Five Security Trends That Should Change Your 2026 Budget

Five shifts in the 2026 data should move money in a small company’s security budget, and one of them should cut a line rather than add one. Trend lists cost nothing to read. The controls behind them cost between roughly $13,600 and $36,300 a year for a firm of 25 to 100 people, which is the range I work from when a client asks what a defensible program costs.

I built this from the primary 2026 reports, not vendor summaries: FBI complaint data, Verizon’s breach dataset, Sophos’s ransomware survey, ISC2’s workforce survey. Each section ends with the budget line the trend should move and a dollar band, and the method behind every band is stated so you can argue with it.

In Sophos’s 2026 survey, only 34% of organizations with 100 to 250 employees stopped a ransomware attack before encryption or extortion, against 46% at organizations with 3,001 to 5,000 employees. Smaller firms are less covered, and the difference shows in whether the attack is stopped.

AI made the con cheap, not new

The FBI’s annual complaint report added an artificial-intelligence section for the first time in its 2025 edition. It records 22,364 complaints with an AI reference and $893 million in associated losses for 2025, inside a total of 1,008,597 complaints and $20.877 billion in reported losses, a 26% rise over 2024 (IC3 2025 Internet Crime Report, April 2026). Phishing and spoofing remained the most frequent complaint type at 191,561.

Businesses reported over $30 million in losses to business email compromise involving AI, where chat tools draft official-sounding messages and voice cloning carries a payment request. Verizon’s 2026 breach report adds the delivery channel: mobile social engineering — text messages and voice calls — succeeds 40% more often than email phishing (Verizon 2026 DBIR, 19 May 2026).

The attack that reaches your controller is a plausible message arriving on a channel your staff trust, at a moment of manufactured urgency. Detection tools catch some of it; the control that catches the rest is a rule that no payment instruction, bank-detail change, or credential reset is acted on until someone calls a number already on file.

Email authentication is the cheap half. SPF, DKIM, and DMARC at enforcement stop direct domain spoofing, and Google has required bulk senders to authenticate with all three since 1 February 2024 (Google Workspace, Email sender guidelines). Lookalike domains and compromised real accounts still get through, which is why the callback rule carries more weight than the filter.

Budget line: email authentication, a written callback rule with a dual-approval threshold, and a quarterly drill. Allow $0 to $2,500, most of it labor.

Ransom prices fell while recovery costs rose

Sophos’s seventh State of Ransomware survey covers 2,158 organizations in 17 countries that were hit in the previous 12 months, fielded by Vanson Bourne in the first quarter of 2026 (Sophos, State of Ransomware 2026, 15 July 2026). Median demand fell to $698,000, down 65% over two years. Median payment fell to $769,000 from $1 million. Encryption still succeeded in 56% of attacks, and 48% of those organizations paid.

The recovery bill went the other way: $1.7 million on average per incident, up 11% year over year. Two findings explain the gap. Backup-based recovery rose to 66% of encrypted cases, which is the strongest argument in the report for spending on backups. And the attacks that start with an exploited firewall vulnerability carry demands of $1 million or more 59% of the time, against a 48% baseline.

Chainalysis counts payments rather than surveying victims. In 2025 it recorded $820 million in on-chain ransomware payments, down 8%, with claimed attacks up 50% and at least $14 million paid to the initial access brokers who sell footholds to affiliates (Chainalysis, 2026 Crypto Crime Report: Ransomware, 26 February 2026).

Patching is where the exposure sits. CISA’s Known Exploited Vulnerabilities catalog holds roughly 1,700 entries at the time of writing, several hundred of them flagged as used in ransomware campaigns (CISA KEV catalog, live list). A 14-day deadline for internet-facing systems, and removal of admin interfaces from the public internet, covers a large share of what gets exploited in practice.

On root cause, the same survey put malicious email at 26%, phishing at 24%, compromised credentials at 23%, and exploited vulnerabilities at 18%, down 14 points in a year. Verizon’s broader dataset disagrees on the ordering, putting vulnerability exploitation first at 31%. Neither ranking should drive a budget; the overlap should. Email, credentials, and unpatched edge devices are the three doors, and they are cheap to close relative to the $1.7 million recovery bill.

Budget line: one immutable or offline backup copy with a tested restore, plus a patching schedule built from KEV. Allow $4,900 to $11,400, which is storage, a local appliance, and 32 to 64 hours of labor a year.

Identity is the entry point, and coverage is the gap

Sophos found that 79% of ransomware attacks began with an identity-based approach, and 67% of victims said the ransomware incident was also their most significant identity incident. The detail that should change how you buy: MFA was deployed in some form in 97% of the incidents where compromised credentials were the root cause. The failing organizations had MFA; it did not cover the path the attacker used.

