Security Budgets Are Up. CEOs Still Rank It Their Top Tech Risk

The logic is solid. Invest more in security, and you’ll reduce your risk.

IDC data suggests otherwise. IDC’s 2026 Worldwide Security Spending Guide (V2 release) forecasts that organizations will spend $310.42 billion on security this year, up 13.2% from 2025. Yet in IDC’s February 2026 CEO Survey of 492 CEOs, cybersecurity is still the highest-ranked anticipated technology risk, ahead of AI itself.

In the same survey, organizations have funded security and put governance around it, yet they still do not feel safer.

So why the mismatch between rising budgets and heightened concern?

Two IDC surveys, one of CEOs and one of security buyers, point to the same evidence gap: security spending isn’t following the risk data meant to justify it.

To meet CEO expectations for security, tech leaders need to find where the gap sits in their own organization. Start with these three questions.

1. Is your next AppSec purchase justified by a finding or by a feature?

At the buyer level, the top reason security buyers gave for their most recent application security (AppSec) tool purchase was adopting AI features (31%), followed by better integration (28%). Neither reason is about risk findings. Both figures come from IDC’s 2025 DevSecOps and Software Supply Chain Security Survey (n=511, fielded July 2025).

The same survey, of US-based organizations with more than 500 employees, puts the average 2024 AppSec budget at $2.3 million, and 61% of organizations raised it in 2025, with an average change of about +5% across all organizations.

2. How does your spend compare to organizations your size?

Endpoint security funding isn’t reaching every organization equally. Large organizations are raising budgets faster, while small organizations lag.

IDC’s 2026 Worldwide Modern Endpoint Security Survey (n=846, fielded March 2026) found that more than 60% of organizations raised their 2026 endpoint security budgets. More than 25% of large organizations (500–999 employees) raised them by 10% or more, versus only 12.9% of small organizations (1–99 employees).

The gap isn’t evenly distributed. Small organizations are often the ones with the least room to absorb a miss, so knowing how your spend compares with organizations your size is a useful first reference point.

3. Is security part of your AI funding conversation?

In IDC’s February 2026 CEO Survey, 50% of CEOs named advanced cybersecurity, and 52% named agentic and generative AI at scale, as a top-three investment area for the next 12 to 24 months. The two sit two points apart, which suggests CEOs weigh AI and security funding together.

CEOs link the two on risk as well. Asked what concerns them most about AI, they name data privacy (46%) and security (35%) as their top two risks.

How to close the evidence gap

If one or more of these questions hit close to home, you may be facing an evidence gap. The same question applies to AI. In IDC’s MaturityScape Benchmark: AI-Fueled Organization Worldwide, 2026 (n=1,900), 61.3% of organizations are still in the two earliest stages of AI maturity. Where do you stand?

The first step to closing the gap is knowing where you stand against your peers. IDC Quanta for Tech Leaders delivers sourced IDC research and peer benchmarks directly into the tools your teams already use, with no separate portal or login.