Australian organisations are forecast to spend A$7.56 billion on information security in 2026, up 9.5% on 2025. Almost half of that goes to security services rather than software. This page collects the current Australian figures in one place, each linked to its primary source, with the calculations shown where we derived a number ourselves.
Key figures at a glance
- A$7,555 million: forecast Australian end-user spending on information security in 2026 (Gartner, March 2026).
- 9.5%: growth on 2025, when spending was A$6,900 million.
- 49%: share of that spending that goes to security services (consulting, professional and managed services).
- 12.3%: growth in security software, the fastest growing segment.
- About 4.4%: security spending as a share of total forecast Australian IT spending of A$172.3 billion.
- About 2%: Australia’s share of forecast global information security spending.
- A$80,850: average self-reported cost of cybercrime per business report in FY2024-25, up 50% (ASD).
- 1,205: data breach notifications to the OAIC in calendar 2025, the highest year since the scheme began.
How big is the Australian cybersecurity market?
Gartner forecasts Australian end-user spending on information security at A$7,555 million in 2026. That is spending by organisations buying security products and services, which is the figure most useful to a decision owner. Vendor revenue estimates from market research firms are usually larger and less comparable, because they count different things.
| Segment | 2025 (A$m) | 2025 growth | 2026 (A$m) | 2026 growth |
|---|---|---|---|---|
| Security services | 3,480 | 6.3% | 3,720 | 6.9% |
| Security software | 2,971 | 10.9% | 3,336 | 12.3% |
| Network security | 449 | 9.1% | 499 | 11.1% |
| Total | 6,900 | 8.4% | 7,555 | 9.5% |
Gartner attributes the growth to a persistent threat environment, AI use by both defenders and attackers, the local skills shortage and rising expectations of cyber resilience. It also expects more than 75% of enterprises to be using AI-amplified security products for most use cases by 2028, up from less than 25% in 2025.
Where the money goes: services outspend software
Security services are the largest segment in Australia at A$3,720 million, or 49% of the total. Software is close behind at A$3,336 million and growing almost twice as fast. Network security is a small line at A$499 million.
The services share is where Australia differs from the global picture. In Gartner’s worldwide forecast for 2026, services account for US$92.8 billion of US$239.8 billion, about 39%. Australian organisations put roughly ten percentage points more of their security budget into buying people and outcomes from providers.
Gartner links this to the talent shortage: organisations that cannot hire AI-literate security staff rely more on managed security service providers. For decision owners it has a practical consequence. The biggest slice of Australian security spend sits in services contracts, which are harder to compare than software licences because scope, service levels and staffing are all negotiable. We cover how to compare them in our managed SOC evaluation guide.
What share of the IT budget goes to security?
Gartner forecasts total Australian IT spending of A$172.3 billion in 2026. Set against A$7.56 billion of security spending, that puts security at about 4.4% of national IT spend.
Two cautions apply. The two forecasts were published six months apart (September 2025 and March 2026), so the ratio mixes vintages. And a national aggregate is not a benchmark for a single organisation. A bank, a hospital network and a retailer will sit well above or below it depending on regulation, data holdings and how much of their security is bundled inside other contracts.
What is Australia’s share of global cybersecurity spending?
About 2%. Gartner’s worldwide forecast puts 2026 information security spending at US$239.8 billion (July 2025 forecast). Converting Australia’s A$7,555 million at exchange rates between 0.60 and 0.70 US dollars gives US$4.5 billion to US$5.3 billion, which is 1.9% to 2.2% of the global total.
Australia is also growing more slowly than the world on these forecasts: 9.5% against 12.5% globally for 2026. Gartner has since published a higher worldwide figure in client research, so treat the share as an approximation rather than a precise ranking.
