Why you may want to question how your security budget is being spent | Tech Radar

Overview

News, deals, reviews, guides and more on the newest computing gadgets

Start exploring exclusive deals, expert advice and more

Details

Unlock and manage exclusive Techradar member rewards.

Unlock instant access to exclusive member features.

Get full access to premium articles, exclusive features and a growing list of member rewards.

Why you may want to question how your security budget is being spent

Turning AI security spend into measurable business value

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Nytt DDo S-rekord (Image credit: Shutterstock / Zinetro N)

Cybersecurity budgets are rising fast. Organizations are increasing cybersecurity spend, with many expecting double-digit growth in 2026. AI is a major reason why.

But bigger budgets do not prove better security. They prove that organizations are spending, yet boards are now asking the more uncomfortable question: ‘what is that spend actually buying?’

The Human Risk Reckoning: Why security must evolve for an AI-augmented workforce

The AI trust advantage: How smarter security wins customer confidence

Friend or foe? AI: The new cybersecurity threat and solutions

AI has become the top driver of security investment, but it is also the easiest line item to challenge when budgets tighten. Everyone wants to say they are investing in AI. Far fewer can explain how that investment reduces risk, improves resilience, or delivers results the business can measure.

This is the core problem. Security leaders still rely too heavily on operational metrics to justify investment. Mean time to detect. Mean time to respond. Ticket closure rates. Useful metrics for running the function, yes. Convincing in the boardroom, not especially.

Boards do not fund faster queue management. They fund measurable risk reduction.

Traditional security operations at breaking point

The old model is under pressure from every side. Enterprises are no longer defending only human users. They are now managing digital workers and AI agents operating across systems, data, and APIs. That expands the attack surface and introduces a new category of insider risk.

At the same time, attackers are using AI tools to move faster. Threat detection, investigation, and response (TDIR) are being accelerated on the adversary side, while many defenders are still relying on workflows built for human speed.

Enterprises are now deploying both human employees and digital workers. It is becoming more common for AI agents to be leveraged across systems, data, and APIs and this opens the door for insider risk. Add in more data, more noise, and less context, and the result is obvious: the traditional SOC is running out of road.

This is why simply automating existing workflows is not enough. Faster bad process is still bad process. More tooling does not equal more control.

You can’t firewall a conversation: how AI red-teaming became mission-critical

How AI-powered threats are rewriting email security economics

Maintaining cyber control when AI can act autonomously

Without strong governance, human oversight, and outcomes-based measurement in place, organizations risk spending more while the boardroom struggles to understand AI tooling and how to effectively report on measurable business outcomes.

Organizations that fail to expand beyond automating current models or existing workflows will not solve these rising challenges. Overcoming these core security problems demands a new security model built around adaptability, context, and continuous reasoning that applies to every layer of defense.

The organizations that get value from AI will be the ones that focus less on automation theatre and more on accelerated security operations.

That means proving improvement over time through things the board actually cares about: fewer repeat incidents, stronger control coverage, faster remediation, and fewer threats slipping through unnoticed.

Organizations can achieve this by measuring how effectively they are lowering risk over time. This requires a few shifts:

First, human-agent teaming. AI should improve analyst judgement and decision speed, not replace accountability. Collaboration between human analysts and AI agents helps organizations turn AI investment into controlled, measurable value by ensuring agents operate within policy and business priorities.

Instead of spending more on automation, organizations can show that budgets are improving decision speed, extending analyst capacity, and strengthening governance without losing human accountability.

Second, agent behavior analytics. If digital workers are part of the operating environment, their behavior needs to be monitored like any other risk-bearing actor.

Behavioral analytics for AI agents help protect the value of rising security budgets by giving organizations visibility into what’s normal for AI agents and how digital workers behave, where they deviate, and the risks they introduce.

The visibility delivered by these analytics means AI spending is more likely to minimize risk, rather than increase automation at the surface level.

Third, continuous security optimization. Budgets should show ongoing reduction in exposure, not isolated bursts of efficiency. Organizations can show that spending is improving defensive posture over time by continuously identifying gaps, tuning detections, and prioritizing investments.

Fourth, better data architecture. Security teams do not need more noise. They need the right context at the right moment. In budget terms, this supports better resource allocation, stronger scalability, and more effective AI-driven operations.

The boardroom test is getting simpler. The question is no longer: ‘did you buy AI?’ or ‘did the SOC get faster?’ But: ‘did the investment reduce risk in a way the business can defend?’

For business leaders, this provides direction to ensure rising cybersecurity budgets translate into stronger oversight, measurable risk reduction, and real business resilience. The shift to accelerated security operations represents a fundamental change in how organizations approach cybersecurity investment.

The next era of security operations will not just be defined by spend, but by the effectiveness of ongoing investments and their ability to produce measurable outcomes.

We've featured the best endpoint protection software.

This article was produced as part of Tech Radar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of Tech Radar Pro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

You must confirm your public display name before commenting

1 Experts warn of 'highly sophisticated' weaponized JPEG campaign used to send out Screen Connect malware

2 Google's Android Show: start times and expected Android 17 updates

3 Rivals season 2 episodes 1-3 release date and time on Hulu and Disney+

4 Sony's new headphones leak again in very official-looking and clear renders

5'The biggest AI opportunity is not replacing people': How Open Claw is empowering the next wave of successful SMBs

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

Key Takeaways

News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Unlock and manage exclusive Techradar member rewards
Unlock instant access to exclusive member features
Get full access to premium articles, exclusive features and a growing list of member rewards