Cyber Security Market

USD 4.99 million against USD 228.21 billion: the first figure is the average cost of one data breach in IBM’s 2026 Cost of a Data Breach study, the second is what the whole cyber security market collected in 2025. The cyber security market covers the hardware, software and services that protect networks, endpoints, cloud workloads, identities, applications and data, plus the managed services that run those controls for buyers. Douglas Insights builds that 2025 figure from 1.18 billion protected seats at an average of USD 193.4 per seat a year, and projects USD 634.25 billion by 2035, a revenue CAGR of 10.76% for 2026 to 2035. Consolidation sets the tone: Palo Alto Networks completed its acquisition of CyberArk on 11 February 2026, paying USD 45.00 in cash plus 2.2005 of its own shares for each CyberArk share. Our enterprise software coverage holds this study, and every number follows the Douglas Insights research methodology.

Which cyber security product segment leads: network firewalls, endpoint agents or cloud security?

Network security leads the cyber security market with 22.4% of 2025 revenue, worth USD 51.12 billion, because every branch, data centre and campus still buys firewalls and secure gateways. Cloud security grows fastest, at 14.8% a year, as workloads leave the data centre. The split covers seven solution types sold to buyers of every size.

Network security, at USD 51.12 billion, holds the top slot on the strength of next-generation firewall refresh cycles, though its 7.5% growth is the slowest of the seven. Managed security services take 18.3%, or USD 41.76 billion, because most firms cannot staff a round-the-clock security operations centre (SOC) of their own. Endpoint security earns USD 31.27 billion from endpoint detection and response (EDR) agents on laptops, servers and phones. Identity and access management (IAM) is worth USD 28.75 billion and grows 12.1% a year, since stolen credentials open most breaches. Cloud security starts at USD 27.16 billion and reaches USD 107.97 billion by 2035, the fastest rise of any segment. Application and data security, at USD 25.79 billion, sells code scanning, web application firewalls and encryption. Security operations and analytics brings in USD 22.36 billion from security information and event management (SIEM) and automated response tools.

Douglas Insights estimates that the cloud security segment’s 14.8% pace adds USD 80.81 billion of new revenue by 2035. Narrower slices of this spend are covered in the Cloud Application Security and Vulnerability Management Market and the Cybersecurity Mesh Market reports.

Which cyber security delivery format makes the money: on-premises, cloud-delivered or hybrid?

Cloud-delivered cyber security, sold as a subscription, accounts for about 46.8% of 2025 revenue in the Douglas Insights model, ahead of hybrid at 31.5% and on-premises at 21.7%. Vendors now price most new controls as services, so the cloud-delivered share keeps rising each renewal cycle.

On-premises appliances still matter in plants, defence sites and banks that keep data inside their walls. Hybrid deals pair a physical firewall with cloud management and threat feeds. Subscription models show in vendor results: CrowdStrike reported subscription revenue of USD 4.56 billion out of USD 4.81 billion in its fiscal 2026, about 94.8% of the total. Fortinet, the most appliance-heavy of the large vendors, still drew USD 4.58 billion of its USD 6.80 billion from services in 2025.

Why is cyber security demand rising faster than overall IT budgets?

Cyber security seat volume grows 6.4% a year in the base case, driven by four forces that add 2.3, 1.9, 1.5 and 0.7 points. Attackers now target machine identities, regulators demand proof of controls, workloads move to cloud, and small firms buy managed protection.

AI agents and machine identities add 2.3 points, the largest contribution. Palo Alto Networks said, when it closed the CyberArk deal on 11 February 2026, that machine identities outnumber human identities by more than 80 to 1. The same release cites nearly 90% of organisations suffering an identity-centric breach, and about 75% saying their privilege models are outdated. Identity is the new perimeter. Each new AI agent, service account and API key is a new identity that needs a vault, a policy and monitoring. Douglas Insights counts these as protected seats alongside people, which is why the seat base outgrows headcount.

