IDC forecasts the Asia/Pacific professional security services (PSS) market is forecast to grow at a compounded annual growth rate (CAGR) of 10% from 2026 to 2030 , and security providers are changing what they sell, how they deliver, and how they staff. IDC’s latest Professional Security Services MarketScape, which assesses 21 providers, identifies three forces behind the shift: agentic AI moving into live delivery, a sharper sovereignty and regulatory agenda, and a wave of acquisitions. Clients want two things: security for their own AI, and AI inside to the security services they buy.
In Asia Pacific, 53% of organizations rank securing and governing AI initiatives and AI agents among the top three goals of security provider engagements, ahead of 48% worldwide. (Source: WW Cybersecurity Consulting Services Survey, Oct 2026, AP n=239)
What’s forcing security providers to change?
- Security has become a board-level question of digital trust, operational resilience, and regulatory standing. Organizations now expect security providers to take a security initiative from strategy and architecture through implementation, training, and incident readiness. 48% of organizations expect significant funding increases for incident readiness services and security consulting, according to IDC’s Asia/Pacific 2025 Security Survey.
- Agentic AI is now both a tool and a threat. Security providers are embedding agentic AI in SOC operations, GRC assessments, and offensive testing. Organizations, meanwhile, face AI-powered attackers, with AI-enhanced impersonation and LLM prompt injections, increasing the demand for AI-driven protection.
- Sovereignty is now a delivery requirement. Australia’s Cyber Security Act, India’s Digital Personal Data Protection Act, and data-localization rules elsewhere are pushing security providers to establish dedicated SOCs, cleared personnel, and classified delivery centers in-country, rather than relying solely on regional or offshore hubs.
How are security providers evolving?
- People-led, agent-assisted delivery. Security providers are shifting from road map slides to live tooling. During my evaluation of IDC’s APeJC PSS MarketScape, I was impressed by how a security provider can run an autonomous penetration-testing agent and report on autonomous test execution in under 50 hours. Another provider developed a SOC AI worker that independently triages and classifies alerts, while humans remain in the loop for critical decisions.
- Providers now sell AI trust and agent governance. Another trend that stood out during my conversations with security providers is the emergence of AI trust and agent governance. Security providers are building agentic AI trust frameworks that cover agent discovery and registration, sandboxed testing and certification, and continuous policy monitoring for clients’ own agents. Providers are also establishing Frontier AI Security advisory practices. In IDC’s WW Cybersecurity Consulting Service Survey, 35% of organizations have already used their provider for agentic AI security advisory and 26% for AI trust services.24% have used theirs for AI bill-of-materials work.
- Acquiring sovereign capacity. Security providers are buying and building their way to in-country capacity. A global security provider completed an acquisition in early 2026 that added 1,000+ security professionals and security operations centers across Australia and New Zealand. An IT services firm bought an Australian specialist to deepen offensive security skills and government accreditations. Another runs a defense-classified sovereign cyber defense center in Canberra. Ultimately, when I speak to CISOs or CIOs, the winning combination is the ability to move between onshore, sovereign, and offshore delivery to match risk tolerance, data residency obligations, and budget.
- GRC moving onto AI-assisted platforms GRC is moving to platforms. One security provider’s AI-assisted platform automates control mapping against frameworks such as DPDP, PDPA, MAS TRM, and APRA CPS 234, while another layers AI accelerators onto a workflow-platform-based GRC suite. Resilience is following the same path, with dedicated recovery services joining readiness and response, and at least one security provider bundling advisory, threat intelligence, and response into a single continuous retainer.
- From billable hours to retainers, outcomes, and embedded engineers. The commercial delivery model is changing fast. Data from IDC’s WW Cybersecurity Consulting Services Survey indicates that only 8% of Asia/Pacific organizations run one-off, project-based engagements. Most are on continuous, embedded advisory (37%), managed or subscription services (23%), or outcome-based arrangements (20%). Forward-deployed engineers and technical staff, embedded onsite or virtually, are a core, ongoing part of the engagement.
For the technology leaders: what should you ask your security provider?
- Show me AI in production. Ask for agentic AI, GenAI, and automation running in SOC operations, GRC assessments, or security testing, backed by measurable outcomes such as faster response times, quicker assessments, or higher analyst productivity.
- Prove you know my regulations. Look for the ability to flex across onshore, sovereign, and offshore delivery, plus depth in your industry and in rules such as the Cyber Security Act or the DPDP Act.
- Tell me who is behind the capabilities. Alliances with hyperscalers, cybersecurity vendors, and AI model providers signal how well AI-driven outputs are governed and tested, and how quickly you’ll get access to new capabilities.
IDC outlook: what’s next?
IDC expects that the security providers best positioned to become long-term strategic partners, rather than service vendors, will combine three elements: trusted, in-production AI-enabled tooling; a mix of onshore, sovereign, and offshore capacity; and a broad ecosystem of hyperscalers, security software vendors, and, increasingly, AI model and platform providers. Buyers can use those three elements as a checklist when they shortlist providers.
IDC’s FutureScape webinar, Agents. Sovereignty. Quantum. What Earns Trust & the Budget That Follows, picks up the budget side of the questions raised here. It draws on IDC survey data showing that more than half of surveyed Asia/Pacific buyers name cybersecurity and resiliency as the top factor in their AI budgets. On Tuesday, December 15, 2026 at 2:00 PM SGT, IDC’s Sakshi Grover and Yih Khai Wong will walk through IDC’s ten FutureScape 2027 trust predictions and the Trust Playbook, which lists what leaders should ask of their providers. Register to bring that list to your next budget conversation.
*Asia/Pacific Excluding Japan and China
