Gitnux/Report 2026

Information Security Industry Statistics

308Statistics
95Sources
12Sections
1Visuals
50mRead
Information Security Industry Statistics
Samuel NorbergWritten by Samuel Norberg·Fact-checked by Maya Johansson
Published
How this report is researched
01Editorial Scope

An editor sets the topic, the inclusion criteria, and the evaluation framework before research starts.

02Source Research

AI search agents locate sources and extract each figure together with the document it came from.

Read our full methodology →

Search agents attach provenance to every extracted figure.

Next review: within 39 days

01 Industry overview

The information security industry at a glance

The global information security market is projected to reach $244 billion in 2026, driven by rising threats, regulatory requirements, cloud adoption and the rapid expansion of artificial intelligence.

$244B[16]
Global spending forecast, 2026
12.5%[16]
Spending growth forecast, 2026
54%
North America spending share, 2025
190,650[86]
U.S. information security analysts, 2025
Market size
Gartner projects worldwide end-user spending on information security at $213.025 billion in 2025, compared with $193.408 billion in 2024. A separate Futurum Research estimate puts the broader cybersecurity market at $184.243 billion in 2025.[16]
Forecast & CAGR
Gartner forecasts information-security spending of $239.759 billion in 2026, equivalent to 12.5% growth from 2025. Its February 2026 outlook gives a comparable 2026 estimate of $244 billion and constant-currency growth of 11.6%. Futurum projects the cybersecurity market to rise from $184.243 billion in 2025 to $287.583 billion in 2029, implying an approximate 11.8% CAGR.[16]
Market share & regions
North America is the largest regional market, with projected 2025 revenue of $93.688 billion and 54% of global cybersecurity spending in Futurum Research's estimate. Europe follows at $46.263 billion, APAC at $35.338 billion and Latin America at $8.954 billion.
Segmentation
Gartner divides information-security spending into network security, security services and security software. In 2025, the segments were projected at $23.273 billion, $83.812 billion and $105.940 billion respectively, making security software the largest category.[16]
Trends, drivers & challenges
Gartner identifies rising threats, regulatory pressure, increased security awareness and the expanding use of AI and generative AI as major growth drivers. Verizon's 2025 breach analysis found ransomware in 44% of breaches, vulnerability exploitation as an initial access vector in 20%, and only 54% of perimeter-device vulnerabilities fully remediated during the year.[16][63]
Consumer behavior & competition
Security demand is increasingly shaped by cloud adoption, AI deployment and third-party exposure rather than by consumer purchasing alone. Verizon reported that third-party involvement doubled to 30% of breaches in its 2025 dataset, while IBM found that 20% of studied organizations experienced breaches linked to shadow AI and 97% of organizations reporting AI-related breaches lacked proper AI access controls.[63][11]
M&A
Cybersecurity M&A remained active in 2026: SecurityWeek recorded 33 cybersecurity-related deals announced in August 2026 and reported more than 420 acquisitions announced during 2025. Notable August 2026 transactions included Munich Re's agreed $575 million acquisition of At-Bay and Deel's acquisition of AI cybersecurity company Clarity.[19]
Regulation
U.S. public companies are subject to SEC rules requiring current disclosure of material cybersecurity incidents and periodic disclosure of cybersecurity risk-management, governance and oversight processes. In Europe, the regulatory landscape includes NIS2, DORA and the Cyber Resilience Act, increasing compliance-driven demand for security products and services.[32][87]
Latest news
The latest market outlook available as of November 10, 2026 is Gartner's February 2026 forecast, which projects $244 billion in global information-security spending during 2026 and 11.6% constant-currency growth. Gartner also reports that AI-driven security benefits and securing AI usage are central priorities for the market.[16]

02 Ranking

Top 10 Companies in the Information Security Industry

The leading companies in the information security industry, ranked on market impact, performance, momentum, innovation and brand popularity.

Updated November 10, 2026 · Next review December 10, 2026

Verdict

Microsoft leads Gitnux's 2026 information security ranking with an Overall score of 9.5, with approximately 223,000 employees as of June 30, 2026. Palo Alto Networks is the highest-ranked network cybersecurity provider at 9.3, with $11.48 billion in fiscal 2026 revenue.

Ranked by Overall score · How we score ↓

Editor's top 3 picks

Where to start, by need.

  1. #1 Overall · Leader in cloud identity and endpoint security

    Microsoft

    US

    Ranked #1 · 9.5 · Cloud identity and endpoint security

    Why we picked it: It covers cloud, identity, endpoint and enterprise security, aligning spend with AI-driven security priorities.

    See in ranking ↓Visit microsoft.com ↗

  2. Leader in network and platform cybersecurity

    Palo Alto Networks

    US

    Ranked #2 · 9.3 · Network and platform cybersecurity

    Why we picked it: Its network, cloud, endpoint and AI cybersecurity footprint fits controls for expanding attack surfaces.

    See in ranking ↓Visit paloaltonetworks.com ↗

  3. Leader in enterprise security software

    Broadcom

    US

    Ranked #4 · 9.2 · Enterprise security software

    Why we picked it: It focuses on enterprise security software and mainframe security within software-led security spend.

    See in ranking ↓Visit broadcom.com ↗

Pick 1 is the #1 company overall. Picks 2 and 3 are the highest-ranked companies in the top 5 that add a new segment.

