Cybersecurity

IDC’s outlook covers spending on security software, hardware and services. A specialist’s addressable market is narrower, shaped by its products, customer sectors, countries and required approvals. The chart shows the broad spending pool, with both years marked as estimates or forecasts.

ENISA’s December 2025 survey found median security spending of €1.5 million among 1,080 EU organisations, mostly large businesses in highly critical sectors. That is a sample of customer budgets, not a European market total. It helps explain why tools that reduce specialist workload and managed services can compete for the same budget.

As companies put AI agents to work, they also need to control which systems those agents can access and what actions they can take. In August 2026, Gartner forecast US$4.8 billion of worldwide spending on securing AI in 2027. This is a forecast for a specialised category, not an extra amount to add automatically to the wider security market. Useful products must control access and detect misuse, not merely add an AI label.

Regulation is changing the work too. The EU Cyber Resilience Act’s reporting obligations began on 11 September 2026 for actively exploited vulnerabilities and severe incidents affecting covered digital products. That creates practical work in identifying affected components, handling vulnerabilities and reporting incidents. Compliance spending is a demand driver; it does not prove that a particular supplier wins the contract.