Cybersecurity Market Statistics (2026)

Cybersecurity is now one of the largest line items in enterprise technology. Gartner puts worldwide end-user spending on information security at about $213 billion in 2025, up from $193 billion in 2024, roughly a 10% jump in a single year (see the chart below).

That is the software, services, and network-security tooling organizations buy to defend themselves. Broader research firms that also count internal staff, hardware, and consumer products cite even larger figures, from roughly $200 billion to $270 billion for 2025, depending on scope.

Spending splits into three big buckets. Security software is the largest and fastest-growing at about $106 billion in 2025, followed by security services at roughly $84 billion and network security at about $23 billion (see the table below).

Software leads because companies keep moving from on-premises systems to the cloud, which opens new attack surfaces. Gartner flags cloud security posture management and cloud access security brokers as the main drivers, with cloud security growing nearly 29% into 2026.

Growth is accelerating, not slowing. Gartner forecasts information security spending will rise about 12.5% in 2026 to roughly $240 billion, and a later 2026 update lifted the estimate toward $244 billion, up 13.3% (Gartner via Software Strategies).

AI is the swing factor on both sides. Gartner estimates the AI-amplified security market at roughly $49 billion in 2025, while spending to secure AI systems themselves is just $2.8 billion, meaning organizations spend about 17 times more on AI tools than on protecting them.

The 2025 dip did not last. IBM's 2026 report puts the global average breach cost at a record $4.99 million, up 12% after a 9% fall to $4.44 million the year before, driven by higher detection, escalation and lost-business costs (see the tables below). The 2026 study draws on 602 organizations breached between March 2025 and February 2026.

The cost depends heavily on what is stolen: intellectual property runs about $178 per record, employee personal data $168, and customer data $160. That is why breaches that expose sensitive records, rather than just anonymized data, drive the headline totals.

The global average hides a sharp US divergence. In IBM's 2025 report, the US average breach cost rose 9% to a record $10.22 million, more than double the global figure, driven by higher regulatory fines plus steep detection and escalation costs (IBM). IBM's public 2026 summary does not restate the US figure.

It is a reminder that averages travel badly across borders. Stricter US disclosure rules, larger settlements, and heavier litigation exposure all inflate the final bill, so a US organization budgeting off the global $4.99 million number would badly underestimate its risk.

Some industries bleed far more than others. In IBM's 2025 report, healthcare topped the list for the 14th consecutive year at $7.42 million per breach, ahead of the financial sector at about $5.56 million. The 2026 report puts financial services breaches at $6.3 million and energy at $5.2 million, and says 62% of AI-driven attacks targeted critical-infrastructure sectors (see the chart below).

Healthcare stays expensive because patient records are highly regulated, hard to re-secure, and valuable to attackers, and because downtime in a hospital carries direct safety costs. Financial firms face similar regulatory weight plus the direct value of the accounts involved.

Attackers get in through people, credentials and unpatched software. In IBM's 2025 report, phishing was the single most common root cause at 16% of breaches, followed by supply-chain compromise at nearly 15% and denial-of-service at about 13%; roughly 51% of breaches traced to malicious attacks, 26% to human error, and 23% to IT failure. Verizon's 2026 DBIR finds exploitation of vulnerabilities is now the top initial access vector at 31% of breaches, with credential abuse down to 13%.

The most expensive entry points are not always the most common. Malicious-insider breaches cost the most at $4.92 million, just ahead of supply-chain compromises at $4.91 million and phishing at $4.80 million (see the chart and table below), so both frequency and per-incident cost matter when prioritizing defenses.

Speed is money in a breach. In IBM's 2025 report, the mean time to identify and contain an incident fell to 241 days, a nine-year low, helped by security AI and automation that IBM credits with cutting the breach lifecycle by up to 80 days. Patching is slipping, though: Verizon's 2026 DBIR found only 26% of critical known-exploited vulnerabilities were fully remediated in 2025, down from 38%, with the median fix time up to 43 days from 32.