Full ranking

Sort by
Top 10 companies in the information security industry, 2026 – Gitnux ranking
#CompanyOverall ↓Company snapshot
1

Microsoft

Cloud identity and endpoint security · US

9.5
2

Palo Alto Networks

Network and platform cybersecurity · US

9.3
3

Cisco Systems

Network and platform cybersecurity · US

9.3
4

Broadcom

Enterprise security software · US

9.2
5

CrowdStrike

Cloud identity and endpoint security · US

9.1
6

Fortinet

Network security, SASE and security operations · US

9.1
7

SentinelOne

AI-native endpoint, cloud and identity security · US

9.1
8

Cloudflare

Application, network, API and zero-trust security · US

9.0
9

Trend Micro

Endpoint, cloud, network and enterprise security · JP

8.6
10

Netskope

SASE, cloud, data and zero-trust security · US

8.6

How we score

  • Impact (30%): scale and weight in the market (revenue, market share, employees, market position).
  • Performance (20%): recent revenue growth and operating margin; an analyst assessment where a company does not publish them.
  • Momentum (20%): growth trajectory and future potential.
  • Innovation (15%): R&D intensity and how technologically advanced the company is.

Popularity (brand search demand, 15%) counts toward Overall but is not published as a column. Overall leaves out what is not known.

Scale Scores are shown on a 7–10 scale with one decimal; bars start at 7.0.

Cadence Recalculated when new figures are published; next review December 10, 2026.

Independence. Rankings are editorially independent. Scores, ranks, picks and the verdict follow the method above; no company can pay to change them.

Cite this ranking

APA

Samuel Norberg. (2026, November 10). Top 10 companies in the information security industry. In Information Security Industry Statistics. Gitnux. https://gitnux.org/information-security-industry-statistics/#top-companies

report visual · Comparison

Revenue of the largest information security companies

Microsoft leads with $331.8B in annual revenue (group level, converted to USD).

Microsoft$331.8B
Cisco Systems$63.3B
Palo Alto Networks$11.5B
Fortinet$6.8B
CrowdStrike$4.8B
SentinelOne$1.0B
source-verifiedmicrosoft.com · sec.gov · investors.paloaltonetworks.com · investor.fortinet.com · investors.sentinelone.com2026

04 Statistics

Technology & Innovation

AI adoption is visible in testing and operations: 29% of professionals relied entirely on AI automation for vulnerability testing in 2025.

AI in the information security industry

  • 42% of cybersecurity professionals identified using AI for threat detection and response as a key AI competency in 2025.[1]
  • 11% of cybersecurity professionals reported encountering data poisoning attacks against their AI architecture during the year ending in 2025.[1]
  • 23% of cybersecurity professionals reported AI-related data breaches during the year ending in 2025.[1]
  • 25% of cybersecurity professionals reported AI-related data leakage during the year ending in 2025.[1]
  • 72% of cybersecurity professionals in 2025 said AI would create a need for more strategic cybersecurity mindsets.[1]
  • 40% of cybersecurity professionals reported experiencing AI-optimized social-engineering attacks during the year ending in 2025.[1]

Automation in the information security industry

  • 29% of cybersecurity professionals relied entirely on AI automation for vulnerability testing in 2025.[2]
  • 48% of cybersecurity professionals said AI had influenced job satisfaction in 2024.[3]
  • 71% of cybersecurity professionals who reported improved job satisfaction attributed it to automation of tedious tasks in 2024.[3]
  • Two-thirds of security leaders considered AI-based SOC automation important in 2024 and expected it to remain important over the following two years.[4]
  • 82% of organizations using AI in cybersecurity said it was useful for improving SOC threat detection in 2024.[3]
  • 50.4% of security leaders in 2026 identified threat detection and risk triage as the areas most likely to benefit from AI automation.[5]

Digital Transformation in the software and IT services sector (sector benchmark)

  • 54.8% of surveyed organizations reported having a chief digital officer or another executive responsible for digital transformation.[6]
  • 45% of North American technology and business decision-makers planned to adopt AI and machine learning to improve business within 12 to 24 months.[7]
  • 75% of digital leaders globally planned to increase AI-related business expenditure in 2024.[7]
  • 34% of surveyed organizations globally identified replacing or upgrading legacy technology as a top digital-transformation goal in 2024.[7]
  • 72% of digital leaders globally expected to increase technology spending in 2024, compared with 50% of digital laggards, according to a survey of 855 technology and business decision-makers.[7]

Technology Adoption in the software and IT services sector (sector benchmark)

  • 57.7% of surveyed organizations reported having a chief information security officer or equivalent in 2024.[6]
  • More than 50% of surveyed global IT decision-makers were exploring AI use cases or piloting AI technologies in 2024.[7]
  • 51.8% of surveyed organizations reported that AI solutions were somewhat or extremely rare in 2024.[6]
  • 67.6% of IT services were delivered through cloud infrastructure among surveyed organizations in 2024.[6]

Cloud Computing in the software and IT services sector (sector benchmark)

  • 26.1% of EU enterprises using paid cloud services used computing platforms for application development, testing or deployment in 2025.[8]
  • 85.2% of EU enterprises using paid cloud services used them for email in 2025.[8]
  • 65.5% of EU enterprises using paid cloud services used them for security software applications in 2025.[8]
  • 71.7% of EU enterprises using paid cloud services used them for office software in 2025.[8]
  • 71.5% of EU enterprises using paid cloud services used them for file storage in 2025.[8]
  • 52.7% of EU enterprises with at least 10 employees used paid cloud-computing services in 2025.[8]

Big Data in the software and IT services sector (sector benchmark)

  • 14% of enterprises with at least 10 employees across the OECD used big-data analytics on average, based on 2022 data or the latest available year.[9]
  • 40% was the highest reported enterprise adoption rate for big-data analytics across OECD countries in the latest available data through 2023.[9]
  • Big-data analytics adoption averaged 14% among OECD enterprises with at least 10 employees, compared with 49% for cloud computing in the latest comparable data.[9]

05 Statistics

Data & Analytics

SOC and data quality metrics shape operational budgets; 60% of respondents operated a single centralized SOC in 2024.

