into three big buckets. Security software is the largest and fastest-growing at about $106 billion in 2025, followed by security services at roughly $84 billion and network security at about $23 billion (see the table below).

Software leads because companies keep moving from on-premises systems to the cloud, which opens new attack surfaces. Gartner flags cloud security posture management and cloud access security brokers as the main drivers, with cloud security growing nearly 29% into 2026.

Growth is accelerating, not slowing. Gartner forecasts information security spending will rise about 12.5% in 2026 to roughly $240 billion, and a later 2026 update lifted the estimate toward $244 billion, up 13.3% (Gartner via Software Strategies).

AI is the swing factor on both sides. Gartner estimates the AI-amplified security market at roughly $49 billion in 2025, while spending to secure AI systems themselves is just $2.8 billion, meaning organizations spend about 17 times more on AI tools than on protecting them.

For the first time in years, the global average breach cost fell, dropping 9% to $4.44 million in 2025 as faster AI-assisted detection trimmed the damage (see the tables below). IBM's report draws on 600 organizations across 16 countries and 17 industries.

The cost depends heavily on what is stolen: intellectual property runs about $178 per record, employee personal data $168, and customer data $160. That is why breaches that expose sensitive records, rather than just anonymized data, drive the headline totals.

The global decline hides a sharp US divergence. The US average breach cost rose 9% to a record $10.22 million in 2025, more than double the global figure, driven by higher regulatory fines plus steep detection and escalation costs (IBM).

It is a reminder that averages travel badly across borders. Stricter US disclosure rules, larger settlements, and heavier litigation exposure all inflate the final bill, so a US organization budgeting off the global $4.44 million number would badly underestimate its risk.

Some industries bleed far more than others. Healthcare topped the list for the 14th consecutive year at $7.42 million per breach, ahead of the financial sector at about $5.56 million, with industrial, energy, and technology rounding out the priciest five (see the chart below).

Healthcare stays expensive because patient records are highly regulated, hard to re-secure, and valuable to attackers, and because downtime in a hospital carries direct safety costs. Financial firms face similar regulatory weight plus the direct value of the accounts involved.

Attackers overwhelmingly get in through people and credentials. Phishing was the single most common root cause at 16% of breaches, followed by supply-chain compromise at nearly 15% and denial-of-service at about 13%. Roughly 51% of breaches trace to malicious attacks, 26% to human error, and 23% to IT failure.

The most expensive entry points are not always the most common. Malicious-insider breaches cost the most at $4.92 million, just ahead of supply-chain compromises at $4.91 million and phishing at $4.80 million (see the chart and table below), so both frequency and per-incident cost matter when prioritizing defenses.

Speed is money in a breach. The mean time to identify and contain an incident fell to 241 days in 2025, a nine-year low, helped by security AI and automation that IBM credits with cutting the breach lifecycle by up to 80 days.

That gap between fast and slow responders is expensive: breaches contained in under 200 days averaged $3.87 million, versus $5.01 million when they dragged past 200 days, a roughly 24% premium for slow detection. Internal security teams found breaches fastest, at about 172 days.

Ransomware remains the defining threat. Verizon's 2025 DBIR found it present in 44% of breaches, up 37% year over year, and involved in a striking 88% of breaches at small and mid-sized businesses (Verizon).

Victims are pushing back, though. The median ransom payment fell to about $115,000, 64% of victims refused to pay at all (up from 59% the prior year in IBM's data), and IBM's ransomware recovery cost excluding any ransom dropped 44% to $1.53 million as organizations got better at restoring from backups.

AI is now central to the breach story. Organizations that deployed security AI and automation extensively saved about $1.9 million per breach, but the flip side is emerging fast: IBM found 13% of organizations reported breaches of AI models or applications, and nearly two-thirds had no AI governance policy at all.

Unsanctioned tools add cost. Breaches involving so-called shadow AI carried a $670,000 penalty over the average, and Verizon reported that AI-generated phishing emails have roughly doubled, so the same technology cutting defenders' costs is also lowering the bar for attackers.

Reported losses are hitting records. The FBI's IC3 logged $16.6 billion in cybercrime losses across 859,532 complaints in 2024, a 33% jump from the prior year, with investment fraud (mostly crypto) accounting for more than $6.5 billion and business email compromise for $2.7 billion (see the table below).

Zoom out and the estimates get staggering. Cybersecurity Ventures, a research firm, projects total global cybercrime costs of about $10.5 trillion a year in 2025, rising toward $12.2 trillion by 2031. That figure is a widely cited projection, not a measured total, and should be read as an order-of-magnitude estimate rather than a hard number.

Breach counts have plateaued even as exposure explodes. The ITRC tracked 3,158 US data compromises in 2024, down about 1% from 2023's record, yet victim notices surged 312% to more than 1.7 billion, driven by six mega-breaches that each exposed at least 100 million people (ITRC).

Defenders remain badly outnumbered. ISC2's 2025 Workforce Study, based on a record 16,029 professionals, found 95% reporting at least one skills gap and 59% calling those gaps critical or significant, up from 44% a year earlier, against a talent shortage the group has previously pegged near 4.8 million unfilled roles worldwide.

No one dominates. Palo Alto Networks leads with an estimated 9% market share, ahead of Fortinet at 7% and Microsoft at 6%, and industry analysts note that no vendor has yet reached a double-digit share (see the table below). Palo Alto reported about $8.2 billion in FY2025 revenue and Fortinet $5.96 billion in 2024.

The fast growth is in platform consolidation and recurring revenue. CrowdStrike's annual recurring revenue reached roughly $4.4 billion, while Zscaler, CyberArk, and SentinelOne each run subscription revenue in the low billions, and Microsoft's security business alone has been reported above $20 billion, blurring the line between pure-plays and incumbents.

Cybersecurity is a structural-growth theme: spending compounds at low double digits, breach costs keep rising in the US, and AI is expanding the attack surface as fast as it improves defense. That secular demand is why the sector has drawn steady investor interest through market cycles.

The catch is that the market is fragmented and richly valued, with dozens of specialists across endpoint, network, identity, and cloud security. Rather than pick a single winner, many investors gain exposure through a diversified basket of cybersecurity leaders or a sector ETF. Walnut is a tracking and research tool, not an investment adviser, and none of this is a recommendation to buy any specific security.