Where CISOs Are Putting Their 2027 Security Budgets (and How to Prioritize Yours)

Where CISOs Are Putting Their 2027 Security Budgets

Budget season is when strategy meets arithmetic. Every CISO knows what they'd like to fund; the harder question is what the data says everyone else is actually funding, and where that leaves the gaps in your own environment.

We pulled together the most current research on 2026–2027 security spending — Gartner, PwC's Global Digital Trust Insights, Foundry's Security Priorities Study, the RH-ISAC CISO Benchmark, and others — and five categories kept surfacing ahead of the rest. Below is the data behind each one, the gap it's exposing, and the case for where to spend the next dollar.

1. Identity & Access Management — especially machine and agentic identity

The data: IAM has quietly become the largest line item in a lot of security budgets. Global IAM spend is projected at $26.1 billion in 2026, up 19.7% year-over-year — nearly double the growth rate of the broader security market (Start with Identity). 73% of CISOs plan to increase IAM spending, and 42% rank it as their #1 or #2 investment priority. ITDR is the fastest-growing subcategory, with budgets "nearly doubling year-over-year" as CISOs stand up dedicated line items for the first time (same source).

$26.1B global IAM spend in 2026, up 19.7% YoY — nearly double the broader security market's growth

73% of CISOs plan to increase IAM spending; 42% rank it #1 or #2 priority

2x ITDR budgets are “nearly doubling year-over-year” as dedicated line items appear

Start with Identity, May 2026

The gap: Agentic AI has multiplied the number of "things" an IAM program has to govern — service accounts, API keys, autonomous agents — often faster than access reviews and least-privilege controls can keep up. ISC2 CISO Jon France put it plainly: organizations now must manage "not just human identities but thing identities as well" (CSO Online).

The case: IAM is already the biggest line item in many security budgets, and the fastest-growing piece of it — machine and agent identity — is exactly the part most programs haven't inventoried yet. Before adding another IAM tool, know where the exposure already is. We've written before about what happens when this goes unmanaged — our breakdown of the Amgen cloud breach shows how a "cloud breach" is almost always an access breach in disguise.

Where InfoSight fits:  tests the identity sprawl — human and non-human — driving this budget shift, before an attacker finds it for you.

AD & Entra ID IAM Security Assessment →

Related: our breakdown of the Amgen cloud breach — shows how a “cloud breach” is almost always an access breach in disguise

2. AI Governance & Shadow AI / "Shadow Agent" Detection

The data: 69% of cybersecurity leaders suspect or have evidence that employees are using prohibited public GenAI tools, and Gartner predicts more than 40% of enterprises will have a security or compliance incident tied to unauthorized shadow AI by 2030 (Gartner Newsroom). In the 2026 RH-ISAC CISO Benchmark, AI ranks above supply chain risk, vulnerability management, and ransomware as the most-cited source of day-to-day friction for security leaders (Help Net Security).

69% of cybersecurity leaders suspect or have evidence employees are using prohibited public GenAI tools

40%+ of enterprises are predicted to have a security or compliance incident tied to unauthorized shadow AI by 2030

Gartner Newsroom, Nov 2025

#1 AI ranks above supply chain risk, vulnerability management, and ransomware as CISOs' top source of day-to-day friction

RH-ISAC CISO Benchmark, via Help Net Security, Apr 2026

The gap: Most organizations already have a policy on paper — RH-ISAC found governance "implemented or partially implemented" almost everywhere — but few have visibility into what's actually running: which tools, which agents, touching which data. Google Cloud's Cybersecurity Forecast 2026 goes a step further, warning that autonomous agents are turning "shadow AI" into "shadow agents" — tools employees deploy on their own, with no one accountable for what they touch (cited in CSO Online).

The case: Policy without visibility isn't governance — it's a hope. Before the incident Gartner is forecasting shows up in your environment, the highest-leverage spend is finding out what's already there, and building the oversight layer to keep it that way. It's also personal for CISOs: 26% considered quitting this year as AI governance landed on their desk with no added budget or headcount to match. We covered why here.

Where InfoSight fits:  give visibility into sanctioned and shadow AI use before it shows up in an audit finding or a breach report.

For teams without a dedicated hire, Virtual Security & GRC Leadership (vISO) builds the policy and oversight layer underneath it.

AI Governance & Exposure Assessment →     AI Penetration Testing →     Virtual Security & GRC Leadership (vISO) →

Related: why 26% of CISOs considered quitting this year — as AI governance landed on their desk with no added budget or headcount

3. Cyber Resiliency & Business Continuity

The data: Gartner names resiliency one of three defining CISO themes for 2026, noting true cyber resilience "includes legal, public relations, market disclosures, and supplier readiness" — not just IT recovery (CSO Online). PwC's 2026 Global Digital Trust Insights survey of nearly 3,900 executives across 72 countries found 60% now rank cyber risk investment among their top three strategic priorities, largely in response to geopolitical uncertainty (PwC).