Business intelligence in the information security industry

  • 58% of cybersecurity decision-makers expected their cyber budgets to increase during the following 12–24 months in 2024.[10]
  • 20% of cybersecurity decision-makers said their CISO reports directly to the CEO in 2024, indicating stronger executive integration of security intelligence.[10]
  • 57% of US respondents said improving threat detection and response was a major expected outcome of cybersecurity initiatives in 2024.[10]
  • 41% of global cybersecurity decision-makers said their boards address cyber-related issues at least monthly in 2024.[10]
  • 30% of US cybersecurity decision-makers said their boards discuss cyber-related issues weekly in 2024.[10]
  • 51% of US respondents said increasing efficiency and agility was a major expected outcome of cybersecurity initiatives in 2024.[10]

Data analytics in the information security industry

  • 60% of respondents operated a single centralized SOC in 2024, according to SANS research covering 403 security professionals.[3]
  • 49% of continuously operating SOCs used a follow-the-sun staffing model in 2024.[3]
  • 46% of SOCs partially automated threat hunting with vendor-provided tools in 2024.[3]
  • 76% of SOC respondents said security operations staff could work remotely in 2024.[3]
  • 42% of organizations identified breaches using their own security teams and tools in 2024, up from 33% in 2023.[11]
  • Nearly 25% of organizations were already using artificial intelligence in their cyber threat intelligence programs in 2024.[3]

Data Quality in the software and IT services sector (sector benchmark)

  • In 2025, 34% of organizations globally rated their data excellent for relevance and suitability, across surveyed technology and business organizations.[12]
  • In 2025, 46% of organizations globally rated their data excellent for accuracy and integrity, across surveyed technology and business organizations.[12]
  • In 2024, 95% of enterprise data leaders and practitioners reported a data-quality issue with a direct impact on business outcomes, across companies with at least $1 billion in revenue.[13]
  • In 2025, 43% of organizations globally rated their data excellent for quality and completeness, across surveyed technology and business organizations.[12]
  • In 2025, 35% of organizations globally rated their data excellent for consistency and standardization, across surveyed technology and business organizations.[12]
  • In 2025, 46% of organizations globally said they were fully confident in their data quality, across surveyed technology and business organizations.[12]

Data Governance in the software and IT services sector (sector benchmark)

  • In 2026, 76% of global data leaders said their company’s AI governance did not completely keep pace with employee use of AI technology.[14]
  • In 2024, 32% of global technology leaders prioritized data governance among their data-management areas for the next 12 months.[4]
  • In 2024, 18.3% of organizations reported having a data-governance or catalog solution as part of their governance program, according to a global governance study.[14]
  • In 2024, 35% of U.S. technology executives prioritized data governance among their data-management areas for the next 12 months.[4]
  • In 2024, 61% of supply-management organizations reported having a dedicated data-governance function, based on an Institute for Supply Management survey.[15]
  • In 2024, 81.7% of organizations reported having no data-governance or catalog solution as part of their governance program, according to a global governance study.[14]

KPIs in the information security industry

  • 26% of cyber leaders used threat intelligence to inform security budget and spending decisions in the 2026 SANS SOC Survey.[3]
  • 29% of SOCs partially supported all at-risk operational-technology and internet-of-things systems in 2026.[3]
  • 67% of SOC respondents provided performance metrics to senior management to justify resources in 2024.[3]
  • 16% of organizations had fully automated their incident-response processes in 2024.[3]
  • 38% of SOC respondents said their organization’s security operations budget was unknown in 2024.[3]
  • 48% of organizations used a single integrated detection-and-response team in 2024.[3]

06 Statistics

Strategy & Growth

Spending continues to shift across network security and adjacent categories; Gartner forecasts $239.759 billion in 2026 end-user information-security spending.

Growth in the information security industry

  • 12.5% is the projected growth rate for worldwide end-user information-security spending from 2025 to 2026.[16]
  • 1,178 UK cyber-security firms were classified primarily as service providers, up from 1,088 in the previous study.[17]
  • 27% of UK cyber-security firms were primarily product developers, while 72% were primarily service providers, managed-service providers or resellers.[17]
  • $25.825 billion is Gartner’s forecast for worldwide network-security spending in 2026.[16]
  • $239.759 billion is Gartner’s forecast for worldwide end-user information-security spending in 2026.[16]
  • $83.812 billion was worldwide security-services spending in 2025, compared with $77.130 billion in 2024.[16]

Differentiation in the information security industry

  • 85% of UK micro cyber-security firms were classified as dedicated cyber-security companies rather than diversified firms.[17]
  • 38% of registered UK cyber-security firms offered network security, including perimeter and application security.[17]
  • 21% of registered UK cyber-security firms offered identification, authentication and access-control solutions.[17]
  • 59% of registered UK cyber-security firms offered endpoint or mobile security.[17]
  • 24% of registered UK cyber-security firms offered training, awareness and education services.[17]
  • 83 different security solutions from 29 vendors were used on average by organizations surveyed in IBM and Palo Alto Networks research.[18]

Mergers and acquisitions in the information security industry

  • 8 of the 11 cybersecurity deals above $1 billion in 2024 involved pure cybersecurity companies.[19]
  • 25 cybersecurity M&A deals announced in 2024 were valued between $100 million and $1 billion.[19]
  • 405 cybersecurity-related mergers and acquisitions were announced globally in 2024.[19]
  • $50.75 billion was the combined disclosed value of the 68 cybersecurity acquisitions with reported financial terms in 2024.[19]
  • $3 billion was the announced value of Hg’s 2024 acquisition of AuditBoard.[19]
  • $2.7 billion was the announced value of Mastercard’s 2024 acquisition of Recorded Future.[19]

Strategic partnerships in the information security industry

  • 20% of the largest surveyed MSPs worked with six or more cybersecurity vendors in 2024.[20]
  • 39% of Canadian organizations sought help from government cybersecurity agencies after an attack in the 12 months before the 2024 survey.[21]
  • 70% of Canadian cybersecurity professionals said cybersecurity measures or audit controls were common requirements in third-party contracts in 2024.[21]
  • 35% of MSPs with at least 51 employees worked with one or two cybersecurity vendors in 2024.[20]
  • 75% of MSPs with one to five employees worked with one or two cybersecurity vendors in 2024.[20]
  • 69% was the estimated daily-management-time reduction among MSPs using six or more cybersecurity vendors if they consolidated onto one platform.[20]

07 Statistics

People & Workforce

Hiring constraints remain central to delivery and automation; 50% of cybersecurity organizations reported difficulty retaining cyber talent in 2025.

