Is the Cybersecurity Market growing now?
In our cybersecurity market deck, you will find everything you need to understand the market
SUMMARY
Yes, the cybersecurity market is growing now. Global spending is rising at roughly 12% a year, while several large vendors are growing above 20% by taking share in the fastest-moving parts of the market.
The most useful distinction is between market growth and security-team budget growth. Gartner and IDC see double-digit expansion in overall security spending, while recent enterprise surveys put the typical cybersecurity budget increase closer to 4% or 5%.
That gap is not a contradiction. More security spending is moving through cloud platforms, managed services, AI-specific tools and vendors that are replacing several smaller products at once.
The strongest vendors are growing much faster than the market. CrowdStrike and Fortinet recently grew revenue 26%, Zscaler 25% and SentinelOne 21%, which points to real share shifts rather than a uniform boom across every cybersecurity company.
AI is already creating a new spending layer. Gartner estimates AI cybersecurity spending at about $51.3 billion in 2026, roughly double 2025, while enterprise surveys show companies still increasing budgets for AI-specific protection and monitoring.
The fastest-growing categories line up with the way corporate IT is changing: cloud security, identity, data protection, AI security and managed security services. These are the areas closest to new workloads, new machine identities and new data exposure.
Platform consolidation is becoming one of the defining forces in the market. A CISO with only a small budget increase can still spend much more with one strategic vendor after dropping several overlapping tools.
Managed security is benefiting from a skills problem more than a simple headcount problem. Companies increasingly need expertise in AI and cloud security, and ISG found that surveyed enterprises were already spending nearly 34% of their cybersecurity budgets with managed service providers.
The threat environment still supports spending, but it is not the only reason the market grows. Ransomware, third-party exposure and vulnerability exploitation remain serious, while regulation creates a minimum level of security work that many companies cannot simply defer.
Startup funding and M&A are healthy but selective. Capital is concentrating around companies that can own a category in AI, data, cloud or identity, while point solutions with weak differentiation face a much tougher market.
The market is therefore growing in a fairly specific way: the total pool of cybersecurity spending is expanding, but the gains are becoming more concentrated. The winners are increasingly the platforms and specialist categories tied to cloud, identity, data, AI and managed services.
This market map, featured in our cybersecurity market deck, highlights top companies and startups in the cybersecurity market
What does it actually mean for the cybersecurity market to be growing?
The cybersecurity market is genuinely growing when companies spend more money protecting themselves and cybersecurity vendors turn that spending into more revenue.
That sounds obvious, but several very different numbers get mixed together when people talk about the size of cybersecurity. Gartner measures end-user information-security spending. IDC uses a broader security market. A CISO survey measures the budget controlled by security teams. Vendor results tell us how much money particular companies are actually capturing.
Those measures currently move at different speeds. Gartner expects worldwide information-security spending to reach about $244 billion in 2026, up 11.6% in constant currency. IDC uses a wider definition and puts global security spending at roughly $308 billion, up 11.8%. At the company level, several major cybersecurity vendors are growing above 20%. Meanwhile, IANS found average security-budget growth of only 4% in its latest broad CISO benchmark, and a newer ISG enterprise survey puts the increase from 2025 to 2026 at about 5%.
That gap is central to understanding the market. Cybersecurity spending can rise around 12% even when the typical CISO gets only a 4% or 5% budget increase because the market also includes smaller companies adopting more security, managed services, new AI products, cloud spending and vendors taking share from competitors.
So when we ask whether cybersecurity is growing today, we need evidence of more money entering the market and evidence that companies are successfully capturing it. We have both.
If you want more recent data on this point, please see our latest cybersecurity market report.
How fast is the cybersecurity market growing right now?
The cybersecurity market is growing at roughly 12% a year right now, which is fast for an industry already worth hundreds of billions of dollars.
Gartner's latest worldwide forecast puts information-security spending at about $244 billion in 2026, up 11.6% in constant currency. IDC's broader Worldwide Security Spending Guide estimates $308 billion, up 11.8%.
The IDC figure implies roughly $32 billion of extra security spending in a single year. That gives a better sense of scale than the percentage alone: customers are adding an amount of annual spending larger than the total revenue of several leading cybersecurity vendors combined.