Sophos’s Active Adversary analysis of 661 incident-response and managed-detection cases reached the same conclusion, with MFA missing where it mattered in 59% of them. The pattern is consistent: SaaS accounts have MFA, while VPN concentrators, firewall administration consoles, and legacy applications do not. An attacker needs one uncovered path, and those paths are usually missing from the inventory.

The metric to manage is the percentage of remote and administrative access paths covered by phishing-resistant authentication, reported by path rather than as a yes on a settings page. CISA’s guidance is direct that FIDO/WebAuthn is the only widely available phishing-resistant method, and that other factors remain worth having where it is not yet possible (CISA, Implementing Phishing-Resistant MFA, January 2023). The same permission logic now applies to software: an agent or integration with write access is an identity, and it needs scoping for the same reasons a person’s account does.

Budget line: a paid identity tier that supports passkeys and conditional access for the whole staff, not just administrators. Microsoft’s current list price for Entra ID P1 is $7 per user per month (Microsoft, Entra pricing), which is $2,100 a year at 25 users and $8,400 at 100.

Your vendors are inside the blast radius

Verizon’s 2026 report puts third-party involvement in 48% of breaches, a 60% jump, and finds frequent employee AI use rising from 15% to 45% in a year, with shadow AI the third most common source of non-malicious leakage. That figure is a vendor problem: staff paste work into tools nobody reviewed, and those tools hold a copy of your data.

Procurement is the control point. CISA’s Secure by Demand guide asks buyers to assess how a manufacturer builds the product, not only whether the manufacturer passes audits (CISA, Secure by Demand Guide, August 2024). A SOC 2 report describes the vendor’s own corporate security program. It says little about whether their product ships with authentication bypasses, an unpublished vulnerability process, or a hard-coded admin account.

For a company with twenty to forty vendors, the work is tiering rather than questionnaire volume. Five vendors can take your operations down or hold your regulated data. Those five get the CISA questions, a security addendum, and an annual review. Everyone else gets a lighter check at renewal. The clauses I would insist on in every contract are a 72-hour breach notification, MFA on all administrative access, disclosure of subcontractors who touch your data, and a defined export and deletion process at termination. Without the last two, leaving a vendor becomes its own incident.

Budget line: vendor inventory, tiering, and contract review. Allow $4,000 to $8,000, which is 40 to 80 hours in the first year and less afterward.

The skills gap is a coverage gap

ISC2 surveyed 16,029 cybersecurity practitioners and decision-makers between May and June 2025, and reported that 88% had experienced at least one significant consequence of a skills shortage, with 69% reporting more than one (ISC2, 2025 Cybersecurity Workforce Study, 4 December 2025). A third said their organization lacks the resources to staff its team adequately; 29% said they cannot afford the skills they need. ISC2 stopped publishing a headcount gap that year, arguing skills, not seats, are the constraint.

For a 60-person company this is not a solvable hiring problem. You will not outbid a bank for a security engineer, and one hire does not cover nights and weekends. What you can buy is defined coverage: a managed detection retainer with a named escalation contact, an incident-response agreement signed before you need it, and one internal owner who holds the decision rights when something goes wrong. My view is that the owner matters more than the title; the retainer only works if someone internal can authorize the response.

Then rehearse. A tabletop that walks a payment-fraud call and a ransomware detection to the point of decisions takes half a day and exposes the gaps that documentation hides. If your first rehearsal happens during the incident, the first 72 hours will be spent learning roles instead of preserving evidence.

Budget line: an owner’s time, one rehearsal a year, and training for the staff who handle money and credentials. Allow $2,600 to $6,000 in labor. A managed detection retainer is a separate quote and should be priced against the coverage it actually provides.

Trend	What it should fund	Annual cost band	Evidence
AI-assisted fraud	DMARC at enforcement, a verified callback rule, a quarterly drill	$0–$2,500	IC3 2025: 22,364 AI-related complaints, $893 million in losses; DBIR 2026: mobile social engineering succeeds 40% more often than email
Ransomware economics	One immutable backup copy, a timed restore, a 14-day KEV patching deadline	$4,900–$11,400	Sophos 2026: $1.7 million average recovery, 66% recovered from backups, 59% of firewall-vulnerability demands at $1 million or more
Identity as entry point	Phishing-resistant MFA across VPN, firewall administration, and legacy apps	$2,100–$8,400	Sophos 2026: 79% of ransomware began with identity; 97% of credential-rooted incidents had some MFA
Third-party exposure	Vendor tiering, CISA product-security questions, four contract clauses	$4,000–$8,000	DBIR 2026: a third party is involved in 48% of breaches
Skills gap	One accountable owner, one rehearsal, training for finance and IT	$2,600–$6,000	ISC2 2025: 88% experienced at least one significant consequence of a skills shortage
Total		$13,600–$36,300

