Cybersecurity Mid-’26 CISO survey: Al-driven demand continues!

Research evidence excerpt

Cybersecurity Mid-’26 CISO survey: Al-driven demand continues!

t seems to imply CISOs view SSE as a maturing market where functionality across leading vendors

is converging, shifting purchasing decisions toward consolidation rather than incremental expansion. In a tighter spending

environment, organizations are often optimizing existing SSE investments rather than adding new capabilities, which reduces

the urgency of spend growth relative to other security categories.

• CrowdStrike / SentinelOne vs. Endpoint downticking in investment: We believe endpoint security continues to be mission-

critical, and this downtick in growth could run counter to the narrative we heard from the leading vendors at their latest

earnings. They made the case that endpoint demand was actually accelerating, on the back of GenAI generating a renewed

urgency to modernize the remaining ~50% of enterprises that have yet to adopt EDR. The point being that desktop AI Agents

need to be secured, and the endpoint cyber solutions are well positioned to be part of that. We wonder if this is a mixed

signal, with non-adopters being strong net buyers, while existing adopters are already mature and not growing spend. (there

are other priorities because they already have EDR / XDR in place). As a result, spending often centers on renewals, vendor

consolidation, and platform optimization rather than large net-new deployments. CISOs are also directing a larger share of

incremental security budgets toward emerging risks such as AI, identity, and data protection, reducing endpoint's relative

growth profile despite its importance.

• Okta vs. Identity conflicting messages. The narrative is that identity is a critical investment for AI Agent adoption — how