AI agents are creating a second spending boom: the security bill for the first one

Attack speed is becoming the commercial argument

AI does not need to create a new vulnerability to change the economics of intrusion. It can find exposed services faster, personalize social engineering, retry failed approaches, and keep operating across many targets at once.

CNBC reports that a cyber emergency-response company saw its Asia-Pacific caseload double year over year in the first half of 2026. The article also cites research suggesting AI-enabled phishing is around five times more effective than human attempts, raising the expected cost of identity and email compromise.

The market may reward both specialists and the platforms being secured

Gartner expects information-security spending to increase 12.5% in 2026 to 240 billion dollars. Analysts quoted in the report expect dedicated cyber vendors to capture early demand, while hyperscalers can build or acquire security capabilities around their existing cloud estates.

That creates a complicated incentive. The companies expanding the AI stack may also sell customers the controls required to secure it. Buyers need independent evidence that defensive products reduce exposure rather than simply deepen platform dependence.

A bigger budget needs a smaller attack surface

Security spending is an input, not an outcome. Organizations can add dashboards, agents, and subscriptions while leaving excessive privileges, weak identities, exposed APIs, and untested response plans untouched.

The useful measure is whether an attacker can do less, is detected sooner, and can be contained and recovered from more quickly. AI security investment should be tied to those operational results.

• Reduce standing credentials and require strong multifactor authentication.
• Sandbox agents and enforce tool permissions outside the model.
• Test containment against coordinated, long-running attack scenarios.
• Measure time to detect, revoke, isolate, recover, and notify affected people.