What this means for operators

$36,300 against a $1.7 million average recovery is a real ratio, but the more useful point is that the cheap controls are the ones the data says are failing. Attackers beat MFA in 97% of credential cases by finding the VPN, the firewall console, or the old application that never got enrolled. They beat backups by finding the copy that was reachable from the domain controller.

That reframes the budget conversation. Most small companies need their security spend reshaped more than enlarged. The lines that grew over the last three years — endpoint agents, email filters, another detection console — are not where the 2026 evidence points. Patching, identity coverage, and a tested restore are, and they cost labor and configuration more than subscriptions; the cybersecurity section takes each one further.

Two limits. First, the $1.7 million figure is an average across organizations up to 5,000 employees, so it overstates a 40-person firm’s loss and understates the variance. Build your own number from downtime, notification costs, and lost revenue; the distribution matters more than the mean, as I argued in my reading of IBM’s breach cost report. Second, the controls above assume you already have the tier-one basics in place — inventory, endpoint protection, a documented response plan. If those are missing, the threat floor comes first.

One line should go down. Most small firms I assess pay for two tools that do the same job, bought by different people in different years, and nobody owns either. Cancelling one funds much of this program without a new approval.

What to do

1. Map every login path, then close the top five. List VPN, firewall administration, remote desktop, SaaS administration, and any legacy application with an internet address. Put phishing-resistant MFA on the five with the highest exposure first, and report coverage as a percentage rather than a yes or no.
2. Put DMARC at enforcement and write the callback rule. Publish a reject policy, monitor for lookalike domains, and require that any payment instruction or bank-detail change be confirmed by calling a number from your own records. Set a dollar threshold above which two people approve.
3. Make one backup copy unreachable. Immutable or offline storage, credentials that the production domain cannot use, and a restore of one critical system performed and timed this quarter. Untested backups are a hypothesis.
4. Patch from the KEV list on a deadline. Fourteen days for internet-facing systems, 30 for the rest, with an owner named per system.
5. Tier your vendors and change four clauses. Identify the five vendors that can stop your operations, then add 72-hour notification, MFA on administrative access, subcontractor disclosure, and data export and deletion to every renewal.
6. Name one owner and rehearse once. Give one person the authority to isolate systems and call the insurer, the lawyer, and the client. Run one tabletop covering a payment-fraud call and a ransomware detection, and record the decisions people actually made.
7. Cut the duplicate before you ask for more. List every security subscription, its owner, and the control it provides. Cancel the one with no owner, and move the money to identity coverage or the backup test.

The decision to make this quarter is whether you can prove two things on a single page: that every remote and administrative path requires phishing-resistant authentication, and that you can restore your finance system from a copy the attacker could not reach. If you can prove both, spend the next dollar on detection. If you cannot, the next dollar belongs there, and the $13,600 end of the band is enough to start.

An earlier version of this piece appeared on LinkedIn.

Sources

1. 2025 Internet Crime Report — Federal Bureau of Investigation, 2026-04-06.
2. Cryptocurrency and AI Scams Bilk Americans of Billions — Federal Bureau of Investigation, 2026-04-06.
3. Vulnerability exploitation top breach entry point, 2026 DBIR finds — Verizon, 2026-05-19.
4. The State of Ransomware 2026: Payments are dropping but encryption is climbing — Sophos, 2026-07-15.
5. 79% of Ransomware Attacks Now Originate from Compromised Identities — Sophos, 2026-07-15.
6. 2026 Crypto Crime Report: Ransomware — Chainalysis, 2026-02-26.
7. Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency, live list.
8. Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem — CISA, 2024-08.
9. Implementing Phishing-Resistant MFA — CISA, 2023-01.
10. 2025 ISC2 Cybersecurity Workforce Study — ISC2, 2025-12-04.
11. ISC2 Study Finds Cybersecurity Budget Constraints Remain, But Do Not Worsen, While Skill Needs Grow — ISC2, 2025-12-04.
12. Email sender guidelines — Google Workspace, 2024-02-01.
13. Microsoft Entra pricing — Microsoft, current list price.
14. B2 Cloud Storage pricing — Backblaze, current list price.