Compliance adds 1.9 points. The EU NIS2 Directive had to be in national law by 17 October 2024 and reaches medium-sized and large entities in 18 critical sectors, from energy and health to waste water and space. The Cyber Resilience Act, Regulation (EU) 2024/2847, entered into force on 10 December 2024, with reporting duties from 11 September 2026 and full product obligations from 11 December 2027. Both rules make boards accountable, and both turn optional cyber security spend into a line item that auditors check. Auditors now ask for evidence. Fines follow failure.

Cloud workload migration adds 1.5 points. Every workload moved to a public cloud needs posture management, workload protection and identity controls that the old perimeter firewall never supplied. Cloud security’s 14.8% growth rate is the clearest sign of that shift in the segment table above. Old firewalls do not see these workloads.

Small-business managed services add the final 0.7 points. Firms with fewer than 250 staff rarely hire a full security team, so they buy managed detection and response (MDR) from a provider. A provider can watch thousands of small offices from one SOC, which keeps the monthly fee per seat low enough for a dental practice or a regional accountant. Douglas Insights puts small and medium-sized enterprises at 27.4% of 2025 cyber security seats, rising to 31.2% by 2035 as these contracts spread. Breach costs keep the pressure on: IBM’s 2026 study puts the global average at USD 4.99 million, up 12% on the prior year.

Which hurdles hold cyber security budgets below the threat level: talent gaps and platform discounts?

Three cyber security restraints remove 1.8 points from seat growth in the slower case: the talent shortage (0.8 points), platform consolidation discounts (0.6 points) and budget scrutiny in smaller firms (0.4 points). Together they pull volume growth from 6.4% to 4.6%.

The security talent shortage takes 0.8 points. Unused tools die. Tools that nobody configures do not get renewed, and buyers who cannot hire analysts delay new modules. Managed services absorb part of this gap, which is why the managed segment grows 11.2% while network security grows 7.5%.

Platform consolidation discounts take 0.6 points. Large vendors bundle firewall, endpoint, identity and SIEM licences, and a buyer that swaps eight point products for two platforms often cuts its seat count for overlapping tools by a fifth. Douglas Insights treats that overlap removal as lost volume, not lost price.

Budget scrutiny in smaller firms takes 0.4 points. In the slower case, small businesses hold renewals flat for two to three years after an economic slowdown. Large enterprises with regulatory duties rarely cut, so the restraint falls mainly on the small and medium-sized enterprises tier.

How much do buyers pay per cyber security seat, and why does the price keep climbing?

Buyers paid an average of USD 193.4 per protected cyber security seat in 2025, rising 4.1% a year to USD 289.0 by 2035 in the base case. The rise comes from added modules per seat, not list-price increases on the same product. Prices follow modules.

Douglas Insights estimates realised bands by product. Endpoint detection and response seats sell for about USD 45 to USD 110 a year at enterprise volume. Identity and access management runs USD 30 to USD 95 per user a year, with privileged access vaults priced well above that. Managed detection and response adds roughly USD 90 to USD 240 per endpoint a year, depending on the response hours. Firewalls are priced per appliance, from under USD 1,000 for a branch box to more than USD 250,000 for a data-centre chassis, plus 20% to 25% of list each year for threat subscriptions.

Douglas Insights calculates that the price leg alone adds USD 95.6 per seat over the decade. The average seat carried 2.6 security modules in 2025 in our model, and 3.9 by 2035. AI-driven features, such as automated triage and AI agent protection, are sold as add-on tiers at 15% to 30% above the base licence.

Which cyber security vendors win the platform contest after the CyberArk deal?

Microsoft leads the cyber security market with an estimated 8.8% share, and the top three (Microsoft, Palo Alto Networks and Fortinet) hold 15.8% of 2025 revenue. Douglas Insights bases those shares on disclosed revenue against the USD 228.21 billion total.