That gap between fast and slow responders is expensive: breaches contained in under 200 days averaged $3.87 million, versus $5.01 million when they dragged past 200 days, a roughly 24% premium for slow detection. Internal security teams found breaches fastest, at about 172 days.

Ransomware remains the defining threat. Verizon's 2026 DBIR, covering more than 22,000 confirmed breaches, found it present in 48% of breaches, up from 44% a year earlier; the 2025 edition had found it in 88% of breaches at small and mid-sized businesses (Verizon). Breaches with third-party involvement rose 60% to 48% of the total.

Victims are pushing back, though. In the 2026 DBIR, 69% of ransomware victims did not pay and the median payment slipped to $139,875 from $150,000. IBM's 2026 report saw reported ransomware incidents rise (39% vs 34%), with attackers leaning on brand reputation as leverage, while its 2025 report found ransomware recovery cost excluding any ransom dropped 44% to $1.53 million as organizations got better at restoring from backups.

AI is now central to the breach story. In IBM's 2026 report, organizations that used security AI and automation extensively saved $1.93 million per breach, but one in four malicious breaches was AI-enabled, a 56% increase, costing $6 million on average. More than 20% of organizations reported a breach targeting AI models or applications, up from 13% in the 2025 report.

Unsanctioned tools add cost. In the 2025 report, breaches involving so-called shadow AI carried a $670,000 penalty over the average. Verizon's 2026 DBIR found the median threat actor researched or used AI assistance in 15 documented attack techniques, so the same technology cutting defenders' costs is also lowering the bar for attackers.

Reported losses are hitting records. The FBI's IC3 logged $20.9 billion in cybercrime losses across 1,008,597 complaints in 2025, up 26% from $16.6 billion in 2024, with investment fraud accounting for $8.6 billion (crypto investment fraud alone $7.2 billion) and business email compromise for $3.0 billion (see the table below, and the FBI IC3 report).

Zoom out and the estimates get staggering. Cybersecurity Ventures, a research firm, projects total global cybercrime costs of about $10.5 trillion a year in 2025, rising toward $12.2 trillion by 2031. That figure is a widely cited projection, not a measured total, and should be read as an order-of-magnitude estimate rather than a hard number.

Breach counts have plateaued even as exposure explodes. The ITRC tracked 3,158 US data compromises in 2024, down about 1% from 2023's record, yet victim notices surged 312% to more than 1.7 billion, driven by six mega-breaches that each exposed at least 100 million people (ITRC).

Defenders remain badly outnumbered. ISC2's 2025 Workforce Study, based on a record 16,029 professionals, found 95% reporting at least one skills gap and 59% calling those gaps critical or significant, up from 44% a year earlier, against a talent shortage the group has previously pegged near 4.8 million unfilled roles worldwide.

No one dominates. Palo Alto Networks leads with an estimated 9% market share, ahead of Fortinet at 7% and Microsoft at 6%, and industry analysts note that no vendor has yet reached a double-digit share (see the table below). Palo Alto's trailing-twelve-month revenue reached about $11.5 billion through July 2026 and Fortinet's about $7.5 billion.

The fast growth is in platform consolidation and recurring revenue. CrowdStrike's annual recurring revenue reached roughly $5.8 billion in the quarter ended July 2026, while Zscaler, CyberArk, and SentinelOne each run subscription revenue in the low billions, and Microsoft's security business alone has been reported above $20 billion, blurring the line between pure-plays and incumbents.

Cybersecurity is a structural-growth theme: spending compounds at low double digits, breach costs keep rising in the US, and AI is expanding the attack surface as fast as it improves defense. That secular demand is why the sector has drawn steady investor interest through market cycles.

The catch is that the market is fragmented and richly valued, with dozens of specialists across endpoint, network, identity, and cloud security. Rather than pick a single winner, many investors gain exposure through a diversified basket of cybersecurity leaders or a sector ETF. Walnut is a tracking and research tool, not an investment adviser, and none of this is a recommendation to buy any specific security.