The aggregate numbers for 2026 security spending look uniformly healthy. Gartner’s second-quarter forecast puts worldwide end-user information security spending at $248.9 billion, a 12.7% increase year over year, following $213 billion in 2025. Marsh, surveying more than 2,200 cybersecurity leaders across 20 countries, found 66% planning to increase cyber risk prevention investment over the next twelve months, with more than a quarter planning increases above 25%.
Then you look at data protection specifically, and the picture fractures. Veeam’s 2026 Data Trust and Resilience Report, drawing on 900-plus senior IT, security and risk leaders, found 49% increased cybersecurity budgets year over year while 51% held flat or cut. Roughly half of this market is not participating in the growth story at all.
That split matters because the same survey measured what happened to those two groups when they were attacked. The organizations that increased budgets were about 2.5 times more likely to fully recover all affected data after an incident — 40% versus 16%. The gap between the halves is not cosmetic.
What the growth categories are, and what they are not
The fast-growing lines in Gartner’s forecast are worth knowing precisely, because most of them are not backup. Cloud security posture management leads all 41 tracked categories at a 33.4% growth rate. Securing AI is the only accelerating segment, growing 16.3% in 2026 against a projected 20.1% by 2030. Security software overall is the fastest-growing segment, driven by the continued shift from on-premises to cloud-delivered controls.
None of those categories restore data. This is the structural tension in a 2026 data-protection budget: the money is flowing toward preventive and posture tooling in cloud and AI environments, while the survey evidence from Sophos and Veeam keeps pointing at recovery as the control that determines incident cost. Sophos put average recovery cost per incident at $1.7 million, up 11% year over year, excluding any ransom paid. That bill is landing on teams whose budget line grew slower than the CSPM line next to it.
Marsh’s respondents named their three main spending priorities as security technology and mitigation, incident response and preparation, and hiring. Incident response and preparation is the one that overlaps with recovery capability — and it is the middle item, not the first.
The line items that correlate with actually recovering
The most useful budget guidance in any of this year’s surveys is not a product category. Veeam compared what the increased-budget cohort did differently, and the differences were overwhelmingly instrumentation and process rather than storage:
- Tracking RTOs: 78% of the increased-budget group, against 56% of the flat-or-decreased group
- Tracking time to isolate or contain an incident: 47% versus 36%
- Automated or orchestrated recovery: 32% versus 14%
The orchestration gap is more than double, and it is the one most tightly coupled to outcome. Veeam’s population recovered an average of 72% of affected data, with 44% recovering less than three quarters — the signature of manual, dependency-ordered restore work performed under time pressure. Orchestration is what converts a documented runbook into a repeatable result. It is also, conveniently, a software and engineering-time cost rather than a capital storage purchase, which makes it available to teams whose budget did not grow.
The pattern across all three findings is that the higher-recovery group measures recovery. That is not a spending recommendation so much as a sequencing one: instrument first, because you cannot justify the next purchase without knowing which part of the restore is slow.
Regulation is doing some of the arguing
Part of the 2026 increase is not discretionary. The EU’s Digital Operational Resilience Act and NIS2 both push spending toward demonstrable operational resilience and outage reduction rather than toward perimeter controls, and both attach consequences to failure that a CFO can read. For organizations in scope, this has quietly changed the internal politics of a backup budget request — recoverability has become a compliance obligation with an audit trail, not an infrastructure preference.
Third-party exposure is the other external forcing function. Marsh found that seven in ten organizations experienced at least one material third-party incident in the preceding twelve months. For data protection, the relevant consequence is that recovery scope now routinely includes data held or processed by someone else, under contracts that may specify availability but rarely specify restore testing.
Where the AI line item bites data protection
The AI spending surge is usually framed as a security problem, but the Veeam data describes it as a scope problem for recovery. Forty-three percent said AI adoption is outpacing their ability to secure data. Forty-two percent reported limited visibility into all the AI tools in use. Forty percent said security policies have not been updated for AI risks, and 25% named shadow IT and unauthorized AI tool usage as a primary concern.
An organization with partial visibility into its AI tooling has an unknown quantity of business data — vector stores, fine-tuning corpora, retrieval indexes, working data inside unsanctioned services — that no backup policy covers, because no inventory lists it. Budgeting for AI security while leaving AI-adjacent data outside backup scope produces exactly the partial-recovery outcome the same report measures. Discovery is the cheap fix here and it is rarely anyone’s line item.
A defensible allocation for the flat-budget half
If the budget did not grow — which describes 51% of Veeam’s respondents — the evidence points to a specific ordering, because the interventions that correlate with recovery are mostly not the expensive ones:
- Instrument what you already run. Track RTO attainment and restore duration per workload. This is the single largest behavioural difference between the 40% and 16% recovery cohorts, and it costs engineering time rather than capital.
- Close the identity path to the recovery tier. With Sophos attributing 79% of ransomware attacks to identity-based initial access, a repository reachable by a production credential is inside the blast radius. Separating backup console authentication and making retention locks non-revocable by the backup service account are configuration changes, not purchases.
- Extend backup scope to the data discovered in step one’s blind spots — AI tooling, SaaS, and third-party-held data — before buying more capacity for the data you already protect.
- Then automate recovery. The 32%-versus-14% orchestration gap is where the remaining outcome difference sits, and it is the first item on this list that genuinely needs budget.
The headline is that data-protection spending is rising. The finding underneath it is that half of organizations are flat, and that the half achieving full recovery is distinguished less by what it bought than by what it measured. For anyone writing next year’s request, the 40%-versus-16% recovery figure is the most persuasive sentence in this year’s research — and the cheapest way to move toward the right side of it is to start recording how long a real restore takes.
Sources: Gartner, information security spending forecast (2Q26: $248.9 billion for 2026, up 12.7%; $213 billion in 2025). Veeam, Data Trust and Resilience Report 2026 (900+ leaders). Marsh cyber survey (2,200+ cybersecurity leaders, 20 countries). Sophos, The State of Ransomware 2026.