Hiring in the information security industry

  • 39% of cybersecurity organizations took three to six months to hire non-entry-level staff in 2025.[22]
  • 54% of cybersecurity hiring managers said they had rejected entry- or junior-level candidates because of social-media activity in 2024.[1]
  • 38% of cybersecurity organizations took three to six months to hire entry-level staff in 2025.[22]
  • 89% of cybersecurity hiring managers would consider candidates with only entry-level cybersecurity certifications in 2024.[1]
  • 53% of cybersecurity organizations needed more job specialists for new roles in 2026, up from 23% in 2025.[23]

Employee retention in the information security industry

  • 50% of cybersecurity organizations reported difficulty retaining cyber talent in 2025.[22]
  • 32% of cybersecurity professionals reported feeling overworked because of staffing and skills shortages in 2025.[1]
  • 31% of cybersecurity professionals identified insufficient pay as a job-satisfaction problem in 2025.[1]
  • 74% of fully remote cybersecurity professionals whose work arrangement matched their preference reported being satisfied in 2025.[1]
  • 20% of cybersecurity professionals said they were expected to work long hours in 2025.[1]

Remote Work in the software and IT services sector (sector benchmark)

  • 34.8% of global software and IT services respondents worked remotely in 2026, according to the Stack Overflow Developer Survey.[24]
  • 84% of technology-services employers agreed in 2025 that the ability to work remotely is important for employee retention.[25]
  • 6% of global respondents worked fully remotely in 2025, defined as spending less than one day per week in the office.[25]
  • 10% of technology-services respondents worked under fully flexible arrangements in 2025, allowing employees substantial control over remote work.[25]
  • 48% of U.S. software and IT professionals surveyed worked remotely in 2026, compared with 21% in France.[24]

Hybrid Work in the software and IT services sector (sector benchmark)

  • 56% of IT employees worked in hybrid arrangements in 2025, while 31% were fully remote and 13% attended the office daily.[26]
  • 55% of technology-services respondents worked in a hybrid arrangement in 2025, the highest share among industries measured by Cisco.[25]
  • 52% of U.S. employees with remote-capable jobs worked in hybrid arrangements in May 2026, according to Gallup.[27]
  • 61% of U.S. employees with remote-capable jobs preferred hybrid work in November 2025, compared with 33% preferring fully remote work.[27]
  • 47% of global respondents worked in hybrid arrangements in 2025, down from 63% in Cisco’s 2022 study.[25]

Upskilling in the information security industry

  • 24% of cybersecurity organizations invested in organization-wide security-awareness training to address skills needs in 2025.[1]
  • 91% of organizations believed industry certifications were important for bridging the cybersecurity skills gap in 2024.[28]
  • 60% of organizations considered continuous training essential for maintaining an up-to-date cybersecurity workforce in 2024.[28]
  • 24% of cybersecurity organizations provided cross-training opportunities to develop new skills in 2025.[1]
  • 90% of cybersecurity professionals said their organizations were taking action to address skills deficiencies in 2025.[1]

Employee Engagement in the software and IT services sector (sector benchmark)

  • 74% of respondents approved of fully flexible hybrid policies in 2025, the highest positive sentiment among the policy types Cisco measured.[25]
  • 22.2% of global software and IT respondents were happy with their current professional role in 2026, while 32.6% were unhappy.[24]
  • 92% of employees ranked collaboration and community as very important aspects of office culture in Cisco’s 2025 global study.[25]
  • 54% of exclusively remote U.S. employees were thriving in May 2026, compared with 52% of hybrid employees and 49% of on-site employees with remote-capable jobs.[27]
  • 37% of exclusively remote U.S. employees were engaged in May 2026, compared with 34% of hybrid employees and 29% of on-site employees with remote-capable jobs.[27]

08 Statistics

Customer & Sales

Buyer consolidation pressure appears alongside retention: 13% of customers reported too many gaps in their solutions in 2024.

Customer experience in the information security industry

  • 2.1 endpoint-security solutions were used on average per cybersecurity functional area in 2024.[29]
  • 18% of cybersecurity customers said they had too many vendors and found them complicated to manage in 2024.[29]
  • 13% of cybersecurity customers reported too many gaps in their solutions in 2024.[29]
  • 2.1 application-security solutions were used on average per cybersecurity functional area in 2024.[29]
  • 16% of cybersecurity customers reported too many overlapping solutions in 2024.[29]

Customer retention in the information security industry

  • 114% was Cloudflare’s dollar-based net retention rate in the second quarter of 2025.[30]
  • 13 years was the approximate customer lifetime implied by a 92% average gross-retention rate among cybersecurity companies in 2025.[31]
  • 85%–98% was the typical gross-retention range for cybersecurity companies as of January 15, 2025.[31]
  • 112.8% was WalkMe’s net-retention rate at December 31, 2025, up from 111.9% a year earlier.[32]
  • 107% was Tufin’s customer net-retention rate in 2025.[33]

Customer acquisition in the information security industry

  • $345 was the reported average organic-channel acquisition cost for a cybersecurity customer in 2026.[34]
  • $805 was the average blended acquisition cost for a small-business cybersecurity customer in 2025.[34]
  • 64.8% of large-company cybersecurity buyers preferred direct vendor purchasing in the 2025 buyers report.[34]
  • $512 was the reported average paid-channel acquisition cost for a cybersecurity customer in 2026.[34]
  • 46.7% of cybersecurity buyers said IT management makes the final purchase decision in the 2025 buyers report.[34]