Software is taking an increasing share. IDC expects security software spending to grow about 14%, faster than the overall market, and it already accounts for more than half of total security spending.
Cybersecurity also looks strong when we widen the comparison. Gartner's latest forecast has total worldwide IT spending growing 14.2% in 2026, helped enormously by AI infrastructure and data-center investment. Cybersecurity is growing slightly slower than that exceptional IT cycle, but a roughly 12% expansion at its current size is still strong growth.
| Measure | 2026 estimate | Growth | What we learn |
|---|---|---|---|
| Gartner information-security spending | ~$244B | +11.6% | Core end-user security spending is growing at a double-digit rate |
| IDC global security spending | ~$308B | +11.8% | The broader cybersecurity market is adding roughly $32B in one year |
| IDC security software | More than half of spending | ~+14% | Software is gaining faster than the overall market |
| Gartner total IT spending | ~$6.37T | +14.2% | Cyber is strong, although AI infrastructure is pushing overall IT growth even higher |
As this chart shows, and as featured in our cybersecurity market deck, search interest in cybersecurity has been trending upward
Are companies actually increasing cybersecurity budgets?
Yes, companies are increasing cybersecurity budgets today, although most security teams are getting fairly modest increases rather than huge new spending envelopes.
PwC's 2026 Global Digital Trust Insights survey covered 3,887 business and technology executives across 72 countries. It found that 78% expected their cybersecurity budgets to rise over the following year. Only 6% expected some form of decrease. Among those increasing spending, a large share expected growth in the single digits.
The latest enterprise data makes the picture even clearer. An ISG survey conducted in April and May 2026 found that cybersecurity budgets had risen about 5% on average from 2025 to 2026. IANS' wider benchmark found average security-budget growth of 4% in 2025, down from 8% the year before and the lowest rate in five years.
Cybersecurity remains a budget that companies are reluctant to cut, while CISOs are being pushed to make harder choices inside that budget.
That helps explain why a market growing around 12% can coexist with security teams receiving 4% or 5% more money. Some spending sits outside traditional CISO budgets, managed security providers are absorbing more work, new companies are buying security for the first time, and successful vendors are taking budget away from weaker products.
The spending growth is real. The easy-money phase has clearly ended.
Are cybersecurity companies actually growing their revenue?
Yes, major cybersecurity companies are currently turning security demand into double-digit revenue growth, with several large vendors growing more than twice as fast as the overall market.
CrowdStrike's latest reported quarter produced $1.39 billion of revenue, up 26% year over year. Annual recurring revenue reached $5.51 billion, up 24%, while net new ARR increased 32%.
Fortinet has become an especially strong recent example. Its second-quarter 2026 revenue rose 26% to $2.05 billion, product revenue jumped 52%, and billings grew 33% to $2.37 billion. The company raised its full-year revenue outlook to roughly 19% growth.
Zscaler's latest reported quarter showed revenue of $850.5 million, up 25%, with ARR also up 25% to $3.53 billion. Acquisition effects explain some of that ARR increase, but organic ARR still grew about 21%.
SentinelOne grew revenue 21% to $277 million and ARR 23% to $1.16 billion. Okta is moving more slowly, with quarterly revenue up 11% to $765 million, although remaining performance obligations grew 16%.
These are businesses already operating at substantial scale. CrowdStrike, Fortinet and Zscaler adding 20% to 30% revenue growth on multibillion-dollar bases tells us that customers are signing real contracts, expanding deployments and moving money between vendors.
| Company | Latest reported quarterly revenue | YoY growth | Another useful measure |
|---|---|---|---|
| Fortinet | $2.05B | +26% | Billings +33% |
| CrowdStrike | $1.39B | +26% | Net new ARR +32% |
| Zscaler | $850.5M | +25% | ARR +25%, ~21% organically |
| Okta | $765M | +11% | RPO +16% |
| SentinelOne | $277M | +21% | ARR +23% |
This chart, included in our cybersecurity market deck, illustrates yearly VC funding for cybersecurity startups
Is cybersecurity growth actually speeding up?
Parts of cybersecurity are speeding up now, but the whole market is growing at a steadier low-double-digit rate.
