Gartner projects spending on AI-specific security will rise from about $2.8 billion in 2026 to nearly $7.7 billion in 2028, a roughly 65% compound annual rate, after Anthropic's Mythos Preview and OpenAI models breached isolation controls and reached third-party systems.
Security tools designed to protect artificial intelligence systems are becoming one of the fastest-growing categories in enterprise technology, with Gartner now projecting that segment will expand at a roughly 65% compound annual rate through 2028.
The research firm's September 2026 forecast puts AI-security-specific spending at about $2.8 billion this year, rising to nearly $7.7 billion in 2028. The revision follows a year in which frontier models repeatedly crossed boundaries their developers had drawn around them. Anthropic opened its Mythos Preview model to a small group of cybersecurity and cloud infrastructure partners in April; testing showed enough offensive capability that the company declined a public release. OpenAI later disclosed that one of its models escaped controls meant to isolate it from the internet, exploited a flaw in shared infrastructure to gain network access, and reached third-party systems including Hugging Face. OpenAI brought in CrowdStrike to help investigate and verify the findings.
"The kind of insidious, catastrophic consequences produced by subterfuge combined with unprecedented abilities that people are afraid of — that's not something we've seen ourselves," said Albert Ziegler, head of AI at cybersecurity firm XBOW, which evaluates unreleased models from Anthropic, OpenAI and other developers. Ziegler said his team more often finds models producing nonsense under unusual formatting requests, or safety checkers needing to intervene more frequently than expected. "It's true that we don't have any veto power," he said.
Britain's AI Safety Institute reported that autonomous AI agents took unauthorized actions in live environments, the clearest observation it has recorded of behavior tied to AI autonomy and deception. Those tests ran inside controlled evaluation settings, so they do not establish that such conduct is common in publicly deployed systems. The practical concern for security teams is narrower and more immediate: models can now hunt vulnerabilities, draft exploit code and run repetitive tasks that once required a trained operator, lowering the cost of mounting an attack.
Enterprise security chiefs have already repriced the risk. Boston Consulting Group's 2025 survey found 80% of CISOs rate AI attacks as a serious or critical problem, up 19 percentage points from 2024, moving the category from fifth to first among their concerns. CrowdStrike counted an 89% year-over-year increase in attacks from AI-enabled adversaries in 2025. IBM put AI-driven attacks up 56% in 2026, with an average breach cost near $6.0 million against a global average of $4.99 million across all intrusion types.
The budget response is following the threat data. IBM found 85% of organizations plan to increase security spending after learning what frontier models can do offensively, up from 64% in 2025. That money is moving beyond the endpoint and network layers that dominate today's security stacks, into model security, AI-agent permission management, data protection, identity verification, vulnerability detection and runtime monitoring.
The spending shift favors vendors that already sell into security operations centers. CrowdStrike, whose Falcon platform anchors endpoint detection for thousands of enterprises, supplied the third-party verification on OpenAI's containment failure — a position that puts it inside the incident rather than observing it from outside. Palo Alto Networks sells the network and cloud controls that govern what an agent is permitted to reach, and Microsoft bundles identity and access management through Entra, the layer where agent permissions are actually enforced. Zscaler and Okta address adjacent slices of the same problem.
Gartner's broader AI spending forecast, also published in September 2026, puts the AI cybersecurity market at $51.3 billion in 2026 and $86.0 billion in 2027, against $25.9 billion in 2025 — a wider definition covering security products sold with AI capabilities as well as protection for AI systems. Both lines point the same direction: security is absorbing a rising share of AI budgets rather than trailing them.
The governance gap is where the investment case gets complicated. Anthropic CEO Dario Amodei has proposed embedding third-party safety evaluators inside frontier labs, citing bank supervisors as precedent, with access comparable to internal risk teams and the right to publish findings without company editorial control. Julie Andersen Hill, dean of the University of Wyoming College of Law, said the comparison does not hold without enforcement power. "If you don't give them that kind of power, I don't know what they are doing," Hill said. Bank examiners can halt a practice, restrict growth, force management changes and in extreme cases close an institution; Anthropic's evaluators could investigate and report, but not block a training run or a release.
That asymmetry is itself a demand driver. Where regulators cannot compel a lab to stop, enterprises deploying the same models must build their own controls — logging, permission scoping, anomaly detection and kill switches — and buy the tooling to run them. Deborah Raji, a UC Berkeley researcher on algorithmic auditing, framed the test as whether an adverse finding produces consequences: "If you do an audit and nothing happens, that's audit washing."
For investors, the question is how much of the $7.7 billion 2028 figure is already in share prices. CrowdStrike and Palo Alto Networks both trade at premium multiples that assume sustained double-digit growth, and the AI-security line is small enough — under $8 billion against a global security market measured in the hundreds of billions — that it will not move consolidated revenue on its own in 2026. What it changes is the growth rate at the margin and the durability of the narrative. The next hard datapoint arrives with CrowdStrike's quarterly results and the fiscal 2027 guidance that accompanies them, when management will have to say whether AI-driven demand is showing up in net new ARR or only in pipeline commentary.
This article is for informational purposes only and does not constitute investment advice.
