Tight Cybersecurity Budgets Accelerate the Shift to AI-Driven Defense – Source: www.securityweek.com

The need to do more with less is not new, but now it is essential.

Recent reports from both IANS and Swimlane come to the same conclusions: cybersecurity budgets are adversely affected by political and economic pressures outside of their control. The knock-on effects could be severe.

According to IANS, cybersecurity budgets are still growing, but at a dramatically lower rate: down from 17% in 2022 to 4% in 2025. IANS explains this slowdown in macroeconomic terms: “Global market volatility, fueled by ongoing geopolitical tensions, uncertainty around global tariff policies, and fluctuating inflation and interest rates, has made the business outlook for most companies unpredictable.”

Gartner has predicted that worldwide “end-user spending” on information security will reach $213 billion in 2025, up from $193 billion in 2024. Gartner estimates spending to increase 12.5% in 2026 to total $240 billion.

Amy Lindenmeyer (CFO at Keeper Security) explains, “Operational efficiency, profitability and productivity all factor into the multifaceted pressures facing business leaders anytime, but particularly during an economic downturn.”

Business has become more frugal in spend generally – and cybersecurity spend is a major victim. The knock-on effect is more security staff shortages (leading to reduced team morale, inefficient use of existing security tools, and increased risk of noncompliance); delays in new security initiatives with planned projects canceled or postponed increasing organizational risk; and the need to focus efforts in one area at the expense of others.

Swimlane’s study comes to similar conclusions but examines the issue through the lens of federal policy rather than global economics. For Swimlane, the primary causes of budget restraint are uncertainty over the effect of federal cybersecurity policy: decreased funding for CISA (hindering threat sharing between government and private industry); and the disbanded Cyber Safety Review Board (reducing coordination after major incidents). The combined effect elevates in-house uncertainty, delays in-house investments, and increases organizations’ overall risk exposure.

Security teams are forced to do more with less, and to focus more on in-house cybersecurity and less on national cybersecurity. That will lead to greater reliance on automation from agentic AI (which increases a firm’s threat surface and decreases the need for – and ultimately supply of – human cybersecurity expertise). 

“Security teams everywhere are feeling the pinch from tightening budgets,” comments Matt Lee (security and compliance sr director at Pax8) comments. “It’s putting real strain on these professionals who are already stretched thin. We’re seeing more organizations turn to AI-powered security tools that can take care of routine tasks like alert triage and threat detection.”

The Swimlane report takes one single diversion into the global economy: US federal policy has a ripple effect on global cybersecurity. The UK is used as an example. Just as Europe is seeking to be less reliant on the military strength of the US, so UK cybersecurity is seeking to be less reliant on US cybersecurity vendors. This is likely to be repeated in many of the more advanced economies around the world.

Seventy-nine percent of UK respondents say they are more cautious about relationships with US cybersecurity vendors; 53% have increased their reliance on UK or EU based security suppliers; 43% have reassessed existing relationships; and 29% have delayed or canceled new contracts with US cybersecurity vendors.

All of this is against the background of growing professionalization and sophistication from cybercrime as a service, and the assertiveness of elite nation state groups caused by worsening geopolitics.

Swimlane based its report on a survey of 500 IT and cybersecurity decision makers at companies with at least 1,000 employees in the US and UK. The timeframe was June 2025 and July 2025.

The IANS report is based on a survey of “587 security executives at a diverse set of companies.” The timeframe was April 2025 to August 2025.

Related: White House Proposal Slashes Half-Billion From CISA Budget

Related: ICS/OT Security Budgets Increasing, but Critical Areas Underfunded: Report

Related: White House Outlines Cybersecurity Budget Priorities for Fiscal 2025

Related: Addressing the Challenges Cybercrime-as-a-Service Serves Up