Customer loyalty in the information security industry

  • 71 was Tufin’s Net Promoter Score in 2025.[33]
  • 47% of SSH PrivX customers said they would readily recommend the cybersecurity product in 2024.[35]
  • 4.6 out of 5 was SensorFu’s average customer-success score in its 2026 survey.[36]
  • 63 was Inprosec’s Net Promoter Score from its cybersecurity customer survey reported in 2024.[37]
  • +94 was SensorFu’s Net Promoter Score from its 2026 customer-success survey.[36]

Lead generation in the information security industry

  • 22.8% deeper nurture engagement was recorded for cybersecurity accounts with both G2 intent and INFUSE engagement.[38]
  • 31% was the reported lead-to-marketing-qualified-lead conversion rate for First Page Sage cybersecurity clients.[39]
  • 40% of cybersecurity sales-qualified leads became opportunities in the 2025 funnel data.[34]
  • 21.9% of cybersecurity free-trial users converted to paid accounts in 2025.[34]
  • 7.4% of cybersecurity website visitors started a free trial in 2025.[34]

09 Statistics

Marketing & Brand

Demand signals are tied to content and publications, with 55% of U.S. cybersecurity buyers citing case studies, webinars and news articles as more effective than fear-based marketing.

Marketing in the information security industry

  • 18% of cybersecurity vendors’ marketing budgets went to public relations and media liaison in the last financial year surveyed.[40]
  • 53% of technology marketing executives said budget changes in 2024 were made to invest in marketing automation and artificial intelligence.[41]
  • 19% of technology marketers reported significant marketing-budget increases of 20% or more in 2024, including respondents from cybersecurity companies.[41]
  • 78% of cybersecurity companies received an increase in marketing budget in 2024, the highest share among technology industries surveyed globally.[41]
  • 64% of technology marketers reported increased marketing budgets in 2024 across the surveyed markets, including cybersecurity companies.[41]

Digital marketing in the information security industry

  • 17.2% of cybersecurity marketing respondents planned to decrease direct-marketing spending in 2024.[42]
  • 33% of U.S. cybersecurity buyers ranked articles in cybersecurity, technology and business publications as their most-used purchase resource in 2021.[43]
  • 55% of U.S. cybersecurity buyers said case studies, webinars and news articles were more effective than traditional fear-based marketing in 2021.[43]
  • 56.7% of cybersecurity marketing respondents considered content marketing the most useful activity in 2024.[42]
  • 10.3% of cybersecurity marketing respondents planned to decrease search-engine-optimization spending in 2024.[42]

Branding in the information security industry

  • 30% of U.S. cybersecurity buyers cited lack of brand awareness as one of the biggest barriers to purchasing from cybersecurity vendors in 2021.[43]
  • 82% of U.S. cybersecurity buyers purchased cyber products directly from vendors all or some of the time in 2021.[43]
  • 50% of U.S. cybersecurity buyers who did not purchase directly from vendors used managed-service providers in 2021.[43]
  • 68% of U.S. cybersecurity buyers felt overwhelmed by the number of cybersecurity vendors in 2021.[43]
  • 52% of U.S. cybersecurity buyers cited fear of data loss as a concern in 2021.[43]

Social media in the information security industry

  • 30% of cybersecurity organizations considered regional spokespeople valuable in 2024.[42]
  • 80% of cybersecurity organizations surveyed in 2024 did not have an active influencer program involving external or internal influencers.[42]
  • 76.7% of cybersecurity marketing respondents considered speaking slots more valuable than award nominations or wins in 2024.[42]
  • 20% of cybersecurity marketing respondents considered award nominations or wins more valuable than speaking slots in 2024.[42]
  • 13.8% of cybersecurity marketing respondents planned to decrease social-media spending in 2024.[42]

Influencer Marketing in the software and IT services sector (sector benchmark)

  • Across technology companies, 64% of marketers reported dedicated and growing budgets for creator or influencer marketing in 2026, according to Nielsen’s global marketing survey.[44]
  • Across B2B companies, 55% of marketing organizations were using influencers in 2025, based on an Ipsos survey of 1,500 marketing leaders.[45]
  • Across B2B companies, another 29% of marketing organizations planned to adopt influencer marketing within the next year in 2025, based on an Ipsos survey of 1,500 marketing leaders.[45]
  • Across B2B companies, 43% of marketers reported outstanding results from their influencer programs in the 2025 B2B Influencer Marketing Report.[46]
  • Across B2B companies, 58% of marketing teams reported using an always-on influencer marketing approach in the 2025 B2B Influencer Marketing Report.[46]

10 Statistics

Operations & Execution

Automation targets incident response at scale: 45% of organizations targeted automation for at least half of incident response in 2024.

Process optimization in the information security industry

  • 24% of cyber leaders named lack of enterprise-wide visibility as the single biggest barrier to leveraging security-operations capabilities, globally in 2026.[3]
  • 45% of organizations targeted automation for at least half of incident response, while another 35% targeted automation for at least 75%, globally in 2024.[3]
  • 53% of respondents identified defending a growing and changing attack surface as their most significant security-operations challenge, globally in 2024.[3]
  • 67% of organizations used mean time to respond and 59% used mean time to detect as security-operations performance indicators, globally in 2024.[3]
  • 59% of respondents cited the need for skilled personnel as the top obstacle to detection-and-response automation, globally in 2024.[3]

