56% of U.S. mid-market enterprise IT leaders expect their organization to invest at least $250,000 in AI over the next 12 to 24 months.

88% of U.S. mid-market enterprise IT leaders expect their organization to invest at least $100,000 in AI over the next 12 to 24 months.

25% of organizations have increased AI spending without a defined strategy connecting it to their people or security program.

42% of organizations plan to invest more in runtime security over the next 24 months.

29% of leaders find it materially harder to secure budget for AI projects due to market hype.

36% of middle market organizations prioritize cloud security in cybersecurity investment.

81% of middle market organizations plan to increase cybersecurity spending in the year ahead, down from 91% the previous year.

35% of middle market organizations prioritize broader risk management functions in cybersecurity investment.

68% of organisations have raised budgets for post-breach remediation and ransom payments.

67% of enterprises allocate a budget for securing business-built applications and AI agents, and they expect that budget to grow by 15% in the coming year.

Full data recovery is 40% among organizations reporting increased cybersecurity budgets versus 16% among organizations without increased budgets.

49% of organizations increased cybersecurity budgets year-over-year.

75% of organizations report increased identity security spending.

16% of state CISOs report their budgets have been cut, up from none in 2024.

20% of IT budgets are now dedicated to security among organizations in Canada.

61% of U.S. respondents say their organization’s average ransomware payout exceeds its annual cybersecurity budget. 83%

54% of retail and hospitality CISOs expect budget increases in 2026.

Nearly 90% of retail and hospitality CISOs expect spending on AI-related security initiatives to rise, often through reallocating existing budgets rather than adding new funds.

U.S. respondents (83%) were most likely to agree with the statement: “My organization has allocated sufficient budget for cybersecurity programs, including people and processes.”

In 2025, security spending increased from 0.57% to 0.75% of revenue in the retail and hospitality industry.