Rising cyber risk is becoming a core budget issue for large U.S. companies as executives rank attacks above other major business threats. That shift is supporting demand for security software, cloud protection and AI-related defenses that companies are less able to cut during slower economic periods.
Highlights
- Survey data show 71% of CEOs now rate cyberattacks as a high risk, up from 63% last quarter, elevating cyber above AI and geopolitics.
- The average U.S. enterprise data breach cost rises to $10.22 million, with weekly attacks projected to increase 18% to 2,086 per organization in 2026.
- Gartner forecasts enterprise AI security spending to grow from $15.6 billion in 2025 to $37.6 billion by 2030, supporting cybersecurity ETF exposure such as CIBR.
CEO risk data and spending drivers
As reported by Weiss Ratings, recent survey data from The Conference Board and The Business Council show 71% of CEOs rate cyberattacks as a high risk to their industry, up from 63% one quarter earlier. The report says cyber risk now ranks ahead of AI and new technology, geopolitical conflict and broader economic pressures on the executive agenda.The business case for continued spending is tied to the cost and frequency of attacks. The average U.S. enterprise data breach now costs $10.22 million, while organizations are averaging 2,086 cyberattacks per week in 2026, an 18% increase from the previous year. Global ransomware damages are projected at $74 billion in 2026, up 30% from 2025.
AI is expanding the threat landscape on both sides of the market. Hackers can use generative AI to automate vulnerability searches, move through compromised networks and create more convincing spear-phishing messages, while companies are also adding AI tools that create new systems to defend. Gartner forecasts enterprise spending to secure AI applications will rise from $15.6 billion in 2025 to $37.6 billion by 2030, equal to an 18.5% compound annual growth rate.
Cyber exposure also extends beyond a company's own network. Software vendors, contractors and other suppliers can become entry points for attackers, while state-backed and proxy groups are increasingly tied to risks facing power grids, communications systems, transport networks and financial infrastructure.
Fund positioning and sector implications
For investors, the article points to cybersecurity as a relatively nondiscretionary area of corporate technology budgets. Companies may delay software upgrades, hiring or equipment purchases in weaker conditions, but security spending remains harder to reduce because of regulatory pressure, cyber insurance requirements and legal and reputational risks when defenses fail.Cloud security is described as another key growth segment, with spending on cloud security and workload protection growing at more than 27% annually. At the same time, companies are consolidating fragmented security tools around a smaller number of broad platforms, a trend that can favor larger providers including CrowdStrike Holdings, Fortinet and Palo Alto Networks.
Weiss Ratings highlights the First Trust Nasdaq Cybersecurity ETF, ticker CIBR, as one way to gain diversified exposure to that theme. The fund tracks the Nasdaq CTA Cybersecurity Index, holds roughly 46 to 47 cybersecurity-related companies, has about $18 billion in assets, trades around 2.2 million shares on an average day and charges a 0.58% annual expense ratio.
That structure gives investors exposure across endpoint protection, threat intelligence, secure networking, firewalls, cloud defense and AI-driven security operations rather than relying on a single stock. The broader industry outlook in the article suggests that rising attack volumes, AI adoption, cloud migration, regulation and geopolitical tension continue to support demand across the cybersecurity market.
Our earlier report on cybersecurity startup funding in Q3 2026 noted that investor appetite stayed strong as larger late-stage rounds lifted total financing to $6.8 billion even though the number of deals fell. It also highlighted momentum in AI-oriented and identity security companies, alongside major M&A that underscored ongoing consolidation across the sector.