AI Cybersecurity Spending Hit $25.5B in 2026 — I Don't Think It's Working

AI cybersecurity spending hit $25.5 billion in 2026, and the average data breach still cost a record $4.99 million — up 12% year over year. If AI defense tools were actually winning the fight, one of those two numbers should be falling. Neither is.

I've made 65+ angel investments and sat on enough security vendor pitches to know the pattern by heart: a founder shows a slide where the attacker's line goes up and their tool's line goes down, and everyone in the room nods. I don't think that slide reflects what's actually happening at the market level in 2026. Attacks are up. Spend is up. Breach costs are up. Something in the "AI defense closes the gap" story doesn't hold when you look at the aggregate numbers instead of one vendor's case study.

What is happening with AI cybersecurity spending and attacks in 2026?

AI cybersecurity spending and AI-powered attacks are both accelerating at once in 2026: the AI-in-cybersecurity market reached $25.5 billion, 89% of organizations say they're increasing AI security budgets by an average of 47%, and AI-related capabilities will make up over 40% of all security spending by 2027, up from just 8% in 2023. On the other side of the ledger, AI-driven attacks rose 56% year over year according to IBM, with one in four malicious breaches now AI-enabled, and the average breach cost hit $4.99 million — a new record.

The consensus view: more AI defense spending is closing the gap

The industry narrative is straightforward and, on the surface, backed by real data. Organizations using extensive AI and automation in their security operations report breach costs of $3.62 million versus $5.52 million for those without — a $1.9 million, 34% reduction per incident. Gartner has introduced "securing AI" as its own budget line for the first time and expects it to overtake endpoint protection as the largest security category by 2029, adding $21.9 billion in new spend through 2030. Google's $32 billion acquisition of Wiz and a wave of AI-security funding rounds are all being read as proof that the market is correctly pricing AI defense as the next must-have layer, the same way firewalls and endpoint protection were must-haves in prior cycles.

Why I don't think AI cybersecurity spending is delivering the outcome it's sold on

Here's my problem with the consensus framing: it isolates the one metric (per-incident cost for the most sophisticated adopters) that supports the story, and skips the market-wide metric that doesn't. If AI defense tools were net-reducing risk, the global average breach cost should be flat or falling as AI security spend nearly tripled its share of budgets since 2023. Instead it hit a record $4.99 million, up 12% in a single year. AI-enabled breaches specifically cost $6 million on average — about $1 million more than the overall average — because attackers are using the same class of tools to automate reconnaissance, write more convincing phishing content, and adapt malware faster than defenders can patch. The $25.5 billion AI security market isn't closing a gap; it's running to keep pace with a threat surface that AI is expanding on the other side just as fast.

What the AI cybersecurity market's growth numbers are hiding

I'll grant the bull case its strongest data point: enterprises with mature, extensive AI and automation deployments genuinely do see lower breach costs, $3.62 million versus $5.52 million. That's not nothing, and it's the reason I still think a handful of category-defining vendors in this space are worth backing. But "extensive AI and automation" describes a small, well-resourced slice of the market — the same enterprises that already had the best security posture before AI showed up. For everyone else, the aggregate numbers say spend is going up faster than outcomes are improving. That's the same pattern I've watched play out with thin AI wrapper products in other categories: the tooling gets commoditized and resold as a premium line item well before it's actually differentiated enough to move the underlying metric.

I want to be precise about what I'm arguing, because it's not "AI security tools don't work." Some clearly do, for the buyers with the budget and maturity to deploy them well. My argument is narrower: the market-level story being sold, that AI defense spending is winning the arms race against AI-powered attacks, isn't supported by the market-level data. Global breach costs are at a record high in the same year AI security spend hit a record high. Both of those can be true, and if they both keep rising together for another two or three years, I think that's the tell that most AI security spend is being bought for reassurance, not results.

What would change my mind on AI cybersecurity spending in 2026

I'd get more constructive on the "AI defense is winning" thesis if the global average breach cost turned down for two consecutive years while AI security spend kept climbing — that's the signal that the investment is compounding into outcomes rather than just absorbing budget. I'd also want to see the AI-enabled breach cost premium (currently $1 million above average) shrink, since that's the cleanest evidence that defenders are actually neutralizing AI-powered attacks rather than just buying tools that make the pitch deck look responsible. Until then, I'm treating most "AI cybersecurity" line items the way I'd treat any vendor claim in a board meeting: worth funding selectively, not worth assuming the category-level spend is translating into safety.