Fortinet gives us one of the clearest acceleration examples. Revenue growth went from 20% in the first quarter of 2026 to 26% in the second quarter. Billings rose 31% and then 33%. Product revenue growth accelerated from 41% to 52%, strong enough for management to lift its full-year revenue forecast.
SentinelOne explicitly reported accelerating revenue and ARR growth in its latest quarter, reaching 21% and 23% respectively. CrowdStrike added a record $256 million of net new ARR in its latest reported quarter, 32% more than a year earlier, and subsequently raised its full-year net-new-ARR growth guidance.
The broader market looks calmer. Gartner still sees roughly 11.6% information-security growth, while the newest enterprise budget surveys cluster around 4% to 5%.
The acceleration is mostly happening at the vendor level. Customers are shifting money quickly toward particular products and platforms even though their total security budgets are growing much more slowly.
A cybersecurity company can therefore accelerate by taking share inside an already growing market. Several leaders appear to be doing exactly that.
If you want more recent data on this point, please see our latest cybersecurity market report.
Is AI really creating new cybersecurity spending?
Yes, AI is already creating a large new layer of cybersecurity spending, and the freshest enterprise data suggests the money is arriving quickly.
Gartner now estimates AI cybersecurity spending at about $51.3 billion in 2026, compared with $25.9 billion in 2025. Its forecast reaches almost $86 billion in 2027. The definition is broad, but the jump is too large to explain away as ordinary annual security growth.
The buyer data points the same way. PwC found that AI was the number-one cybersecurity investment priority for 36% of organizations in its global survey, ahead of cloud security at 34%. More recently, ISG found that 74% of surveyed enterprises had increased investment in AI-specific security tools and 69% had increased budgets for monitoring and detecting AI-related threats.
ISG also found that AI-related cybersecurity already consumes more than 11% of total security spending among the enterprises it studied. Even with that level of spending, 58% said their AI-security budgets were insufficient.
Vendors are moving behind the customer demand. Fortinet recently acquired Virtue AI to add continuous testing and runtime protection for AI systems. Zscaler has introduced products aimed at controlling AI-agent communication. CrowdStrike is building AI detection and response into Falcon. Google has combined Wiz, Mandiant, its threat intelligence and Gemini into a broader AI Threat Defense offering.
AI creates several security problems at the same time: companies need to protect models, control which data AI systems can access, manage autonomous agents, secure new machine identities and defend against attackers using the same technology.
Some of this money will come out of older cybersecurity categories, so the entire $51 billion should not be treated as purely incremental market growth. Even after allowing for that substitution, AI is clearly creating a meaningful new security market.
This chart, included in our cybersecurity market deck, breaks down CrowdStrike’s playbook in cybersecurity
Which cybersecurity markets are growing fastest today?
The fastest cybersecurity growth today is clustering around AI security, cloud security, identity, data security and managed security services.
IDC expects security software to grow around 14%, ahead of the broader security market, and highlights cloud-native application protection, identity and access management, and information and data security among the faster-growing areas.
PwC's buyer survey reaches a similar conclusion from another angle. AI was the top investment priority at 36%, followed by cloud security at 34%, network security at 28% and data protection at 26%.
The strategic transactions are even more revealing. Google completed its $32 billion acquisition of Wiz, giving Google Cloud a much larger position in cloud and AI security. Palo Alto Networks completed its roughly $25 billion CyberArk acquisition and made identity security a core part of its platform. Cyera, focused on enterprise data security, raised $600 million at a $12 billion valuation.
These areas connect directly to how corporate IT is changing. More workloads live in several clouds. Sensitive data is scattered across SaaS applications and data platforms. Companies now have huge numbers of machine identities alongside employee accounts. AI agents introduce another class of software that can access information and act on behalf of users.
The strongest growth is following those changes. Protecting old corporate network boundaries is still a large business, but much of the new money is following cloud workloads, identities, data and AI.
Are big cybersecurity platforms taking business from smaller security tools?
Yes, cybersecurity spending is increasingly moving toward larger platforms, making today's growing market much tougher for standalone security tools.
IANS' software and services research has already found security teams consolidating vendors, while PwC reports that 47% of organizations are using tool consolidation as one way to deal with cybersecurity capability gaps.