1 of 3 defining CISO themes for 2026, per Gartner — resilience now spans legal, PR, market disclosures, and supplier readiness

Gartner, via CSO Online, Jan 2026

60% of 3,887 executives across 72 countries rank cyber risk investment among their top 3 strategic priorities

PwC Global Digital Trust Insights, 2026

-26pts drop in state CISOs “very confident” they could protect public data — 48% (2022) to 22% (2026) — even as spend rose

2026 NASCIO-Deloitte Cybersecurity Study

The gap: Confidence hasn't kept pace with the spending. Among state CISOs, those "very confident" they could protect public data dropped from 48% in 2022 to just 22% in 2026 (2026 NASCIO-Deloitte Cybersecurity Study) — a sign that a lot of that budget is buying tools and backups, not the cross-functional muscle memory (legal, comms, suppliers) that determines how well an organization actually performs during an incident.

The case: A resiliency budget that only buys backup infrastructure is buying half the plan. The other half — who talks to legal, press, and suppliers, and in what order — is what separates a contained incident from a headline.

Where InfoSight fits:  build the cross-functional playbook Gartner is describing — not just backup schedules, but who talks to legal, press, and suppliers on the worst day.

BCR/DR Planning →     Cybersecurity Incident Response Planning →

4. Data Protection (still the #1 line item, budget after budget)

The data: For all the AI headlines, the single most-cited CISO priority for 2026 is the oldest one on the list: data protection, named by 48% of security leaders in Foundry's Security Priorities Study (CSO Online).

48% of security leaders name data protection their #1 CISO priority for 2026 — more than any other category

Foundry Security Priorities Study, via CSO Online, Jan 2026

The gap: AI hasn't replaced the old ways data gets exposed — lost laptops, stolen credentials, misconfigured cloud storage — it's added a new one. When an employee pastes a customer list or a draft contract into a chatbot to get help writing something, that data leaves the company's control the moment it's typed, with no alert, no log, and no way for the security team to know it happened. CYE CISO Amit Levinstein sums up the shift: data protection "has become more challenging in the age of AI" because GenAI "creates a lot of different risks from a data leakage perspective." The old playbook — encrypt it, lock down who can access it — doesn't cover a channel employees adopted on their own, outside any tool IT approved. And the scale of the underlying exposure isn't shrinking either — see our recent post on Oracle's 1,434-CVE quarter for a sense of what unpatched exposure looks like at enterprise scale.

The case: Data protection tops the list every year for a reason — it's the priority every other priority depends on. For 2027, the question isn't whether to fund it, it's whether that funding also covers the new way data can walk out the door — through an AI tool an employee is already using — not just the ways security teams have been guarding against for a decade.

Where InfoSight fits:  stop data loss in progress; Patch & Vulnerability Management and the Cyber Controls Gap Assessment close the exposure before it's exploited.

Managed EDR →     24x7 MDR & SOCaaS →     Patch & Vulnerability Management →     Cyber Controls Gap Assessment →

Related: our recent post on Oracle's 1,434-CVE quarter — a sense of what unpatched exposure looks like at enterprise scale

5. Third-Party & Supply Chain Risk Management

The data: Third-party risk management ranked #11 on Foundry's CISO priorities list for 2026, but is described as rapidly climbing in urgency. Major AWS, Azure, and Cloudflare outages in 2025 are cited as a wake-up call for strengthening supplier resilience (CSO Online).

#11 on Foundry's 2026 CISO priorities list — but rising fast

Foundry Security Priorities Study, via CSO Online, Jan 2026

3 major cloud outages (AWS, Azure, Cloudflare) in 2025 cited as the wake-up call for supplier resilience

CSO Online, Jan 2026

The gap: Third-party risk has historically been a once-a-year questionnaire exercise. Between AI embedded in vendor products and concentration risk in a handful of cloud providers, that cadence is now too slow for the actual risk. DXC Technology CISO Mike Baker notes AI is compounding this: CISOs increasingly need to vet the AI models embedded in the vendor software they buy, not just the vendor's general security posture (same source).

The case: A single vendor outage or an unvetted AI model inside a purchased tool can undo the resiliency and data-protection work above it. Ranked #11 today, this is one bad quarter away from being #1.

Where InfoSight fits:  extend risk visibility past your own perimeter and into the vendors — and the AI — you depend on.

Framework Compliance Assessments →     Enterprise Risk Management →

The common thread

None of these five categories exist in isolation — an identity gap is a data protection problem, a shadow AI tool is a third-party risk, and none of it matters if you can't actually operate through the incident when it hits. That's the case for building your 2027 budget around a program, not a shopping list.