Operational efficiency in the information security industry

  • 59% of organizations kept incident response fully in-house, compared with 46% keeping security-operations-center functions fully in-house, globally in 2023.[3]
  • 33% of organizations used artificial-intelligence tools to streamline compliance operations, globally in 2025.[47]
  • 29% of enterprises trained non-security staff to move into security roles, down from 41% the prior year, globally in 2025.[22]
  • 49% of organizations reported reduced manual analysis time and 48% reported workflow-automation gains from artificial intelligence, globally in 2026.[3]
  • 66% of hiring managers ranked industry experience and security certifications among the top candidate attributes for incident-response roles, globally in 2023.[3]

Quality management in the information security industry

  • 21% of organizations did not formally measure the success of software supply-chain security initiatives, globally in 2026.[48]
  • 43% of organizations experienced returning threat actors using the same or similar tactics, techniques and procedures, indicating recurring process weaknesses, globally in 2023.[3]
  • 41% of respondents cited lack of requisite technical skills as a reason for not deploying security automation, globally in 2024.[3]
  • 37% of respondents said matches to indicators of compromise took the longest to triage and investigate, globally in 2024.[3]
  • 37% of organizations measured software supply-chain security success through faster incident-response or remediation time, globally in 2026.[48]

Supply chain in the information security industry

  • 55% of organizations cited budget constraints as a challenge preventing faster adoption of software supply-chain security practices, globally in 2026.[48]
  • 10% of organizations were testing or implementing post-quantum cryptography for code signing, globally in 2026.[48]
  • 71% of organizations used partial or ad-hoc automation for software supply-chain security checks, globally in 2026.[48]
  • 67% of healthcare organizations were very or extremely concerned about cybersecurity risks in their supply chains, globally in 2025.[1]
  • 53% of organizations cited integration complexity with existing tools as a challenge preventing faster adoption of software supply-chain security practices, globally in 2026.[48]

Outsourcing / Offshoring in the software and IT services sector (sector benchmark)

  • Across German digital-experience service providers, 7.6% of services for customer projects were delivered offshore in 2024.[49]
  • Among German IT-service generalists, 19.5% of digital-experience services for customer projects were delivered nearshore in 2024.[49]
  • Across German digital-experience service providers, 13.2% of services for customer projects were delivered nearshore in 2024.[49]
  • Among German IT-service generalists, 10.2% of digital-experience services for customer projects were delivered offshore in 2024.[49]
  • Across EU enterprises sourcing business functions internationally during 2021–2023, 28.7% moved information and communication technology services abroad.[8]

11 Statistics

Finance & Pricing

Budget increases are uneven across orgs: 45% of CISOs received a cybersecurity-budget increase in 2026, while the median increase was 0%.

Pricing strategy in the information security industry

  • 55% growth is forecast for identity-and-access-management services spending as agentic AI adoption increases demand, globally in 2026.[50]
  • $1.874 billion was revenue reported for fiscal 2025 by the same company, representing 6.8% year-over-year growth.[51]
  • $213 billion is the forecast for worldwide end-user spending on information security in 2025.[16]
  • $4.88 million was the average cost of a data breach in 2024, increasing the economic value customers place on security products.[18]
  • $2.1 billion was the annualized recurring revenue reported by a cybersecurity software company for full-year 2025, up 10.9% year over year.[32]

Cost reduction in the information security industry

  • 49% of organizations said technology consolidation was essential or very important for insider-risk management in 2025.[52]
  • 85% of organizations ranked cost savings as a leading reason for technology consolidation in insider-risk management, globally in 2025.[52]
  • 58% of organizations used or planned to use managed security service providers in 2025, up from 47% in 2024, according to Optiv’s survey.[53]
  • 21% planned moderate consolidation of security tools in 2025, according to the Futurum Group survey.[54]
  • 18% of cybersecurity leaders planned minor consolidation of security tools in 2025, according to the Futurum Group survey.[54]

Profitability in the information security industry

  • 2.0 percentage points was the reported year-over-year improvement in gross-profit margin for a publicly listed cybersecurity company in 2025.[55]
  • $65.5 million was GAAP net income reported for full-year 2025 by a cybersecurity company, up 0.5% year over year.[32]
  • $639.1 million was operating income reported for fiscal 2025 by a security-software company, compared with $587.1 million in 2024.[56]
  • $517.2 million was net income reported for fiscal 2025 by the same security-software company, compared with $496.2 million in 2024.[56]
  • $190.0 million in gross profit was reported for 2025 by the same cybersecurity company, up 43.8% year over year.[55]

Financial planning in the information security industry

  • 99% of security leaders at U.S. organizations with at least $1 billion in revenue planned to increase cybersecurity budgets over the following two to three years.[4]
  • 25% of organizations planned security-budget increases of 1% to 5% in 2026, up from 17% in 2024.[57]
  • 1.08% was the mean 2025 security budget as a share of revenue for companies below $1 billion in revenue.[58]
  • 10.9% was the average share of IT spending allocated to security in 2025, down from 11.9% in 2024.[59]
  • 45% of CISOs received a cybersecurity-budget increase in 2026, while the median increase was 0%.[58]

12 Statistics

Product & Service

Managed delivery expands in parallel with adoption; 66% of surveyed organizations already outsourced security services to a managed service provider in Barracuda’s 2026 survey.

