AI accounted for 3% of the average security budget in 2026, the first year it was tracked as a standalone spending category, according to IANS Research. The same research shows most CISOs are using AI to keep team size steady while taking on more work, not to cut security positions.
For small businesses, the change shows up in practical terms. Security vendors are charging more for AI features, routine monitoring work can be automated, and some teams are building small in-house tools to cover gaps that commercial products miss. Budget owners and office managers should check where their technology spending is going and whether automation is freeing staff to handle the issues that still require human judgment.
What AI now means for the security budget
IANS Research reported that AI accounted for 3% of the average security budget that year. Combined with other software spending, it represented 35% of the budget, up from 29% in 2025.
That puts AI and other software spending two percentage points behind staff and compensation, which remained the largest budget category at 37%. When IANS asked where CISOs planned to direct net-new security spending, 69% selected AI for security. Security operations automation ranked second at 51%, followed by zero trust architecture at 45% and identity and access management improvements at 39%.
Security leaders are also finding that many vendors have added AI capabilities to existing products while raising prices. In the IANS research, increases in some security budgets went almost entirely toward keeping pace with vendor price changes. Smaller, fast-growing vendors are drawing attention because some CISOs believe their tools address problems mainstream products handle poorly. Buyers are watching which of those vendors remain stable or are acquired before adding them to their stacks.
That uncertainty is leading some security teams to build internal tools. Some are using vibe coding for specific security problems that have no neat vendor solution. This approach takes up operational cycles and potential budget in terms of tokens.
How AI is changing security team work
Security teams are using AI to process work that had accumulated without enough staff time. Common examples include processing alerts that teams never would have gotten to and prioritizing them, gathering third-party questionnaires and analyzing them for trends and action items, and making sense of data that security teams have been gathering and documenting and logging across a variety of disciplines. AI can also help analysts move from questionnaires to interviewing peer CISOs and figuring out what the risk looks like.
After teams can see the alerts, risks and documentation gaps they missed before, they may need to find the time and money to address them. Many security programs can identify risks and documentation gaps faster than they can address them.
The staffing response is not centered on layoffs. Most CISOs expect their teams to remain about the same size while taking on more work. AI is being used to automate tier-one security operations center tasks and some faster tier-two tasks. Moving fast to upskill entry-level and more inexperienced employees lets them start making more thoughtful decisions and be a little more strategic, while freeing time for more senior employees to take on a wider range of tasks.
Nick Kakolowski, senior director for CISO research at IANS, said the research indicates that most CISOs do not expect to reduce their teams because of AI. They expect to reorganize and reskill staff so the existing team can cover more ground.
What this means for a small-business IT setup
Consider keeping decisions about unusual activity and other higher-risk exceptions with trained staff.
If a managed security or software provider adds AI features through an annual renewal, review the increase separately from new requirements. Consider comparing the added capability with the increase in the existing service price.
Small internal tools can help where a commercial product does not fit a narrow requirement. Consider deciding who owns the code, how it is updated and what happens when its creator leaves.
The underlying security problems remain familiar. Phishing and social engineering are still among the easiest ways into a network, now with AI-assisted versions. Messy permissions, user roles, secrets management and incomplete data classification continue to create exposure.
What to do now
- Review the next renewal cycle. List each vendor price increase and separate the cost of AI features from other price changes. Check which new capabilities will be used by staff during normal operations.
- Identify suitable routine work. Start with alert triage, log summaries, questionnaire preparation and internal documentation. Keep decisions about unusual activity and other higher-risk exceptions with trained staff.
- Plan the staff skills update. Set aside time for administrators and office managers who will use these tools. Include testing AI-generated code before it enters the production environment.
- Review access and data handling. Check user permissions, secrets management and data classification, which remain common weaknesses even when an organization adds AI tools.
- Set ownership for any internal tool. Document its purpose, maintenance schedule and responsible person if the team builds a small application to cover a gap that a vendor does not address.
FAQ
Are CISOs cutting security jobs because of AI?
No. The IANS research finds that most CISOs do not plan to shrink their teams. The focus is on using AI to automate routine tasks, reskill staff and free senior practitioners for complex work.
What is driving CISO budget changes right now?
Vendors are adding AI features and raising prices, so a large share of new budget is going toward keeping up with the existing stack. CISOs are also evaluating smaller AI-focused vendors and, in some cases, building tools in-house to fill gaps. IANS found that AI represented 3% of the average security budget in 2026.
How is AI changing entry-level cybersecurity roles?
Organizations automate tier-one SOC work and other early-career tasks before more complex roles. Most CISOs expect their teams to develop new skills and change their organizational structure. Some CISOs are considering how to develop a future talent pool as more work is outsourced.