The Math Doesn't Add Up
Security budgets rose 5% in 2026. That's the headline number from IANS and Artico Search's annual benchmark survey of 500+ security executives. Compare that to 4% the year before, and you get about one point of extra breathing room across an entire industry. Not exactly a gold rush.
And yet.
Sixty-nine percent of CISOs told IANS researchers that AI is their top priority for net-new security dollars. That's not a marginal preference. That's a near-consensus vote for spending aggressively in a year when the money barely moved.
What the Benchmark Actually Measured
The 2026 Security Budget Benchmark Report, a joint survey from IANS Research and executive search firm Artico Search, polled more than 500 security executives, mostly CISOs and VPs of security at mid-market and enterprise organizations in North America and Europe. It tracks budget growth, where AI dollars sit on the P&L, which vendors get renewals, and what leaders expect from their teams over the next 12 months.
In a Dark Reading video interview, Nick Kakolowski, senior director for CISO research at IANS, walked through the tension at the center of the data: AI budgets, ROI, and the quiet restructuring of security teams — all happening without the mass hiring or mass layoffs either side predicted.
Where the AI Money Actually Goes
Net-new dollars tell a sharper story than totals. AI and machine learning topped the list of categories receiving new investment, ahead of data security, identity and access management, and cloud security. Legacy categories weren't cut — they simply weren't where marginal dollars went.
Within AI spending, three areas dominate the wishlist:
- Detection and response augmentation — using AI to triage alerts, prioritize threats, and cut analyst load.
- Data security for AI adoption — controls that let the business deploy AI without leaking sensitive data into models.
- Automation of repetitive workflows — report writing, ticket triage, phishing response, and compliance evidence gathering.
Notice what's absent: none of these is a standalone "AI product." They are capabilities layered onto tooling CISOs already own, which is precisely why the ROI conversation is so slippery.
The Line-Item Test: Who Owns the AI Budget
The most actionable finding in the report isn't about technology — it's about budget ownership. Where an organization chooses to park its AI budget predicts how aggressively it funds AI:
- About 70% of organizations that track AI as a dedicated budget line item or subcategory reported increased AI funding.
- Only 42% reported increases where AI is buried inside the general security budget.
- Just 31% reported increases where AI is funded from IT, data, or innovation budgets.
A line item is a claim of ownership. Organizations that formally budget for AI fund AI. Organizations that let another department hold the bag get what the other department decides to spare.
There's also momentum for the aggressive. Among organizations that increased AI security spending by more than 10% this year, 75% expect another increase of more than 10% in the next budget cycle. The spenders are doubling down, not testing the waters.
Kakolowski's advice to CISOs caught on the wrong side of that split is to flip the framing: "The organizations seeing the greatest momentum are using business interest in AI as a lever to get resourcing for security initiatives that enable AI use." In other words, don't ask for an AI security budget. Ask for the budget that lets the business do what it already wants to do with AI, safely.
The Vendor Pricing Squeeze
That leverage matters more because the supply side is pushing hard. Security teams, Kakolowski told Cybersecurity Dive, are being flooded with tools in response to rising concerns about AI-enabled attacks — and vendors are exploiting the anxiety. "Vendors are racing to monetize the AI hype by adding AI features and using them to justify significant price increases," he said.
That's the ROI trap in one sentence. When a rebranded feature ships with an "AI" prefix and a double-digit renewal hike, the CISO has to decide whether they're buying capability or paying a hype tax. The report's budget-line-item split suggests the disciplined buyers treat AI as a measurable category with owners and outcomes; the rest absorb whatever the renewal letter says.
The pressure on the demand side is real too: as coverage of CISOs under siege shows, AI complexity and rising threats are reshaping cybersecurity teams from the inside out, which is exactly the anxiety vendors are selling against.
Not a Hiring Spree, Not a Bloodbath
The most durable finding may be about people. Eighty-one percent of CISOs expect AI to create demand for new security roles and skills over the next 12 months, and 69% do not expect AI to reduce existing headcount. The feared deflation of security teams isn't showing up in the data.
What's happening instead is repurposing. "More AI and automation embedded in security workflows has not led to massive layoffs, but it has led to the repurposing of team members and a change in hiring and resourcing," said Steve Martano, IANS Faculty and partner at Artico Search. The work CISOs are routing to humans is exactly the work machines are bad at: "find anomalies, elevate relevant threats and make judgment calls that AI systems are not yet equipped to do with incomplete or ambiguous information."
AI is already reshaping two concrete workflows: hunting for critical flaws in software, and threat hunting for malicious activity already inside systems. Both augment analysts rather than replace them — and both cut both ways, since criminal and state-linked groups are using AI to speed up and widen their own operations, a machine-speed threat that enterprise security infrastructure has to outpace.
What Actually Drives Budgets (Hint: Not Breaches)
Forty-eight percent of CISOs whose budgets grew cited increased business or operational risk as the primary driver. Only 3% pointed to a major breach in their industry. Whatever conference keynotes say, security budgets are bought as business insurance, not as a reaction to someone else's incident.
That business framing also explains the cautiously optimistic forward book. Only 45% of CISOs saw budgets increase in 2026, but 64% expect an increase in 2027, and just 8% anticipate a cut. If your board's appetite for AI-enabled growth keeps rising, the security budget that enables that growth tends to follow — even as reporting underscores that CISOs are drowning in AI threats while hiring lags behind demand.
What to Steal From This
Three moves fall out of the report for any security leader:
- Get AI onto its own budget line. The 70/42/31 funding split is the cheapest experiment in this dataset, and it's one you run with a spreadsheet, not a procurement cycle.
- Audit renewals for the AI tax. Vendors are repricing on hype. Demand evidence of outcome change — triage time, flaw discovery rates, false-positive load — before paying an AI premium.
- Plan for repurposing, not reduction. 81% new-role expectations against 69% no-cut expectations means the job description, not the headcount, is what's changing. Budget for reskilling analysts into the judgment-and-exception work that automation can't absorb.
The math still doesn't add up — a 5% budget year with a 69% AI priority is a stretch by design. But the CISOs making it work have stopped treating AI as a product to purchase and started treating it as a forcing function: a reason to claim budget ownership, renegotiate tooling, and redefine what their teams actually do.
This article draws on the 2026 Security Budget Benchmark Report from IANS and Artico Search (survey of 500+ security executives, published September 15, 2026), coverage by Cybersecurity Dive, and the discussion of AI budgets, ROI, and team changes by Nick Kakolowski, senior director for CISO research at IANS, in a Dark Reading video interview.