Product development in the information security industry

  • $178 billion in total funding had been raised by the 22,300 cybersecurity companies tracked by Tracxn as of June 2024.[60]
  • 22,300 cybersecurity companies were identified globally by Tracxn in June 2024, including 6,370 funded companies.[60]
  • 3% of respondents in the 2025 ISC2 study worked in security software or hardware development, representing a distinct product-development segment of the cybersecurity workforce.[1]
  • 105 cybersecurity unicorns had been created globally by June 2024, according to Tracxn’s industry factsheet.[60]
  • 51% of cybersecurity startups created in 2024 and 2025 offered innovative solutions or secure emerging use cases, particularly involving artificial intelligence.[61]

Product lifecycle in the information security industry

  • 7.61% of observed Information-sector assets were running an end-of-life operating system in runZero’s sector analysis.[62]
  • 20% of breaches analyzed in Verizon’s 2025 DBIR involved exploitation of vulnerabilities, a 34% increase from the prior year.[63]
  • 3.16% of observed Information-sector assets were beyond security support in runZero’s analysis of end-of-life operating systems.[62]
  • 42% of breaches in Verizon’s 2025 DBIR involved compromised credentials, an exploited vulnerability or phishing.[63]
  • 8.56% of enterprise assets observed by runZero were running an operating system that had reached end of life.[62]

After-sales in the information security industry

  • 59% of organizations surveyed by Barracuda expressed concern about artificial-intelligence-related threats and sought provider support.[64]
  • 48% of organizations wanted their MSP to deliver 24/7 security coverage in Barracuda’s 2025 customer insight report.[65]
  • 23% of organizations were actively evaluating or considering outsourcing cybersecurity to an MSP in Barracuda’s 2025 survey.[64]
  • 66% of surveyed organizations already outsourced security services to a managed service provider in Barracuda’s 2026 international survey.[64]
  • 95% customer retention was achieved by Computer Geeks after adding managed-security contracts and Avast Business services.[66]

Value proposition in the information security industry

  • $16.6 million in net present value over three years was estimated for the composite organization using Microsoft Security.[67]
  • 85.7% of CISO survey respondents reported directly measuring or discussing risk reduction, including qualitative measures, when communicating cybersecurity ROI.[68]
  • $167,000 in three-year cost savings was attributed to eliminating legacy point tools and reducing labor costs with CrowdStrike Falcon Identity Protection.[69]
  • 310% return on investment was reported for a composite organization using CrowdStrike Falcon Identity Protection.[69]
  • 57.1% of CISO respondents prioritized business enablement when articulating the return on cybersecurity investment.[68]

13 Statistics

Sustainability & Ethics

Reporting and training targets show in operational commitments; Fortinet achieved 100% renewable-power coverage in 2024.

Sustainability in the information security industry

  • 60% of Check Point’s 2028 goal to train one million people in cybersecurity topics had been achieved by 2024.[70]
  • 12.6% was Check Point’s workforce growth between 2022 and 2024.[70]
  • 70% was the average power-efficiency improvement per throughput threat protection across Check Point’s new Quantum Force branch-office models in 2024.[70]
  • 99% or more of Fortinet’s greenhouse-gas emissions came from Scope 3 activities in 2024.[71]
  • 100% renewable-power coverage was achieved by Fortinet in 2024 through renewable sources and renewable-energy certificates.[71]

ESG in the information security industry

  • 13% of Check Point employees were located in APAC in 2024.[70]
  • 100% of CGI’s covered operational sites had an ISO 27001-certified information-security management system in 2025.[72]
  • 75% of 11,765 publicly listed companies assessed in S&P Global’s 2025 cybersecurity analysis had employee information-security awareness training.[73]
  • 57% of Check Point employees were located in EMEA in 2024.[70]
  • 74 hours was Check Point’s average annual training time per employee in 2024.[70]

Ethics in the information security industry

  • 98% of Check Point employees completed security-awareness training in 2024.[70]
  • 1 reported security vulnerability was disclosed by Check Point to the U.S. Securities and Exchange Commission under its 2024 SASB disclosures.[70]
  • 100% of Check Point employees completed annual GDPR privacy training in 2024.[70]
  • 100% of Check Point employees completed Code of Conduct and Business Ethics training in 2024.[70]
  • 61% of ISACA respondents identified adaptability as a leading qualification for cybersecurity professionals in 2025.[22]

CSR in the information security industry

  • 70% of ISACA respondents expected demand for technical cybersecurity professionals to rise during 2025.[22]
  • 38% of ISACA respondents said entry-level cybersecurity hiring took three to six months in 2025.[22]
  • 1,100 new hires were reported by Check Point for 2024.[70]
  • 7,005 employees and contractors were supported by Check Point’s employment programs in 2024.[70]
  • 18% was Check Point’s increase in corporate donations in 2024.[70]

Carbon footprint in the information security industry

  • 1.004 metric tons of CO2e per million dollars of revenue was Check Point’s market-based emissions intensity in 2024.[70]
  • 74% was Check Point’s reduction in market-based Scope 1 and Scope 2 emissions from 2023 to 2024.[70]
  • 2,576 metric tons of market-based Scope 1 and Scope 2 emissions were reported by Check Point for 2024.[70]
  • 1,606 metric tons of CO2e was Fortinet’s Scope 1 emissions in 2024.[71]
  • 75.4% was Check Point’s reduction in market-based emissions intensity from 2023 to 2024.[70]

15 Statistics

Globalization & Expansion

Cross-region revenue is part of the market’s structure, with North America holding a 54% share of global cybersecurity spending in 2025.

Globalization in the information security industry

  • 43% of Zscaler revenue came from outside the Americas in fiscal 2025.[32]
  • $265 billion is the projected global cybersecurity industry revenue for 2030.[80]
  • 50.4% of N-able revenue came from outside the United States in 2025.[32]
  • $200 billion was the estimated global cybersecurity industry revenue in 2025.[80]
  • 21,921 employees formed Palo Alto Networks' global workforce as of July 31, 2026.[32]

Cultural adaptation in the information security industry

  • 2% of SANS' 2026 cybersecurity workforce respondents were from the Middle East.[52]
  • 56% of SANS' 2026 cybersecurity workforce respondents were from North America.[81]
  • 1,000 information-security decision-makers across six regions participated in Kaspersky's geographically distributed-businesses study.[82]
  • 60% of security decision-makers said monitoring non-headquarters locations was shared between headquarters and local teams.[82]
  • 5% of SANS' 2026 cybersecurity workforce respondents were from Africa.[52]