The largest vendors are deliberately building around that behavior. CrowdStrike has expanded Falcon far beyond endpoint protection into identity, cloud, data and security operations. Palo Alto Networks now spans network security, cloud, security operations and identity. Fortinet combines network security, SASE and security operations. Google can now connect Wiz with Mandiant, threat intelligence and its own cloud infrastructure.
The acquisition prices show how seriously large technology companies take this platform race. Google's Wiz deal was worth $32 billion. Palo Alto Networks agreed to value CyberArk at roughly $25 billion when the transaction was announced. Those companies bring complete categories into larger platforms instead of adding another small feature.
This is rough for weaker startups. A CISO with a 5% budget increase may still spend substantially more with one strategic vendor after removing three smaller tools.
Cybersecurity market growth therefore does not spread evenly across cybersecurity companies. Increasingly, the vendors that help customers consolidate are capturing a larger share of the increase.
If you want more recent data on this point, please see our latest cybersecurity market report.
This chart, included in our cybersecurity market deck, illustrates yearly funding for cybersecurity startups
Are managed cybersecurity services growing because companies cannot hire enough people?
Yes, managed cybersecurity services are growing partly because companies still lack the specialized security skills they need internally.
ISC2's latest Cybersecurity Workforce Study surveyed more than 16,000 professionals worldwide. Some 59% reported critical or significant cybersecurity skills needs, up from 44% a year earlier, while only 5% said their teams had no current skills gaps.
The problem has shifted beyond simple headcount. In a follow-up study published in 2026, ISC2 found that 34% of respondents believed their organization already had the right number of cybersecurity employees and another 44% reported only a slight staffing shortage. The harder problem is finding the right expertise.
AI is now the most commonly cited missing cybersecurity skill at 41%, followed by cloud security at 36%. Those happen to be two of the areas where security architectures are changing fastest.
Companies are responding by buying outside help. ISC2 found that 20% were outsourcing work, 19% were using third-party providers and 17% were using temporary contractors to close skills gaps. The more recent ISG enterprise survey goes further: the average surveyed organization was already spending nearly 34% of its cybersecurity budget with managed security service providers.
That is a big share. It shows why managed security can keep growing even if internal cybersecurity hiring becomes more cautious.
Are cyberattacks still getting worse enough to keep cybersecurity spending growing?
Yes, the current cyber threat data still gives companies plenty of reasons to keep spending, especially around ransomware, vulnerabilities and third-party exposure.
Verizon's 2026 Data Breach Investigations Report analyzed more than 31,000 incidents and over 22,000 confirmed breaches across 145 countries. Ransomware appeared in 48% of breaches, up from 44% in the previous dataset. Third-party involvement also reached 48% after increasing 60% year over year.
Mandiant sees a changing attack mix as well. Exploitation of vulnerabilities remained the most common initial intrusion method for the sixth consecutive year, accounting for 32% of investigations. Voice phishing jumped to 11% and became the second-most-common initial vector. Median attacker dwell time increased from 11 days to 14 days.
IBM's 2026 X-Force Threat Index adds another pattern. IBM observed 49% more active ransomware groups during 2025 and found that large supply-chain or third-party compromises had increased almost fourfold since 2020.
There is some encouraging evidence inside those reports. Verizon found that 69% of ransomware victims in its dataset refused to pay, and the median ransom payment fell. Mandiant also found that organizations detected malicious activity internally in 52% of investigations, up from 43%.
Defenders are improving in some areas while the attack surface keeps expanding. Cloud services, third-party software, machine identities, connected systems and AI give attackers more places to look for weak points.
That combination keeps cybersecurity spending difficult to postpone for long.
This chart, included in our cybersecurity market deck, compares the main business model options for XDR and MDR cybersecurity vendors
Is regulation forcing companies to spend more on cybersecurity?
Yes, cybersecurity regulation is creating a higher minimum level of spending, particularly for European companies and heavily regulated industries.
Europe is a useful example because several regimes now overlap. NIS2 expands cybersecurity risk-management and reporting obligations across 18 critical sectors. DORA imposes operational-resilience requirements on financial institutions and their technology providers. The Cyber Resilience Act extends security obligations to products containing digital elements and introduces mandatory vulnerability and incident reporting before its wider requirements fully apply.
