TL;DR
Everyone is pricing in the AI attacker. Almost no one is buying the defense.
That is the short version of what we heard when we ran field research with security leaders this year, from solo practitioners up to Deputy CISOs, Field CTOs, and MSP unit leaders. Urgency about AI is real. It is just not the urgency the market is selling. This article walks through what practitioners told us they actually fear, where the money is really going, and where you should point your own time and budget instead.
Where the AI hype is pushing your money
The pitch is everywhere. AI attackers are faster, smarter, and coming for you, so buy a new tool built to stop them.
The spending backs up the pressure. Gartner projects worldwide information security spending will reach about $240 billion in 2026, up 12.5% from $213 billion the year before. Software and platforms now take the biggest slice of the average enterprise budget at roughly 40%, ahead of personnel. The money is moving, and the market keeps aiming it at the attacker frontier.
There is one problem. When we asked practitioners what actually tops their quarter, almost no one named defending against AI attackers.
What security leaders told us when no one was pitching
We ran moderated interviews first, then showed the same leaders real messaging to see what landed. The pattern held at every company size.
71% raised the grunt work, the alert volume, and the burnout on their own, without being prompted. Stated AI urgency averaged 3.4 out of 5, but only about 14% tied that fear to an actual purchase. Every frontier-AI user we spoke to discounted the attacker story.
So the urgency is real, but it points inward. The AI money that is moving goes to governing the organization’s own adoption of AI, shadow AI, agent sprawl, procedure gaps, not to a shield against some new attacker. The fear the market sells and the budget practitioners actually release are two different things.
The old problems did not go away. AI made them heavier.
AI did not hand security teams a brand new problem. It made the oldest one more urgent.
The same lean team now faces faster, higher-volume, AI-assisted attacks. The alert queue was already the thing breaking people. Most teams still triage by hand, most alerts are noise, and analyst burnout was already driving good people out of the role. AI just turned up the pressure on a system that was already underwater.
The attacker is not a new enemy. The grunt work is the old one, and it is the one draining your hours from the inside.
5 findings from the field research study
We pulled five findings out of the study. Read together, they stop being separate points and describe one way of working.
1. The problem is operational load, not the attacker. 71% raised grunt work, alert volume, and burnout unprompted. Only about 14% tie AI-attacker fear to a purchase. Relief from the load is what teams actually feel, and it is the language budget gets approved in.
2. The AI money is already pointed inward, at governance. 57% carry a live governance concern right now. Every buyer in-market today is buying for governance, consolidation, or workload economics. Governance is where the AI budget moves.
3. Capacity pressure tracks the ratio, not the company size. A four-person team serving ten thousand staff feels the squeeze as sharply as a lean unit inside a large enterprise. Address the workload and every segment sees itself. Address team size and people opt out.
4. The one gap nothing in the stack closes is offense to defense. A continuous loop between attacking and defending drew positive reactions in 86% of sessions, with a “show me” attached to every one. A once-a-year pentest is not this.
5. Governance is the condition of entry. Proof is the only currency. Human approval was the most-repeated condition for letting AI act. 86% of decisions came down to hands-on proof, and everyone wanted to start with a single use case before expanding.
The full study covers each finding in depth, with the belief-behavior gap charted and the interview evidence behind every number.
Read The Security Practitioner’s Guide to AI Hype
The grunt work is more urgent than ever. Here’s what actually closes the gap AI attackers open.
Where to actually put your budget and time
Navigating the hype is about aiming time and money at the moves that compound. Five of them matter more than anything a vendor leads with.
Fund throughput, not fear. Buy back analyst hours by clearing the grunt work first, and measure the win in hours returned and time to resolve.
Correlate before you collect. Your signals already exist, scattered across tools. The next gain is a layer that connects the SOC, cloud posture, AppSec, and offensive testing into one picture, not another false-positive feed to watch.
Make validation continuous. Retire the once-a-year pentest and keep a standing view of your real, exploitable exposure, routed straight into hardening.
Govern every automated action. As you let AI act, require human approval, audit trails, and reversibility. In this market, governance is the near-term reality.
Add capacity above the stack. Raise the output of the team you have without a rip-and-replace.
The gates and the questions
Before you let any AI execute, the panel’s buyers required four gates. Ask for a human in the loop on every action. Ask for evidence an auditor accepts, exportable and immutable. Check certifications on the vendor’s own site before the first call. Confirm the regulatory path under your own framework first.
Then run every pitch through six questions. Does it reduce work, or add a tool? Where does it sit, above your stack or in place of it? Can I see real, validated exposure? Is the automation actually governed? Does it connect my domains into one picture? How fast can I prove it, in my own environment?
The hype sells another console, a rip-and-replace, a risk score with no proof, and a six-month rollout. Substance shows fewer measured hours, something that augments what you own, exposure you can validate, and proof live in days.
How Secure.com fits
Secure.com is built for the problem practitioners actually named: the hours your team loses to grunt work.
It works through governed AI Security Teammates that do real security work across the SOC, Cloud Security, AppSec, and offensive security. They sit above the stack you already own and run inside the permissions, approval thresholds, and audit trails you define. The Red Teammate proves what an attacker can actually exploit. The defensive Teammates harden it and verify the outcome. Every consequential action pauses at a human approval gate, and every decision is logged and reversible.
You start with one Teammate and one function, then expand once you see the hours come back. Governed defense, powered by offense.
