AI cybersecurity budgets should not assume staff cuts

AI leads cybersecurity investment priorities as teams plan to do more

Security leaders are putting AI first in new spending plans while expecting continued demand for people and skills. They must fund more capable security operations within modest budget growth. So assumed staff reductions are a weak starting point for financing AI purchases.

About seven of every 10 chief information security officers, or CISOs, surveyed named AI their highest priority for new cybersecurity investment in the 2026 Security Budget Benchmark Report, released Tuesday by IANS and Artico Search. The report draws on responses from more than 500 security executives and examines investment, staffing, and how business priorities shape security strategy. IANS and Artico Search have commercial interests in demand for security expertise and executive recruitment, respectively, which readers should weigh alongside their findings and commentary.

Modest budget growth meets AI-related vendor price increases

AI tops investment priorities in a restrained spending environment: the IANS and Artico Search report puts overall security spending growth at 5% in the current survey, compared with 4% in the year-ago report. Growth accelerated slightly. While AI’s ranking shows its priority among respondents, the spending figures describe the broader funding available for their decisions.

Available funding also varies substantially with company size. IANS puts security budgets at about $1 million per year for businesses with annual revenue of $100 million or less, compared with more than $30 million for businesses with annual revenue above $10 billion. Buyers can use those benchmarks to weigh an additional commitment against existing security costs. But affordability still depends on the organization’s approved budget and the other work it must fund.

Within those budgets, suppliers are seeking higher prices for AI additions. “Vendors are racing to monetize the AI hype by adding AI features and using them to justify significant price increases,” Nick Kakolowski, senior research director at IANS, told Cybersecurity Dive. Kakolowski describes how suppliers use added functionality to support a larger charge. Buyers therefore need to connect the proposed increase to the security work that functionality would improve.

Higher prices also come with more products to assess. IANS researchers say concerns about AI-enabled attacks are prompting a flood of tools aimed at security teams. Before committing funds, buyers must assess each proposal’s relevance, overlap with existing tools, and cost. The practical question is what additional capability the organization would receive for the extra expense.

CISOs expect greater demand for cybersecurity skills

Those extra expenses cannot safely be matched to assumed payroll savings, given respondents’ workforce expectations. Eight of every 10 CISOs in the report expect AI to generate demand for cybersecurity roles and job skills. About seven of every 10 do not expect to need headcount reductions because of AI. Together, these responses suggest planning for the people needed to support expanded security capabilities.

Continued demand for people can coexist with higher productivity. CISOs expect AI to help security operations accomplish more over the long run, and they express less concern than initially expected about traditional teams becoming obsolete or widespread layoffs. Improved tools can let a team take on more security work while still requiring staff to carry it out. The expected investment benefit may therefore be greater team output.

Greater output becomes a financial benefit when the organization identifies the change and assigns it a value. Because the survey describes expectations over time, each purchase still needs an assessment of likely gains and operating requirements. Expected demand for roles and skills also leaves organizations to determine their own hiring, training, and staffing costs. The percentages describe aggregate responses, so they should be read separately rather than combined into the assumed answers of an individual CISO.

Specific security uses define the expected benefit

Assessing operating requirements starts with the work AI is meant to improve. The report identifies security-operations automation and improvements to identity and access management as two areas receiving AI-related investment. Security operations cover detecting and responding to threats, while identity and access management controls who can use systems and what they can access. Buyers can use these activities to define the proposed change and identify the people needed to make it work.

Beyond those uses, organizations are increasingly applying AI to search their software for critical weaknesses. Finding flaws gives the investment a defined purpose: identifying issues that need attention. Its operational value depends on whether the organization can use the findings to improve security work, which makes handling those findings part of the investment decision.

Threat hunting extends the work from finding weaknesses to investigating possible compromise. Organizations use AI to look for activity inside their systems that could signal malicious behavior, so the expected benefit should be tied to the team’s ability to investigate it. Across these applications, evaluating results after deployment helps establish whether productivity improved as intended and what value that delivered.

The need to improve defensive work also reflects changes in attackers’ capabilities. Criminal and state-linked hackers use AI to increase the speed and scope of attacks, giving security teams a reason to examine defensive applications. Vendors’ efforts to charge more for AI create a separate purchasing pressure. An expanding threat can strengthen the case for improving a security activity, but the proposed tool still needs an assessment of its contribution, cost, and staffing requirements.

Future automation savings need explicit conditions

Even when an investment has a clear operational purpose, paying for it may depend on future automation savings. Automation could eventually reduce staffing needs and help cover its own cost; current expectations of continued headcount leave that possibility open. But expected demand for skills makes those savings conditional. A business case that relies on staff reductions needs to identify which work would change, when staffing needs could fall, and how the organization would realize the savings.

Timing matters when a purchase needs those savings to remain affordable. Finance and procurement teams can examine the incremental charge alongside the security team’s expected operating costs, including the people required to use the capability. They can then assess when savings would become available and how likely they are. Until those conditions are met, future payroll savings remain a financing possibility.

Key highlights

• Budget for AI price increases: About 70% of surveyed CISOs rank AI as their top new investment priority, while overall security spending growth is 5%. Procurement and security teams need to assess vendor price increases against added capability, existing tools, and available funding.
• Plan for continued skills demand: Eight in 10 CISOs expect AI to generate demand for cybersecurity roles and skills, and seven in 10 expect no AI-related headcount reductions. Security budget owners need to include staffing and training costs in AI purchase decisions.
• Tie purchases to specific security work: Security operations, identity and access management, software flaw detection, and threat hunting provide concrete uses for AI investment. Security teams need to define the expected operational improvement and measure results after deployment.
• Make automation savings conditional: Future staffing savings depend on which tasks change, when staffing needs fall, and how savings become available. Finance and procurement teams need those conditions documented before using projected payroll savings to fund AI purchases.