Security budget cuts rarely hit the line spending the most. They hit the one that cannot point to anything it actually stopped.
Nothing happening is the result a working security function produces. It is not, by itself, evidence that the function is working. A fire did not start, a breach did not land, a critical system did not go down: all three outcomes look identical whether the controls behind them earned that quiet or simply got lucky. Boards reviewing a budget line in Q4 are not equipped to tell the difference, and most security functions have not given them the tools to try.
The Evidence Behind Security Budget Cuts
A December 2025 survey of 750 IT decision-makers across twelve countries, commissioned by Exabeam and run by Sapio Research, found that 95 per cent of organisations plan to raise cybersecurity spending in 2026 and 74 per cent expect double-digit growth. The same survey found 44 per cent would name AI security investment as the first line item cut if budgets tightened, even though the same respondents cited AI as the leading reason spending needed to rise at all.
Exabeam’s chief AI and product officer, Steve Wilson, put the mechanism plainly: “Those are the budgets that get cut first,” because the teams asking for them track the wrong things and do not speak the board’s language. Exabeam’s CISO, Kevin Kirkwood, made the same point from the metrics side: a faster mean time to resolution does not prove risk went down. “Boards don’t fund faster ticket closure,” he said, “they fund measurable risk reduction and business resilience.” Thirty per cent of the same respondents named the board’s limited grasp of how cyber investment supports resilience as their single biggest challenge, a gap that sits on both sides of the table. It is the same gap that shows up whenever a CEO calls something agility and the CFO calls it AI spend, the same investment described in two different languages for two different audiences.
A separate study, published in March 2026, found 77 per cent of organisations raising cybersecurity budgets this year, and 63 per cent had still suffered at least one significant breach in the past twelve months. Forty per cent of the same CISOs said their budget would remain insufficient for emerging threats. Spending is going up. Confidence that it is buying the right outcome is not keeping pace with it: 90 per cent of leaders describe themselves as confident in their own controls, but only 47 per cent call that confidence strong. That gap, not the headline budget number, is what gets a line item cut.
Report Trends, Not Silence
The fix is not a better story about the quiet. It is a different kind of evidence, assembled before the review rather than produced under pressure during it.
Compare threat volume against incident severity over time rather than citing either figure alone. Rising attack pressure sitting next to flat or falling severity is the actual story, because it shows the controls absorbing more without the business feeling more of it. A single clean quarter proves nothing on its own; a trend line does.
When security budget cuts land mid-programme, as many now will this quarter, report against the revised, approved baseline rather than the original wish list. A programme measured against a target it was never actually funded to hit will always look like it underdelivered, regardless of what it genuinely prevented.
Corroborate internally generated claims externally wherever possible. IDC’s own framing, from September 2026, captures the mechanism precisely: “Your board wants evidence, not conviction.” A named analyst citing a comparable organisation survives a finance review in a way that an unattributed studies-show claim never does, and the same logic applies to a standard, an audit finding or a peer benchmark. None of it depends on the board trusting the person presenting it.
The Evidence Pack Worth Keeping Current
None of this requires a bigger team or a new tool. It requires a short pack, kept current rather than assembled the week of the review: the original charter, the approved budget set against actual spend, the KPI trend rather than a single snapshot, the incident severity distribution over time, governance minutes showing the decisions that shaped the programme, and at least one piece of independent verification.
A security leader who can produce that pack in the room answers a different question than the one about what happened this quarter. They answer whether the organisation would notice if the function stopped, and what it would cost to find out.
Pull your own evidence pack together before your next budget review, not during it. Name the piece of it you genuinely do not have yet.
