The confidence gap
Security leaders face a difficult balancing act: confidence in preparedness is weakening, regulatory demands are growing and managing emerging risks is becoming more time-intensive. The year-on-year findings reveal where expectations and organisational capabilities are beginning to diverge.
Introduction
The past 12 months has gone by in the blink of an eye. The breakneck speed of AI innovation is creating new risks as rogue agents run amok, and threat actors delegate more steps in the kill chain to machines. New regulations have landed, like the EU Cyber Resilience Act, which will change the way organisations think about business resilience. And others, like the long-awaited UK Cyber Security and Resilience Bill, get ever closer.
All of this comes amid another torrid year for CFOs as geopolitical instability pushes inflation back up, and economic uncertainty returns. The share of our respondents expecting cyber spend to rise over the coming year (across 18 categories) has fallen from 65% last year to 50% in 2026, although very few expect cuts.
Amid the volatility there is also a great deal of continuity. AI governance remains a significant challenge. Businesses still think they’ve adopted new technologies too quickly without putting the right guardrails in first. And they still fret about employee misuse.
Yet amid the volatility there is also a great deal of continuity. AI governance remains a significant challenge. Businesses still think they’ve adopted new technologies too quickly without putting the right guardrails in first. And they still fret about employee misuse. Supply chains remain a huge area of cyber risk that organisations have yet to get to grips with. And incident response (IR) efforts continue to stagnate, with little progress made. Many security challenges, priorities, employee mistakes and incident types are cited in similar numbers this year to last.
How do you expect your company’s information security spend to change in the next 12 months
(combined total across 18 areas surveyed)
Year-on-year comparison of expected information security spend to change (2026 vs 2025)
What’s changed from 2025?
Yet some challenges are evolving. The share of respondents who think senior leadership still treat compliance as an afterthought has risen from 48% in 2025 to 53% in 2026. It illustrates a trend mirrored elsewhere in the research; of muddled accountability and disengaged boards.
This is not what regulators expect. They are increasingly demanding strong leadership and clear ownership of cyber resilience. What they’re getting is fewer organisations that can claim to have a clear, well-communicated security strategy (82%, down from 86%).
When senior leaders treat compliance as an afterthought, gaps emerge between policy and practice. Security, privacy and AI governance end up in silos. And resilience suffers. It’s telling that the share of respondents claiming to be “very confident” in responding to a major incident dropped from 61% in 2025 to 41% this year. Confidence fell in both the UK and the US, across companies of all sizes. The overall percentage claiming their confidence levels increased over the past 12 months was down 18 points to 57%.
Regulators are increasingly demanding strong leadership and clear ownership of cyber resilience. What they’re getting is fewer organisations that can claim to have a clear, well-communicated security strategy.
To what extent do you agree with the following statements about the information security landscape? (Year-on-year comparison)
Organisations are also finding compliance with regulations and industry standards more challenging. Nearly two-fifths (38%) of respondents attest to this, versus a third (34%) last year. And 70% complain that regulatory change makes compliance harder, up from 67%. The share that strongly agree they have a clear security strategy fell from 48% last year to 39% in 2026. And those claiming to understand which regulations apply dropped from 52% to 41% over the period.
AI governance remains a key challenge. The share of respondents admitting they adopted the technology too quickly barely moved (from 54% to 52%). And the percentage citing unapproved GenAI use (37% to 35%) also stayed flat. There’s clearly work still to do in order to improve visibility and control in this area.
Ready for the future
Budgets for security and compliance are holding up, even if growth is more measured than last year. Around half of respondents still expect to increase spending on compliance (49%), security strategy and planning (52%) and IR (51%) next year, and 57% expect to spend more on AI governance and policy enforcement.
In every area we surveyed, only 5-8% expect cuts, much the same as in 2025. What has changed is the pace. Fewer expect increases than last year, when 63% anticipated a rise in spending, and most of that shift has been towards budgets holding steady rather than falling. And across the areas we surveyed, around one in eight still anticipate rises of more than 25%. Organisations are continuing to invest, they’re simply being more deliberate about where.
And the case for that investment is growing. Seven in ten respondents say regulatory change is making compliance harder, and reducing manual compliance was the only top priority to gain ground on last year (14% to 17%), a sign that teams are looking for ways to keep pace with regulation without adding to their workload. That creates real opportunities for those keen to streamline compliance and boost resilience. This isn’t just about avoiding fines. It’s about creating a sustainable foundation for future growth.
Around half of respondents still expect to increase spending on compliance (49%), security strategy and planning (52%) and IR (51%) next year, and 57% expect to spend more on AI governance and policy enforcement.
How do you expect your company’s information security spend to change in the next 12 months, in the following areas?
