Indian enterprises may need to raise cybersecurity spending to 15-20% of their IT budgets over the coming years as artificial intelligence (AI) expands the digital attack surface and pushes cyber risk into the boardroom, according to industry executives. The shift marks a departure from treating cybersecurity as a technology or compliance expense to viewing it as a strategic investment in business resilience, with boards increasingly focused on operational continuity, regulatory compliance and financial risk.
Current industry benchmarks indicate organisations allocate about 8-10% of their IT budgets to cybersecurity, while sectors such as banking, financial services, insurance and healthcare spend 10-15%.
Market Forecasts
Executives said those allocations are likely to increase as companies deploy AI applications, migrate more workloads to the cloud and navigate a rapidly evolving threat landscape. Gartner estimates end-user spending on information security in India will reach $3.4 billion in 2026, up 11.7% from the previous year, with industry estimates pointing to sustained double-digit growth driven by AI adoption, data protection requirements and expanding digital infrastructure.
The growing use of AI is creating new security challenges for enterprises even as cybercriminals use the technology to launch increasingly sophisticated attacks. Companies are now securing AI models, cloud workloads and hybrid IT environments alongside traditional enterprise infrastructure, prompting a rethink of cybersecurity investments.
“The demand for cybersecurity visibility tools is growing rapidly as organisations seek to eliminate the increasing number of blind spots across AI-driven, hybrid IT, and operational technology environments,” Chetan Jain, managing director, Inspira Enterprise, said.
The changing threat landscape is also reshaping boardroom conversations. Rather than focusing solely on preventing attacks, company boards are placing greater emphasis on business continuity, recovery capabilities and resilience, recognising that cyber incidents can have direct financial, operational and reputational consequences.
“Cybersecurity has moved from the server room to the boardroom. Boards now see cyber incidents as carrying direct financial, regulatory and reputational consequences, not just IT risk,” Sunil Sharma, managing director and vice-president, sales (India & SAARC), Sophos, said.
As a result, organisations are increasingly measuring cybersecurity through business-centric metrics such as incident response readiness, recovery capabilities, Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR), rather than simply the number of security tools deployed.
“Cybersecurity is no longer viewed as an IT issue; it is now a business risk and resilience priority. Boards are taking a far more active role as ransomware, AI-powered attacks, regulatory mandates and supply chain risks increasingly impact business continuity and reputation,” Dipesh Kaura, country director, India and Saarc, Securonix, said.
Moving Beyond Point Tools
The shift is also changing enterprise buying behaviour. Instead of investing in multiple standalone security products, organisations are consolidating spending around integrated, AI-powered platforms that combine prevention, detection and response. Managed detection and response (MDR), identity security and cloud security are emerging as some of the fastest-growing investment areas as enterprises seek greater visibility across increasingly complex IT environments.
“The clearest shift is away from buying individual products toward buying integrated, outcome-based platforms. Organisations are consolidating endpoint, network and cloud security with detection and response into unified solutions, rather than managing a patchwork of point tools,” said Jaydeep Singh, general manager for India at Kaspersky.
Even as cybersecurity becomes a permanent boardroom priority, executives said many organisations, particularly outside highly regulated sectors, still need to align investments with an expanding digital attack surface, making cyber resilience one of the fastest-growing areas of enterprise technology spending over the next few years.