The threat numbers behind the spending
The Australian Signals Directorate’s Annual Cyber Threat Report 2024-25 covers the financial year to June 2025.
| Measure, FY2024-25 | Figure | Change |
|---|---|---|
| Cybercrime reports to ReportCyber | Over 84,700 (one every 6 minutes) | Down 3% |
| Calls to the Australian Cyber Security Hotline | Over 42,500 | Up 16% |
| Incidents ASD responded to | Over 1,200 | Up 11% |
| Average cost per report, all businesses | $80,850 | Up 50% |
| Small business | $56,600 | Up 14% |
| Medium business | $97,200 | Up 55% |
| Large business | $202,700 | Up 219% |
| Incidents involving ransomware | 11% (138 incidents) | Steady |
| Critical infrastructure share of incidents | 13% | Up 2 points |
ASD itself flags that the large business figure is sensitive to outliers: large businesses filed 22% fewer reports than the year before and make up just over 12% of business reports, so a few big business email compromise losses move the average a long way. For the regulatory instruments that affect technology buying, including CPS 230 dates and Essential Eight maturity levels, see our cyber and technology procurement statistics.
The Office of the Australian Information Commissioner received 1,205 data breach notifications in 2025, up 8% on 1,112 in 2024 and the highest annual count since the Notifiable Data Breaches scheme began in 2018. Malicious or criminal attacks caused 59% of them. Health service providers notified the most breaches, 225 or 19% of the total.
Government investment and new obligations
The 2023-2030 Australian Cyber Security Strategy committed A$586.9 million in new funding when it was released in November 2023, alongside existing investment in ASD capability through project REDSPICE.
Regulation is adding demand as well. Since 30 May 2025, businesses with annual turnover of $3 million or more, and entities responsible for critical infrastructure, must report ransomware payments. APRA-regulated entities are working under CPS 234 for information security and CPS 230 for operational risk and material service providers, which pulls security requirements directly into procurement.
What these numbers mean for decision owners
Most of the money is in the hardest thing to compare
With services at half of Australian security spend, the largest commercial risk for most organisations sits in managed service and consulting agreements. Two providers can quote the same headline price for very different coverage hours, analyst ratios and response commitments. Normalise the scope first, then compare the price.
Software growth means consolidation offers
Security software growing at 12.3% is partly vendors folding more capability into platforms and pricing it as a bundle. Bundles can be good value. They also make it harder to leave any one component later, so price the exit and the individual modules before accepting the discount. Our cybersecurity vendor evaluation framework sets out the scoring we use.
Use market growth to test quotes, and budget from risk
A 9.5% market increase does not mean every organisation should spend 9.5% more. It means vendors will expect it. Budget from your own risk assessment and control gaps, then use market data to test whether the quotes you receive are reasonable. For the wider market view, including where we expect investment to move through 2030, see our Australian cybersecurity procurement landscape 2026-2030.
Frequently asked questions
How much does Australia spend on cybersecurity?
Gartner forecasts Australian end-user spending on information security of A$7,555 million in 2026, up 9.5% from A$6,900 million in 2025.
What percentage of global cybersecurity spending is Australian?
About 2%. At exchange rates between 0.60 and 0.70 US dollars, Australia’s forecast equals US$4.5 billion to US$5.3 billion, or 1.9% to 2.2% of Gartner’s US$239.8 billion worldwide forecast for 2026.
What is the largest segment of Australian security spending?
Security services, at a forecast A$3,720 million in 2026, or 49% of the total. Security software is second at A$3,336 million and is growing faster, at 12.3%.
What does cybercrime cost an Australian business?
ASD reports an average self-reported cost of $80,850 per cybercrime report from businesses in FY2024-25: $56,600 for small businesses, $97,200 for medium and $202,700 for large. These are averages of reported losses and exclude unreported incidents.
Official sources and update status
- Gartner Forecasts Information Security Spending in Australia to Reach Over $7.5 Billion in 2026, Gartner, 16 March 2026
- Gartner Forecasts Worldwide End-User Spending on Information Security to Total $213 Billion in 2025, Gartner, 29 July 2025
- Gartner Forecasts IT Spending in Australia to Exceed $172 Billion in 2026, Gartner, 8 September 2025
- Annual Cyber Threat Report 2024-25, Australian Signals Directorate
- Data breach notifications increase to all-time high in 2025, OAIC, 6 July 2026
- 2023-2030 Australian Cyber Security Strategy, Department of Home Affairs
Information status: figures checked against the sources above on 27 September 2026. Forecasts are revised regularly; the share-of-IT and share-of-global figures are CYBORIUM calculations from the published forecasts, with the method shown in each section.
Comparing security service providers and want the quotes put on a like-for-like basis? Talk to CYBORIUM.
Last updated:
