rankozo

Software & SaaS · 55 figures

Cybersecurity Spending Statistics 2026

IDC expects global security spending to reach $308 billion in 2026, and Gartner puts end-user spending on information security at $240 billion for the same year. Budgets are growing more slowly than that: IANS found security budgets rose just 4% in 2025 and fell to 10.9% of IT spending, while IBM measured the average breach at $4.44 million worldwide and $10.22 million in the US.

Download CSVCite this pageUpdated November 4, 2026 · 19 sources · 59/59 quotes re-checked

This page tracks what organizations spend on cybersecurity and what it costs them when defenses fail. It covers global and regional market forecasts, security budgets, the cost of data breaches, ransom payments, security salaries, cyber insurance pricing and the largest security acquisitions. Most figures describe 2025 and 2026; forecasts run to 2029. Market sizes are in US dollars unless a figure is marked in Australian dollars.

The two big forecasters disagree on size but agree on direction. Gartner counts $213 billion of end-user information security spending in 2025 rising to $240 billion in 2026, while IDC uses a wider definition and expects $308 billion in 2026 and $430 billion by 2029. Both put growth at roughly 12% a year, and both expect security software to grow fastest. IDC expects the United States alone to spend $150 billion in 2026, about half the global total.

Inside companies the picture is tighter. IANS Research and Artico Search found security budgets grew only 4% in 2025, the slowest pace in five years, and security's share of IT spending slipped from 11.9% to 10.9%. ENISA's survey of EU organizations in critical sectors puts the share at 9% of IT budgets. Relative to revenue, security held flat at 0.69% in the IANS data. PwC's latest Digital Trust Insights survey shows sentiment turning back up, with 84% of security and finance leaders expecting budgets to increase and 58% of security leaders ranking AI among their top budget priorities. ISC2 still finds 33% of organizations without the budget to staff their security teams properly.

Breaches remain expensive. IBM's 2025 Cost of a Data Breach study puts the global average breach at $4.44 million, the first decline in five years, but the US average hit a record $10.22 million and healthcare breaches averaged $7.42 million. Organizations that used AI and automation extensively in security operations saved an average of $1.9 million per breach compared with those that did not. Nearly half of breached organizations told IBM they planned to raise prices afterward.

Ransom figures point in different directions depending on who measures them. Chainalysis traced $820 million in on-chain ransomware payments in 2025, down 8%, while the median on-chain payment jumped to $59,556. Coveware reports that only 23% of extortion victims in its cases paid in the third quarter of 2025, a record low, and Sophos found the median payment among surveyed victims who paid fell to $1 million. Cyber insurance is getting cheaper for buyers, with Marsh reporting a 4% global rate decline in the third quarter of 2026, while Munich Re sized the whole cyber insurance market at $15.3 billion of premiums in 2024. Acquirers are paying large sums for security platforms, led by Google's $32 billion agreement for Wiz.

01

Global cybersecurity spending forecasts

Gartner and IDC size the market differently, so their totals are not interchangeable: IDC's 2026 figure is about $70 billion higher than Gartner's. Both expect growth of roughly 12% a year. Software is the fastest growing category in both forecasts, and IDC expected it to be more than half of the market in 2025. Treat the out-year numbers as forecasts that are revised regularly.

Worldwide information security spending by segment, 2026 forecast

Millions of US dollars, end-user spending, Gartner forecast published July 2025.

$121,154
$92,780
$25,825
Security softwareSecurity servicesNetwork security

Source: Gartner, Gartner Forecasts Worldwide End-User Spending on Information Security to Total $213 Billion in 2025

02

Security spending by region

Spending is concentrated in a few markets. IDC expects the United States to account for about half of global security spending in 2026, and expected the US and Western Europe together to exceed 70% in 2025. IDC links European spending to regulation such as NIS2, DORA and the AI Act. Gartner expects MENA and Australia to grow about 10% in 2026, slightly slower than its 12.5% global figure, and its regional figures use the narrower Gartner definition.

Largest security spending regions, 2026 forecast

Billions of US dollars, IDC Worldwide Security Spending Guide, March 2026.

  • United States$150
  • Western Europe$69
  • Asia Pacific excl. Japan and China$26

Source: IDC, Global Security Spend to Exceed $300 Billion in 2026 as the Adoption of AI-Driven Security Platforms Gains Momentum

03

Security budgets inside companies

Market forecasts grow at about 12% a year, but the typical company budget does not. IANS data show 2025 budget growth slowed to 4% and that security lost share of IT spending for the first time in five years. ENISA's EU survey puts security at a similar 9% of IT budgets. People are the largest cost line in the IANS benchmark, ahead of software. PwC's survey suggests budgets are loosening again, with AI a top budget priority for 58% of security leaders. ISC2 shows the cost of the squeeze: a third of organizations lack the budget to staff their teams adequately.

Largest shares of the average security budget, 2025

Share of total security budget, survey of 587 CISOs by IANS Research and Artico Search, 2025.

  • Staff and compensation39%
  • Software29%
  • Outsourcing12%

Source: IANS Research, IANS 2025 Security Budget Benchmark Report

  • 4%

    Security budgets grew 4% on average in 2025, down from 8% in 2024 and the slowest growth in five years, based on a survey of 587 CISOs.

    IANS Research · IANS 2025 Security Budget Benchmark Report (Aug 2025)

    Exact quote

    Security budgets grew 4% on average in 2025, down from 8% in 2024 and the lowest growth in five years, according to IANS and Artico Search’s survey of 587 CISOs.

  • 47%

    Only 47% of CISOs received a budget increase in 2025, down from 62% a year earlier and 78% in 2022.

    IANS Research · IANS 2025 Security Budget Benchmark Report (Aug 2025)

    Exact quote

    Just 47% of CISOs increased their budgets, down from 62% the year before and 78% in 2022, while 39% had flat budgets.

  • 10.9%

    Security budgets averaged 10.9% of IT spending in 2025, down from 11.9% in 2024, the first drop in five years, according to IANS Research.

    IANS Research · IANS 2025 Security Budget Benchmark Report (Aug 2025)

    Exact quote

    Security budgets averaged 10.9% of IT spending in 2025, a full percentage point below the 11.9% of 2024.

  • 9%

    Organizations in EU sectors covered by the NIS rules spent 9% of their IT budgets on cybersecurity, with a median of €1.5 million, in ENISA's 2025 survey of 1,080 professionals.

    European Union Agency for Cybersecurity (ENISA) · NIS Investments 2025 (Feb 2026)

    Exact quote

    Cybersecurity investment remains broadly in line with the levels reported in last year’s study (9% of IT budgets; median 1.5 million euros), though spending is increasingly focused on technology and outsourcing rather than internal cybersecurity teams.

  • 0.69%

    Measured against company revenue, security spending held flat at 0.69% in 2025.

    IANS Research · IANS 2025 Security Budget Benchmark Report (Aug 2025)

    Exact quote

    Measured against company revenue, security spending held flat at 0.69%.

  • 39%

    Staff and compensation take 39% of the average security budget, more than software at 29% or outsourcing at 12%.

    IANS Research · IANS 2025 Security Budget Benchmark Report (Aug 2025)

    Exact quote

    Across all their spending, staff and compensation take the largest share of security budgets (39%), followed by software (29%) and outsourcing (12%).

  • 84%

    In PwC's 2026 global survey, 84% of security and finance leaders expect their cyber budgets to increase, six points more than a year earlier.

    PwC · 2027 Global Digital Trust Insights (2026)

    Exact quote

    Among security and finance leaders, 84% expect budgets to increase—six percentage points higher than last year—and 58% of security leaders rank AI in their top cyber budget priorities.

  • 58%

    58% of security leaders in PwC's survey rank AI among their top cyber budget priorities.

    PwC · 2027 Global Digital Trust Insights (2026)

    Exact quote

    Among security and finance leaders, 84% expect budgets to increase—six percentage points higher than last year—and 58% of security leaders rank AI in their top cyber budget priorities.

  • 51%

    51% of leaders in PwC's survey ranked data protection and trust as the top factor shaping their cyber spending priorities.

    PwC · 2027 Global Digital Trust Insights (2026)

    Exact quote

    When asked what factors are influencing their cyber spend priorities for the coming year, about half (51%) ranked 'data protection and trust' as their top choice.

  • 33%

    33% of organizations in the 2025 ISC2 study lacked the budget to staff their cybersecurity teams adequately.

    ISC2 · 2025 ISC2 Cybersecurity Workforce Study (Dec 2025)

    Exact quote

    Budget reductions are the key driver of staff shortages, as 33% of organizations don’t have the budget to adequately staff their teams, while 29% cannot afford to hire staff with the skills they need.

04

What a data breach costs

IBM's study, run with the Ponemon Institute, is the most widely used yardstick for breach costs, and its 2025 edition shows a split: the global average fell for the first time in five years while US costs set a record. The $1.9 million saving from extensive use of security AI and automation is the study's clearest figure for what security tooling is associated with. These are averages across a sample of breached organizations, so small firms will usually see far lower absolute costs and very large incidents far higher ones.

05

Ransomware payments and recovery costs

Ransom figures depend on who is counting. Chainalysis traces payments on blockchains, Coveware sees the cases it handles, and Sophos surveys victims, so their medians differ by an order of magnitude and do not move together: the on-chain median rose in 2025 while Sophos and Coveware recorded falling payments. They agree that a smaller share of victims pays. Recovery cost is a useful budgeting number because it applies whether or not a ransom is paid, and Sophos found it fell to $1.53 million on average in 2025.

  • $820 million

    Ransomware attackers received more than $820 million in on-chain payments in 2025, an 8% decline from $892 million in 2024.

    Chainalysis · Crypto Ransomware: 2026 Crypto Crime Report (2026)

    Exact quote

    In 2025, ransomware actors received more than $820 million in on-chain payments — an 8% decline year-over-year (YoY) from $892 million, our updated 2024 estimate.

  • $59,556

    The median on-chain ransom payment rose 368% to $59,556 in 2025, up from $12,738 in 2024.

    Chainalysis · Crypto Ransomware: 2026 Crypto Crime Report (2026)

    Exact quote

    In particular, the median payment increased 368%, from $12,738 in 2024 to $59,556 in 2025.

  • 28%

    Chainalysis estimates the share of ransomware victims who paid may have fallen to an all-time low of 28% in 2025.

    Chainalysis · Crypto Ransomware: 2026 Crypto Crime Report (2026)

    Exact quote

    Thanks to this dynamic, the share of ransoms paid potentially reached an all-time low this year at 28%.

  • $14 million

    Initial access brokers, who sell entry into victim networks, received at least $14 million in on-chain payments in 2025.

    Chainalysis · Crypto Ransomware: 2026 Crypto Crime Report (2026)

    Exact quote

    In 2025, we estimate that IABs received at least $14 million in on-chain payments — roughly flat YoY, although we expect this total to grow as attributions improve.

  • $1.53 million

    Sophos found the average cost to recover from a ransomware attack fell from $2.73 million in 2024 to $1.53 million in 2025.

    Sophos · Nearly Half of Companies Opt to Pay the Ransom, Sophos Report Finds (Jun 2025)

    Exact quote

    Silver Lining: Ransomware Payments and Recovery Costs are on the Decline: The average cost of recovery dropped from $2.73 million in 2024, to $1.53 million in 2025.

  • $1 million

    Among surveyed victims that paid, the median ransom payment halved from $2 million in 2024 to $1 million in 2025.

    Sophos · Nearly Half of Companies Opt to Pay the Ransom, Sophos Report Finds (Jun 2025)

    Exact quote

    While ransom payments are high, they declined by 50% from $2 million in 2024 to $1 million in 2025.

  • 53%

    53% of companies that paid a ransom in Sophos's 2025 survey paid less than the original demand.

    Sophos · Nearly Half of Companies Opt to Pay the Ransom, Sophos Report Finds (Jun 2025)

    Exact quote

    Despite the high percentage of companies that paid the ransom, over half – 53% – paid less than the original demand.

  • $2.5 million

    State and local governments reported the highest median ransom payment in 2025 at $2.5 million; healthcare reported the lowest at $150,000.

    Sophos · Nearly Half of Companies Opt to Pay the Ransom, Sophos Report Finds (Jun 2025)

    Exact quote

    Ransom Payments Vary by Industry: State and local government reported paying the highest median amount ($2.5 million), while healthcare reported the lowest ($150,000).

  • $376,941

    The average ransom payment in Coveware's cases fell 66% from the second quarter to $376,941 in the third quarter of 2025.

    Coveware · Insider Threats Loom while Ransom Payment Rates Plummet (Oct 2025)

    Exact quote

    The Average Ransom Payment — $376,941 (down 66% from Q2 2025) — and the Median Payment — $140,000 (down 65%) — both declined substantially in Q3 2025.

  • 23%

    Only 23% of extortion victims in Coveware's cases paid a ransom in the third quarter of 2025, a record low.

    Coveware · Insider Threats Loom while Ransom Payment Rates Plummet (Oct 2025)

    Exact quote

    Ransom payment rates across all impact scenarios — encryption, data exfiltration, and other extortion — fell to a historical low of 23% in Q3 2025.

06

Security salaries, insurance and acquisitions

Staff costs are the largest line in the IANS budget benchmark, and BLS data show information security analysts earn well above other computer occupations, with employment projected to grow 21% over a decade. Pay growth has cooled, though, with one in five ISC2 respondents getting no raise. Cyber insurance is moving in buyers' favor, with Marsh reporting thirteen straight quarters of falling rates, in a market Munich Re sized at $15.3 billion of premiums in 2024. At the top of the market, buyers are paying tens of billions for security platforms.

Median annual wage, information security analysts vs other US workers

US median annual wages, May 2025, Occupational Employment and Wage Statistics.

  • Information security analysts$129,180
  • Computer occupations$109,470
  • All occupations$50,980

Source: U.S. Bureau of Labor Statistics, Information Security Analysts: Occupational Outlook Handbook

  • $129,180

    The median annual wage for US information security analysts was $129,180 in May 2025.

    U.S. Bureau of Labor Statistics · Information Security Analysts: Occupational Outlook Handbook (2026)

    Exact quote

    The median annual wage for information security analysts was $129,180 in May 2025.

  • $199,850

    The top 10% of US information security analysts earned more than $199,850 in 2025.

    U.S. Bureau of Labor Statistics · Information Security Analysts: Occupational Outlook Handbook (2026)

    Exact quote

    The lowest 10 percent earned less than $75,090, and the highest 10 percent earned more than $199,850.

  • 21%

    BLS projects US employment of information security analysts to grow 21% from 2025 to 2035.

    U.S. Bureau of Labor Statistics · Information Security Analysts: Occupational Outlook Handbook (2026)

    Exact quote

    Employment of information security analysts is projected to grow 21 percent from 2025 to 2035, much faster than the average for all occupations.

  • 192,900

    Information security analysts held about 192,900 jobs in the US in 2025.

    U.S. Bureau of Labor Statistics · Information Security Analysts: Occupational Outlook Handbook (2026)

    Exact quote

    Information security analysts held about 192,900 jobs in 2025.

  • 20%

    20% of cybersecurity professionals in the 2025 ISC2 study received no salary increase over the past year.

    ISC2 · 2025 ISC2 Cybersecurity Workforce Study (Dec 2025)

    Exact quote

    While cybersecurity jobs have been viewed as high-paying, 20% of participants said they received no salary increase over the past year, with the majority (57%) receiving a salary increase ranging from 1–9%.

  • 4%

    Global cyber insurance rates fell 4% in the third quarter of 2026, the thirteenth consecutive quarterly decline, according to Marsh.

    Marsh · Global commercial insurance rates fall 5% in Q3 2026 (Oct 2026)

    Exact quote

    Cyber insurance rates declined by 4% globally — the thirteenth consecutive quarter of declines — the same rate as the previous quarter.

  • USD 15.3bn

    Munich Re estimates the global cyber insurance market totaled $15.3 billion in premiums in 2024, less than 1% of worldwide property and casualty premiums.

    Munich Re · Cyber insurance: Risks and trends 2025 (Apr 2025)

    Exact quote

    According to Munich Re estimates, the global cyber insurance market totaled USD 15.3bn in 2024.

  • 62%

    First-party claims, covering losses an organization suffers directly, make up 62% of the actively managed cyber claims in Munich Re's portfolio.

    Munich Re · Cyber insurance: Risks and trends 2026 (2026)

    Exact quote

    Cyber claims insights Looking at Munich Re Claims data on all actively managed claims in its portfolio, first-party claims (claims for losses suffered by an organisation directly) remain dominant at 62% compared to third-party claims, which cover liability for damages to other parties.

  • $32 billion

    Google agreed in March 2025 to buy cloud security company Wiz for $32 billion in cash.

    Google · Google announces agreement to acquire Wiz (Mar 2025)

    Exact quote

    (March 18, 2025)—Google LLC today announced it has signed a definitive agreement to acquire Wiz, Inc., a leading cloud security platform headquartered in New York, for $32 billion, subject to closing adjustments, in an all-cash transaction.

  • $25 billion

    Palo Alto Networks agreed in July 2025 to acquire identity security vendor CyberArk at an equity value of about $25 billion.

    Palo Alto Networks · Palo Alto Networks Announces Agreement to Acquire CyberArk, the Identity Security Leader (Jul 2025)

    Exact quote

    This represents an equity value of approximately $25 billion for CyberArk and a 26% premium to the unaffected 10-day average of the daily VWAPs of CyberArk as of Friday, July 25, 2025 1 .

