Security budgets are rising faster than almost any other line in technology, and most organizations do not feel safer for it. The reason is rarely the size of the budget. It is that most of the money buys additions, and additions carry a cost that is never on the invoice: every new technology is one more thing that has to be connected, watched and understood.
The Numbers
Gartner projects worldwide spending on information security at $213 billion in 2025, rising 12.5 percent to $240 billion in 2026. At the level of individual organizations the picture is tighter: the 2025 IANS and Artico Search study found security budgets grew only 4 percent in 2025, the slowest rate in five years, while CISO compensation rose 6.7 percent.
Meanwhile, the estate those budgets fund keeps widening. A 2025 study by the IBM Institute for Business Value and Palo Alto Networks found that the average organization runs 83 security solutions from 29 vendors, and that 52 percent of executives say this fragmentation limits their ability to deal with threats. The study was co-sponsored by a platform vendor, which should be weighed, but the direction of its finding is consistent with what most security leaders see every day.
Two Different Acts on the Same Budget Line
| Characteristic | Spending | Investing |
|---|---|---|
| What it adds | A new technology, with its own console, alerts and renewal | A capability that makes existing technologies more useful |
| Value over time | Highest at purchase, then declines | Low at first, then compounds |
| Effect on workload | Adds integration and monitoring effort | Reduces the effort needed to reach a decision |
| What remains if the vendor leaves | Little | Knowledge, process and data the organization keeps |
| How to measure it | Deployment and coverage | Time to detect, time to decide, risk reduced |
Where the Return Actually Comes From
IBM's 2025 Cost of a Data Breach study offers the clearest evidence of what pays back. The global average cost of a breach fell 9 percent to $4.44 million, and IBM attributes the decline mainly to faster identification and containment. The largest single cost category was detection and escalation, at $1.47 million. The organizations that reduced their losses did not do it by owning more products. They did it by knowing sooner and acting faster.
The same study contains a warning. The share of breached organizations planning to increase security investment afterward fell from 63 percent in 2024 to 49 percent in 2025. After a breach, fewer organizations are buying their way out, which suggests many have concluded that more of the same does not work.
The IBM and Palo Alto Networks study makes a related point from the other direction: organizations with consolidated security estates reported detecting incidents 72 days faster and containing them 84 days faster. Whatever one concludes about platforms, the mechanism is the same one IBM measured. Value comes from shortening the distance between a signal and a decision.
The Hidden Cost of the Next Tool
Consider an organization adding its eighty-fourth security product. The license is the visible cost. The less visible costs are the integration work, the new stream of alerts to be triaged, the training, the renewal negotiation, and one more place where the picture of the organization's risk is partly stored. If the new product closes a real gap and its findings flow into the decisions the organization already makes, it is an investment. If its findings sit in their own console, it is spending, however good the product is.
Four Tests Before Any Security Purchase
- Which specific risk to the business does this reduce, and how will we know it did?
- Will its findings reach the people who make decisions, or stay in its own console?
- Does it reduce the time from signal to decision, or add to it?
- What will we still have if we stop paying for it?
A purchase that passes all four is an investment. A purchase that fails the second or third is likely to become part of the fragmentation problem, whatever its individual merits.
What This Means for Budget Decisions
None of this argues against security technology. The organizations that recover fastest depend on good technology. It argues for a different order of decisions: first, how the organization will see its risk as a whole and decide on it; then, which technologies feed that view. Organizations that reverse that order tend to accumulate products faster than they accumulate understanding.
Conclusion
Spending buys a product. Investing buys a shorter path from knowing to acting. The evidence from the industry's own studies points the same way: returns come from detection and decision speed, not from the number of products owned. That is the discipline AQUILA C4I was built to put in place, above the technologies an organization already runs.
Sources
- Gartner, information security spending forecast, July 29, 2025
- IANS and Artico Search, 2025 CISO Compensation Benchmark Report
- IBM Institute for Business Value and Palo Alto Networks, Capturing the Cybersecurity Dividend, 2025
- IBM, 2025 Cost of a Data Breach Report
- Help Net Security, on post-breach investment plans in IBM's 2025 report
- CyberScoop, on the cost categories in IBM's 2025 report