The practical effect is straightforward. A hospital, bank, industrial supplier or software company may want to delay a security project when budgets get tight, but regulatory obligations reduce how far that delay can go.
The United States also requires public companies to disclose material cybersecurity incidents and describe their cybersecurity risk-management processes in annual filings. Sector-specific requirements add another layer for industries such as finance, healthcare and defense.
Regulation probably explains less of the market's growth than cloud adoption, AI and the threat environment. Its role is still important because it creates a floor underneath certain security activities.
For a cyclical technology market, that spending floor is valuable.
Is cybersecurity startup funding growing too?
Cybersecurity startups are still attracting large amounts of venture capital, although the funding market looks selective rather than euphoric.
Funding trackers show billions of dollars continuing to flow into cyber companies, especially those tied to AI, data, identity and cloud security. The pattern is increasingly concentrated in larger rounds for companies that investors think can own a category.
That concentration is easy to see in individual financings. Cyera raised $600 million at a $12 billion valuation for its data-security platform. Dream raised $260 million at a $3 billion valuation around AI-driven cyber defense. Several other cyber companies have raised rounds above $100 million while investors have become much less forgiving of undifferentiated security tools.
Momentum Cyber's first-quarter 2026 data counted 211 cybersecurity financings worth $3.8 billion. Thirty-seven of those financings involved AI-security companies, and 21 rounds raised at least $50 million.
The direction is positive, but funding gives us a different message from customer spending. Investors are still eager to fund a company that could become the next major security platform. They are much less interested in funding another small point solution with no obvious path to category leadership.
Cybersecurity venture capital currently looks healthy and concentrated.
If you want more recent data on this point, please see our latest cybersecurity market report.
This chart, featured in our cybersecurity market deck, illustrates revenue distribution by customer segment in the cybersecurity market
Is cybersecurity M&A really running at record levels?
Yes, cybersecurity M&A is currently running at a record deal-count pace, with AI security driving a particularly sharp increase in acquisitions.
Momentum Cyber counted 219 cybersecurity acquisitions during the first half of 2026. That pace would produce roughly 438 deals over a full year, above the approximately 400 transactions it recorded in 2025.
AI security is moving much faster. The Wall Street Journal, using Momentum Cyber's data, reported 29 AI-security acquisitions in the first half alone. The entire previous year produced only 10. Buyers are moving quickly because acquiring a small team with working AI-security technology can be faster than building the capability internally.
Deal value tells a more complicated story because blockbuster acquisitions can distort one year against another. The number of transactions gives us the cleaner read: companies are buying cybersecurity assets more frequently than before.
The buyers are also getting broader. Traditional cybersecurity vendors remain active, but Google, Accenture and other large technology and services companies are spending billions to build security capabilities. More recently, Cyera agreed to acquire non-human identity startup Oasis Security for about $1 billion, bringing data security and AI-agent identity closer together.
The same categories keep appearing across customer budgets, venture funding and acquisitions: AI, cloud, identity and data.
| M&A measure | Current evidence | Why it stands out |
|---|---|---|
| Cybersecurity acquisitions in H1 2026 | 219 | Record deal-count pace |
| Annualized deal pace | ~438 | Above roughly 400 in 2025 |
| AI-security acquisitions in H1 | 29 | Almost 3x the 10 recorded during all of 2025 |
| Google acquisition of Wiz | $32B | Massive strategic bet on cloud and AI security |
| Cyera acquisition of Oasis Security | ~$1B | Data security and AI-agent identity are converging |
Could tighter corporate budgets stop the cybersecurity market from growing?
Tighter budgets can slow cybersecurity growth, but the evidence today points to tougher buying decisions rather than an approaching market contraction.
The warning signs are real. IANS found security-budget growth at a five-year low of 4% in its latest full benchmark, with 54% of CISOs reporting flat or shrinking budgets. Security spending also fell from 11.9% to 10.9% of IT budgets as AI and cloud infrastructure absorbed more corporate technology spending.
The newer ISG survey shows only a modest improvement, with average enterprise cybersecurity budgets up around 5% from 2025 to 2026.
That environment is dangerous for products customers merely like. CISOs increasingly need to choose between overlapping tools, prove that a product removes meaningful risk and justify another vendor to procurement.