FAQ

How much is spent on cybersecurity worldwide?

IDC projects global security spending of $308 billion in 2026, rising to $430 billion by 2029. Gartner, which uses a narrower definition, forecasts $240 billion of end-user information security spending in 2026, up 12.5% from $213 billion in 2025.

What percentage of the IT budget should go to security?

IANS Research found security budgets averaged 10.9% of IT spending in 2025, down from 11.9% in 2024. Measured against revenue, security spending held at 0.69%, so a company with $100 million in revenue spends roughly $690,000 on security at the benchmark level.

How much does a data breach cost?

IBM's 2025 Cost of a Data Breach study put the global average at $4.44 million, down for the first time in five years. The US average reached a record $10.22 million, and healthcare breaches averaged $7.42 million.

How much are ransomware payments?

Chainalysis traced $820 million in on-chain ransomware payments in 2025, with a median payment of $59,556. Among victims Sophos surveyed who paid, the median payment was $1 million, while Coveware put the average payment in its cases at $376,941 in the third quarter of 2025.

What do cybersecurity analysts earn?

The US Bureau of Labor Statistics reports a median annual wage of $129,180 for information security analysts in May 2025, compared with $109,470 for all computer occupations. BLS projects the occupation to grow 21% from 2025 to 2035.

Is cyber insurance getting more expensive?

Not at the moment. Marsh reported that global cyber insurance rates fell 4% in the third quarter of 2026, the thirteenth consecutive quarterly decline. Munich Re estimates the global cyber insurance market at $15.3 billion of premiums in 2024, less than 1% of property and casualty premiums.

Methodology note

We selected figures from the organizations that produced the underlying data: market forecasters (Gartner, IDC), survey sponsors (IANS Research, PwC, ISC2, Sophos), the EU cybersecurity agency ENISA, incident and blockchain analysts (IBM with the Ponemon Institute, Chainalysis, Coveware), a government statistics agency (BLS), insurers and brokers (Marsh, Munich Re) and the companies announcing acquisitions. Gartner and IDC define the security market differently, so their totals should not be added or compared directly. Survey figures reflect each sponsor's sample, which may lean toward larger organizations or toward victims of attacks. Ransom figures differ by method: on-chain tracing, negotiated cases and self-reported surveys. Every quote was refetched from the source page on the check date. Every quote is re-fetched from the source by our checker. See how we rank and verify.

Sources

  1. 1Chainalysis: Crypto Ransomware: 2026 Crypto Crime Report
  2. 2Coveware: Insider Threats Loom while Ransom Payment Rates Plummet
  3. 3European Union Agency for Cybersecurity (ENISA): NIS Investments 2025
  4. 4Gartner: Gartner Forecasts Worldwide End-User Spending on Information Security to Total $213 Billion in 2025
  5. 5Gartner: Gartner Forecasts MENA End-User Spending on Information Security to Total $4 Billion in 2026
  6. 6Gartner: Gartner Forecasts Information Security Spending in Australia to Reach Over $7.5 Billion in 2026
  7. 7Google: Google announces agreement to acquire Wiz
  8. 8IANS Research: IANS 2025 Security Budget Benchmark Report
  9. 9IBM: IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls
  10. 10IDC: Global Security Spend to Exceed $300 Billion in 2026 as the Adoption of AI-Driven Security Platforms Gains Momentum
  11. 11IDC: Worldwide Security Spending to Increase by 12.2% in 2025 as Global Cyberthreats Rise, Says IDC
  12. 12ISC2: 2025 ISC2 Cybersecurity Workforce Study
  13. 13Marsh: Global commercial insurance rates fall 5% in Q3 2026
  14. 14Munich Re: Cyber insurance: Risks and trends 2025
  15. 15Munich Re: Cyber insurance: Risks and trends 2026
  16. 16Palo Alto Networks: Palo Alto Networks Announces Agreement to Acquire CyberArk, the Identity Security Leader
  17. 17PwC: 2027 Global Digital Trust Insights
  18. 18Sophos: Nearly Half of Companies Opt to Pay the Ransom, Sophos Report Finds
  19. 19U.S. Bureau of Labor Statistics: Information Security Analysts: Occupational Outlook Handbook

Cite this page

Rankozo. (2026, November 4). Cybersecurity Spending Statistics 2026. https://rankozo.com/cybersecurity-spending-statistics

Download CSV

Questions or corrections: editorial@rankozo.com

More cost statistics