Spending on securing AI is set to jump almost 70% in 2027

Gartner released the forecast in Sydney on 26 August, but it doesn’t give an Australian figure. It expects spending on securing AI to reach almost US$4.8 billion in 2027, up 68.7% on this year’s US$2.8 billion. By 2028, it forecasts almost US$7.7 billion. That’s nearly triple in two years.

Gartner senior principal analyst Shailendra Upadhyay says it’s driven by enterprises needing to secure their AI systems and deal with new vulnerabilities. Without enough security and visibility controls, he says, enterprise AI projects “face a high risk of failure”.

Upadhyay says “traditional security tools often treat AI applications like any other software”, and they’ll need significant updates to handle AI-specific threats.

He says the need for specialised tools will grow as businesses do more with AI. Autonomous AI’s the big one. He expects it’ll bring new vulnerabilities “beyond the reach of traditional monitoring”.

Gartner predicts that by 2029, over half of successful cyberattacks on AI agents will exploit access control weaknesses and prompt injections.

Its advice is to combine existing security systems with specialised AI security tools.

Gartner splits the market into four main areas: AI application security, AI usage control, AI governance platforms and AI gateways. Application security stays the biggest of the four, at almost US$851 million in 2027.

But it’s AI usage control that grows fastest, up 73% to US$749 million. In plain English, that’s managing how people across a business use AI tools.

Gartner doesn’t expect every segment to play out the same way. In AI governance platforms and AI gateways, which often build on existing enterprise systems for governance, data and API management, it says major vendors are likely to keep their lead by adding AI features. AI application security and AI usage control are another story. They’re seeing a wave of startups.

Upadhyay expects consolidation and acquisitions to follow, with larger cyber security companies buying those startups. So it’ll get crowded fast. Then it’ll narrow.

What clients will still need is a provider who can explain the risk in plain English and stand behind the result.

Take a 300-person accounting firm that’s given its staff an AI assistant. The partners want to know what could go wrong, and who’s watching it. They’d probably pick a provider who can answer both on one page, in words they already use, over one with a longer list of features.

Whoever claims that ground first won’t be easy to shift.