Microsoft said its security business had passed USD 20 billion in revenue, with more than 860,000 security customers, built on bundling identity, endpoint and SIEM into enterprise licences. Palo Alto Networks reported USD 9.22 billion of revenue for its fiscal 2025, with next-generation security annual recurring revenue (ARR) of USD 5.6 billion, and added CyberArk’s privileged-access franchise on 11 February 2026. Fortinet reported USD 6.80 billion of 2025 revenue, up 14%, built on its own security chips and a large firewall installed base.

CrowdStrike reported USD 4.81 billion of revenue, up 22%, and ending ARR of USD 5.25 billion as of 31 January 2026, built on its Falcon endpoint agent; that figure is in its fiscal 2026 results. Check Point Software, built on gateway firewalls and a loyal European and Israeli base, booked about USD 2.73 billion in our register. Zscaler, the zero-trust web gateway specialist, booked about USD 2.67 billion in our register, up 23%. Cisco and Google also compete for platform contracts, through firewalls, analytics and cloud security. Industrial buyers turn to specialists covered in the Industrial Cybersecurity and OT Protection Market report.

Where is cyber security spending growing fastest by region: North America, Europe or Asia Pacific?

North America leads cyber security spending with USD 90.37 billion in 2025, 39.6% of the total, while Asia Pacific grows fastest at 12.8% a year. The Middle East and Africa ranks second on growth, at 12.4% a year, in the Douglas Insights regional model.

North America rises to USD 221.93 billion by 2035 at 9.4% a year, carried by federal civilian and defence budgets and the largest base of banks and cloud providers. Asia Pacific grows from USD 57.74 billion to USD 192.55 billion, the fastest rise, because India, Japan, Australia and Southeast Asia are adding data-protection laws while their cloud adoption climbs. Europe moves from USD 55.00 billion to USD 145.27 billion at 10.2% a year as NIS2 audits reach thousands of mid-sized firms. The Middle East and Africa start at USD 13.24 billion and grow 12.4% a year, led by Gulf state programmes. Latin America, at USD 11.87 billion, grows 10.40% a year; Brazil’s banking sector is the wildcard, since a handful of large Brazilian banks set most of the regional security budget.

Which cyber security buyers spend the most: banks, governments or hospitals?

Banking and financial services is the largest cyber security buyer at an estimated 21.6% of 2025 revenue, followed by government and defence at 17.9% and telecom and IT at 15.3%. Banks face the strictest supervisors and the highest fraud losses.

Healthcare takes 10.4%, with hospitals buying medical device security and backup after ransomware outages. Manufacturing takes 12.1% as plants connect operational technology to corporate networks. Retail takes 9.8%, driven by card-payment rules and e-commerce fraud. Other buyers, including energy, education and utilities, make up the remaining 12.9%. Large enterprises spend about USD 237 per protected seat, while small and medium-sized enterprises spend about USD 79, in the Douglas Insights model. Vehicle makers form a separate niche, covered in the Connected Vehicle Cybersecurity Market report.

How far apart are the slower and faster cyber security scenarios for 2035?

The cyber security market reaches USD 634.25 billion by 2035 in the base case, USD 490.29 billion in the slower case and USD 787.39 billion in the faster case. The gap between the two outer cases is USD 297.10 billion, almost all of it from seat volume.

The base case uses 6.4% volume growth and 4.1% price growth. The slower case uses 4.6% and 3.2%, giving 7.95% a year; that is the path where talent shortages, consolidation discounts and smaller-firm budget cuts all bite. The faster case uses 8.0% and 4.8%, giving 13.18% a year, the path where AI agent identities multiply faster than expected and the Cyber Resilience Act obligations from 11 December 2027 pull product makers into buying security tooling. Raising seat growth by one point lifts our 2035 value by USD 62.20 billion.

Published forecasts run from about 7.8% to 13.8% a year, so our 10.76% sits in the middle of that span. Consolidation such as the CyberArk purchase of 11 February 2026 is neutral for the total in our model, but it moves share toward platform vendors.