Supplier management in the information security industry

  • 43% of MSPs and their customers experienced a supplier- or third-party-caused cyber incident during the previous 12 months.[50]
  • 55% of MSPs did not monitor supply-chain risk in the cited 2026 survey.[50]
  • 63% of organizations without a prior supplier-originated incident were very or extremely concerned about supply-chain risk.[1]
  • 11% of MSPs assessed supply-chain risk annually in the cited 2026 survey.[50]
  • 4% of organizations reported having 5,000 or more suppliers in SecurityScorecard's 2026 supply-chain study.[83]

Stakeholder management in the information security industry

  • 21% included boards of directors in healthcare cybersecurity tabletop exercises in 2024.[84]
  • 35% included accounting or finance departments in healthcare cybersecurity tabletop exercises in 2024.[84]
  • 42% included legal departments in healthcare cybersecurity tabletop exercises in 2024.[84]
  • 22% included vendors in healthcare cybersecurity tabletop exercises in 2024.[84]
  • 43% included human-resources departments in healthcare cybersecurity tabletop exercises in 2024.[84]

Distribution channels in the information security industry

  • 93% of Tenable revenue came through channel partners in 2023.[32]
  • 56% of Check Point sales came from its ten largest channel partners in 2024.[32]
  • 94% of Tenable revenue came through channel partners in 2024.[32]
  • 46% of Qualys revenue came through channel partners in 2024.[85]
  • 49% of Qualys revenue came through channel partners in 2025.[85]

Key questions about the information security industry

How large is the information security market in 2026?
Gartner forecasts worldwide end-user spending on information security at $239.759 billion in 2026, and another February 2026 outlook projects $244 billion.
What growth rate is expected for 2026?
Gartner forecasts 12.5% growth from 2025 to 2026, with 11.6% constant-currency growth in its February 2026 outlook.
Which companies lead the information security industry?
Microsoft leads Gitnux's 2026 information security ranking with an Overall score of 9.5, with approximately 223,000 employees as of June 30, 2026. Palo Alto Networks is the highest-ranked network cybersecurity provider at 9.3, with $11.48 billion in fiscal 2026 revenue.
Which technology shifts are changing demand the most?
The market is driven by expanding use of AI and generative AI, with 42% of cybersecurity professionals identifying AI for threat detection and response as a key competency in 2025.
How is spending structured across categories?
Gartner divides spending into network security, security services and security software; in 2025, security software is projected at $105.940 billion, larger than the other segments.
What operational pressures are shaping requirements for buyers?
Verizon’s 2025 DBIR found ransomware in 44% of breaches and vulnerability exploitation as an initial access vector in 20%, increasing remediation and detection demands.
Reference

Cite This Report

This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.

APA
Samuel Norberg. (2026, November 10). Information Security Industry Statistics. Gitnux. https://gitnux.org/information-security-industry-statistics
MLA
Samuel Norberg. "Information Security Industry Statistics." Gitnux, 10 Nov 2026, https://gitnux.org/information-security-industry-statistics.
Chicago
Samuel Norberg. 2026. "Information Security Industry Statistics." Gitnux. https://gitnux.org/information-security-industry-statistics.

Sources & references

95 sources cited across this report

  1. isc2.org
  2. techradar.com
  3. sans.org
  4. kpmg.com
  5. cybersecstats.com
  6. higherlogicdownload.s3.amazonaws.com
  7. teksystems.com
  8. ec.europa.eu
  9. oecd.org
  10. deloitte.com
  11. ibm.com
  12. riverbed.com
  13. anomalo.com
  14. informatica.com
  15. utah.ismworld.org
  16. gartner.com
  17. gov.uk
  18. paloaltonetworks.com
  19. securityweek.com
  20. newsletter.radensa.ru
  21. cira.ca
  22. isaca.org
  23. giac.org
  24. survey.stackoverflow.co
  25. newsroom.cisco.com
  26. computerworld.com
  27. gallup.com
  28. api.gcforum.org
  29. alvarezandmarsal.com
  30. cloudflare.net
  31. marketing.morningstar.com
  32. sec.gov
  33. tufin.com
  34. octoagency.io
  35. ssh.com
  36. sensorfu.com
  37. inprosec.com
  38. sg.infuse.com
  39. firstpagesage.com
  40. coderedcomms.com
  41. 10fold.com
  42. eskenzipr.com
  43. nasdaq.com
  44. brand-news.it
  45. business.linkedin.com
  46. toprankmarketing.com
  47. secureframe.com
  48. digicert.com
  49. luenendonk.de
  50. itpro.com
  51. s25.q4cdn.com
  52. globenewswire.com
  53. optiv.com
  54. securityboulevard.com
  55. content-archive.fast-edgar.com
  56. s202.q4cdn.com
  57. research.etr.ai
  58. bdemerson.com
  59. ians.com
  60. cdn.tracxn.com
  61. wavestone.com
  62. runzero.com
  63. verizon.com
  64. barracuda.com
  65. iteuropa.com
  66. onlinescan.avast.com
  67. microsoft.com
  68. ylventures.com
  69. crowdstrike.com
  70. checkpoint.com
  71. fortinet.com
  72. cgi.com
  73. spglobal.com
  74. static.fortra.com
  75. gtia.org
  76. cdn.sypher.eu
  77. pagerduty.com
  78. ey.com
  79. portal.s1.spglobal.com
  80. statista.com
  81. assets.contentstack.io
  82. kaspersky.com
  83. securityscorecard.com
  84. himss.org
  85. investor.qualys.com
  86. bls.gov
  87. enisa.europa.eu
  88. investors.paloaltonetworks.com
  89. investor.fortinet.com
  90. investors.sentinelone.com
  91. newsroom.trendmicro.com
  92. newsroom.ibm.com
  93. content.naic.org
  94. nist.gov
  95. pages.nist.gov