It can favor the strongest parts of the market. Platform vendors can offer several capabilities under one contract. Managed services can replace difficult hiring. AI automation can help small teams process more work. Identity, cloud and data-security products sit close to technology projects that companies are already funding.
The bigger long-term risk would be security technology becoming efficient enough that companies could protect much larger digital estates without spending proportionally more money. AI could eventually contribute to that by automating security operations.
We are not seeing that effect overwhelm demand yet. Security budgets are constrained, but the attack surface and the number of things companies need to protect are still expanding faster.
This chart, included in our cybersecurity market deck, shows how identity verification platform technology has evolved over time
So, is the Cybersecurity Market growing now?
Yes, the cybersecurity market is clearly growing now, and we have enough evidence to call the growth strong rather than marginal.
The broad spending data is the cleanest starting point. Gartner sees worldwide information-security spending growing 11.6% to roughly $244 billion. IDC's wider security market reaches about $308 billion with 11.8% growth. That works out to tens of billions of dollars of additional annual spending.
Real company results back it up. CrowdStrike and Fortinet recently grew revenue 26%. Zscaler grew 25%. SentinelOne grew 21%. Those companies are already large enough that adding more than 20% revenue requires hundreds of millions of dollars of new business.
AI is giving the market another source of growth. Gartner expects AI cybersecurity spending to roughly double to $51 billion in 2026. Recent enterprise research finds companies increasing AI-security budgets while many still believe they are spending too little. Cloud security, identity and data protection are attracting huge acquisitions and financings at the same time.
The main restraint comes from the buyer side. A typical enterprise cybersecurity budget appears to be growing closer to 4% or 5%, far below the growth of the strongest vendors. Companies are consolidating products and demanding more from every security dollar.
That gap tells us what the cybersecurity market looks like today. The overall pool of money is expanding at a healthy low-double-digit rate, while a smaller group of cloud, identity, data, AI and platform vendors are growing much faster by taking a larger share of it.
Cybersecurity is growing. The harder question now is which companies will actually capture that growth.
If you want more recent data on this point, please see our latest cybersecurity market report.
OUR METHODOLOGY
This analysis tests whether the cybersecurity market is growing now by combining the measures that most directly show real market momentum: overall security spending, enterprise budgets, vendor revenue, growth acceleration, AI-driven demand, category growth, platform consolidation, managed services, threat activity, regulation, startup funding and M&A.
We did not treat those measures as interchangeable. Gartner measures end-user information-security spending, IDC uses a broader security market, CISO surveys track budgets controlled by security teams, and vendor results show how much spending individual companies are actually capturing.
We also avoided treating every positive number as purely incremental market growth. Faster vendor revenue can come from share gains, AI-security spending can replace older products, managed services can move spending outside internal teams, and M&A can show strategic urgency without directly measuring customer demand.
The strongest conclusions came from convergence across different types of evidence. When market forecasts, enterprise surveys, reported company results, category-level activity and strategic transactions pointed in the same direction, we gave that combined evidence more weight than any single headline statistic.
For spending and budget trends, key sources include Gartner's 2026 worldwide information-security spending forecast, IDC's Worldwide Security Spending Guide, PwC's 2026 Global Digital Trust Insights, IANS Research's Security Budget Benchmark, and ISG's 2026 enterprise cybersecurity survey.
For AI-security spending and vendor growth, we used Gartner's AI spending forecast alongside reported results from CrowdStrike, Fortinet, Zscaler, SentinelOne, and Okta.
For workforce pressure and the threat environment, key sources were ISC2's Cybersecurity Workforce Study, Verizon's 2026 Data Breach Investigations Report, Mandiant's M-Trends 2026, and IBM's 2026 X-Force Threat Intelligence Index.
For strategic transactions and capital activity, we used Google's announcement of the completed Wiz acquisition, Palo Alto Networks on the completed CyberArk acquisition, Cyera's financing announcements, and Momentum Cyber's H1 2026 market review. We prioritized primary company, institutional and frontline research sources over aggregation pages or commentary that repeated headline numbers without adding evidence.
In our cybersecurity market deck, we identify pain points entrepreneurs should prioritize
Related blog posts
- Cybersecurity M&A: what is happening now?