Which cyber security rules and laws force spending: NIS2, the Cyber Resilience Act and disclosure duties?

Two EU laws shape cyber security demand most directly: NIS2, binding medium and large entities in 18 sectors since 17 October 2024, and the Cyber Resilience Act, whose reporting duties applied from 11 September 2026. Both carry board-level accountability for any firm selling into the EU.

The Cyber Resilience Act requires makers of connected hardware and software sold in the EU to handle vulnerabilities for the product’s support period and to report actively exploited flaws. Its main obligations apply from 11 December 2027, about 14 months after this edition. Douglas Insights expects the act to add about 0.4 points of the 1.9-point compliance contribution through product makers’ purchases of code scanning and software bill of materials tools. National rules in the United States, the United Kingdom, India and Australia set incident reporting deadlines that push buyers toward logging and SIEM.

Do small and medium-sized enterprises change the cyber security seat count?

Small and medium-sized enterprises held 27.4% of cyber security seats in 2025 but only about 11.2% of revenue, because they pay about USD 79 a seat against USD 237 for large enterprises. Their share of seats rises to 31.2% by 2035.

Douglas Insights tallies 323 million small-business seats in 2025 out of 1.18 billion. Managed service providers sell them bundled endpoint, email and backup protection at a monthly fee. Because each small-business seat adds less revenue, rising small-firm adoption lifts volume faster than value, which partly explains why the 4.1% price leg trails the 6.4% volume leg.

Douglas Exclusive: the cyber security vendor revenue register

The Douglas Insights cyber security vendor revenue register is our own count of disclosed revenue, built from 6 company filings and investor releases, set against our USD 228.21 billion 2025 market estimate. Fiscal years differ by vendor, as the table shows, so the register is a guide to scale rather than an audited share table.

The six vendors in the register add up to USD 46.23 billion, or 20.3% of the cyber security market. Without Microsoft, the five listed specialists sum to USD 26.23 billion, just 11.5% of the total. The finding is plain: even after the CyberArk deal, roughly 79.7% of spending goes to vendors outside the register, including Cisco, Google, IBM, Okta and thousands of managed service providers. The cyber security market is consolidating at the top but remains fragmented underneath. The tail is long. We will add each quarter’s filings to the register as vendors report.

What methodology turns protected cyber security seats into revenue, and which cross-checks hold?

The cyber security model multiplies 1.18 billion protected seats by USD 193.4 a seat, which gives USD 228.21 billion for 2025, then grows seats 6.4% and price 4.1% a year. Seats include people, servers, cloud workloads and machine identities under paid protection.

The model covers 5 regions and 31 countries, with 7 solution segments and 7 buyer groups. It draws on 6 vendor filings in the register, 2 EU legal texts, 1 breach-cost study and 6 published growth forecasts. Check one: the 2025 total sits 4.2% above the lowest and 30.0% below the highest of the published 2025 estimates we read. Check two: seat volume of 2.19 billion in 2035 times USD 289.0 gives the same USD 634.25 billion as the revenue CAGR. Check three: segment 2035 values sum to USD 628.38 billion, within 0.93% of the total.

Sources

1. Palo Alto Networks Palo Alto Networks completes acquisition of CyberArk (2026)
2. European Commission Cyber Resilience Act (2024)
3. European Commission NIS2 Directive (2024)
4. IBM Cost of a Data Breach Report 2026 (2026)
5. Fortinet Fortinet fourth quarter and full year 2025 results (2026)
6. CrowdStrike CrowdStrike fourth quarter and fiscal year 2026 results (2026)
7. SEC EDGAR Palo Alto Networks fiscal 2025 results (2025)
8. Check Point Software Check Point Software fourth quarter and 2025 full year results (2026)
9. Zscaler Zscaler fourth quarter and fiscal 2025 results (2025)
10. Microsoft Microsoft Security passes USD 20 billion (2023)