Artificial intelligence is rapidly changing the cybersecurity landscape.
Companies are not only using AI to improve security systems—they are also preparing for a new generation of cyber threats powered by increasingly capable AI tools.
That shift is pushing businesses to increase cybersecurity budgets, strengthen AI governance and rethink how they protect sensitive data, applications and digital identities.
Recent research shows just how quickly the trend is developing. BCG reported in August 2026 that 83% of cybersecurity leaders surveyed are spending more on cybersecurity, while nearly nine in 10 had faced cyberattacks during the previous year.
At the same time, cybersecurity companies are reporting strong demand for AI-related security products. Palo Alto Networks recently reported $3.41 billion in quarterly revenue, up 34% year over year, while its next-generation security annual recurring revenue increased 63% to $9.1 billion.
Why AI Is Creating a New Cybersecurity Challenge
Traditional cyberattacks already posed a major challenge for businesses. AI is making the problem more complicated.
Attackers can potentially use AI to automate parts of reconnaissance, vulnerability discovery, phishing, social engineering and other malicious activities.
Instead of relying entirely on manual work, criminals can use automated systems to analyze information and adapt their tactics much faster.
That creates a difficult situation for companies.
The same technology that can help a security team identify suspicious activity can potentially help an attacker find weaknesses more efficiently.
Researchers are increasingly describing AI as something that can participate directly in parts of the attack chain rather than simply being a tool used by humans. Check Point’s 2026 AI Security report describes incidents in which AI was used to automate exploitation workflows with limited human direction.
Companies Are Increasing AI Security Spending
Businesses are responding by putting more money into cybersecurity.
BCG’s latest research found that overall cybersecurity spending grew 12% in 2025, significantly faster than the 7% rate expected previously. The firm also found that most cybersecurity leaders expect AI-related budget increases to continue for another one to two years.
Another 2026 ISG study found that 74% of surveyed organizations had increased investment in AI-specific security tools and solutions, while 69% had increased budgets for monitoring and detecting AI-specific threats.
The numbers point to an important shift: cybersecurity is no longer simply an IT expense.
For many businesses, protecting AI systems is becoming a core business requirement.
AI Is Also Becoming a Security Tool
The story is not only about attackers.
Companies are also using artificial intelligence to defend their networks.
AI-powered security systems can help organizations analyze huge amounts of security data, identify unusual behavior and prioritize potential threats.
Security teams can use AI to assist with:
- Threat detection
- Network monitoring
- Identity protection
- Malware analysis
- Security investigations
- Fraud detection
- Automated response
- Vulnerability management
This is particularly important because modern companies generate enormous amounts of digital information.
Human security teams cannot manually investigate every event.
AI can help security analysts focus on the alerts that appear most important.
The Rise of AI Agents Could Change Cybersecurity Again
One of the biggest technology developments of 2026 is the rapid growth of AI agents.
Unlike traditional chatbots, AI agents can perform multi-step tasks using software tools and external systems.
That can create significant productivity benefits for businesses.
But it also creates another security problem.
If an AI agent has access to sensitive systems, company databases or business applications, a compromised or poorly configured agent could potentially create serious security risks.
BCG says formal AI governance, stronger oversight of AI agents and monitoring for “shadow AI” are among the measures companies can use to manage these risks.
Shadow AI Is Becoming a Business Security Problem
Employees are increasingly using AI tools to summarize documents, generate code, analyze data and automate everyday tasks.
The problem is that some employees may use AI applications without their company’s security team knowing.
This is commonly referred to as shadow AI.
An employee might accidentally upload confidential information into an external AI service or connect an AI application to business systems without fully understanding the security implications.
That can create data-exposure risks.
For businesses, simply blocking AI is becoming increasingly difficult.
Instead, companies are looking for ways to allow useful AI applications while controlling what data and permissions those systems can access.
Why AI-Powered Phishing Is Especially Dangerous
Phishing attacks have traditionally relied on poorly written emails, suspicious links or obvious grammatical mistakes.
AI can make social engineering more convincing.
Attackers can use AI-generated text to create highly personalized messages and potentially adapt their communication to specific targets.
This means employees can no longer depend only on spotting spelling mistakes or awkward language.
Businesses increasingly need stronger authentication, identity protection and automated threat detection.
Passkeys Are Becoming Part of the Defense
Identity security is another area receiving increased attention.
Microsoft announced that beginning September 1, 2026, passkeys are becoming the default authentication experience in Microsoft Entra ID as the rollout reaches organizations.
Passkeys can reduce reliance on traditional passwords and can help protect users against certain types of phishing and credential theft.
The broader trend is clear: companies are moving toward stronger identity-based security as attackers become better at stealing credentials.
Cybersecurity Companies Are Benefiting From the Trend
The increasing demand for AI security is also affecting the technology industry.
Cybersecurity companies such as Palo Alto Networks and CrowdStrike are seeing strong interest from organizations looking to defend against increasingly sophisticated threats.
Reuters recently noted that cybersecurity companies including CrowdStrike and Cloudflare have benefited from the growing demand for digital defenses as AI-related threats evolve.
Palo Alto Networks is also forecasting continued growth, with fiscal 2027 revenue guidance of approximately $14.1 billion to $14.2 billion.
This suggests that cybersecurity could remain one of the more resilient areas of enterprise technology spending.
The Biggest Challenge: AI Is Moving Faster Than Security
The biggest problem may not be the technology itself.
It may be the speed at which AI is evolving.
Companies can spend millions of dollars building security systems, but those systems must continue adapting as AI capabilities change.
A 2026 Thales data threat report found that 70% of surveyed organizations said their AI applications had been targeted by attackers, while 30% reported having a dedicated budget for AI security.
That creates a constant race between attackers and defenders.
Attackers want to automate attacks.
Defenders want to automate detection and response.
And both sides are increasingly using artificial intelligence.
What Companies Should Do Next
Businesses adopting AI should not wait for a major security incident before reviewing their defenses.
Security experts increasingly recommend several basic priorities.
1. Know Where AI Is Being Used
Companies should maintain an inventory of AI tools, models and agents being used across the organization.
2. Protect Sensitive Data
Employees should understand what information can and cannot be entered into external AI applications.
3. Control AI Permissions
AI agents should receive only the access they actually need.
4. Strengthen Identity Security
Companies should adopt stronger authentication methods and reduce dependence on passwords where possible.
5. Monitor AI Activity
Security teams need visibility into how AI systems interact with company data and applications.
6. Prepare for AI-Assisted Attacks
Traditional security training should evolve to include AI-generated phishing, deepfakes and automated attacks.
The Bottom Line
AI is creating a cybersecurity paradox.
It can make companies more productive and help security teams detect threats faster, but the same technology can also give attackers new capabilities.
That is why cybersecurity spending is increasing even as businesses continue expanding their use of artificial intelligence.
The next phase of cybersecurity will not simply be about protecting computers and networks.
It will also be about securing AI models, AI agents, company data and the decisions made by increasingly autonomous software.
For businesses, the message is simple: AI adoption without AI security could become a costly risk.
As AI becomes more deeply integrated into everyday business operations, cybersecurity is likely to become an even more important part of technology strategy through 2026 and beyond.
