U.S. companies are planning widespread increases in cybersecurity investment as emerging threats driven by artificial intelligence (AI) reshape risk priorities, according to the newly published 2025 KPMG Cybersecurity Survey.
The report, available for download here, shows nearly all security leaders surveyed intend to boost budgets for cyber defense over the next several years, underscoring the increasingly strategic role cybersecurity plays for large organizations.
The survey was conducted from September 25 to October 9, 2025, and includes responses from 310 C-suite security leaders at U.S. organizations with at least $1 billion in revenue, according to an announcement. Findings indicate that nearly all respondents plan to grow their cybersecurity budgets over the next two to three years, and almost as many reported increases during the past 12 months.
Cyberattack activity continues to rise
According to the survey, 99% of respondents anticipate increasing cybersecurity spending in the near term, with more than half planning budget increases of 6% to 10%. Priority investment areas include data security and privacy, identity and access management and cloud security. Budget growth appears closely tied to the surge in cyber threats, even as leaders cite resource constraints and competing demands for funding as barriers to addressing vulnerabilities.
The survey reflects a heightened level of cyber activity. Eighty-three percent of security leaders reported a rise in cyberattacks over the last year. Among organizations that experienced an incident, phishing and distributed denial-of-service attacks were the most frequently cited, followed by ransomware and malware. Insider-related incidents, Internet of Things attacks and password-based attacks were also identified as recurring challenges.
AI reshapes both threats and defenses
AI-driven threats are emerging as a central concern. More than half of respondents cited AI-powered social engineering and targeted attacks as top challenges, along with AI-enhanced malware, ransomware and automated phishing campaigns. Despite these concerns, fewer than half of respondents rated their defenses as highly effective against AI-driven threats. More than half also expressed concern about the malicious use of AI tools by insiders.
At the same time, AI is viewed as both a risk and a critical line of defense. Most respondents expect AI-powered attacks to become a major challenge within the next two to three years, particularly among organizations that feel less prepared today. However, leaders also expect AI to have the greatest impact in areas such as fraud prevention, predictive analytics and enhanced threat detection. Many organizations already dedicate more than 10% of their cybersecurity budgets to AI-related initiatives, signaling that AI investment is becoming a core component of security strategy.
Workforce pressures influence security strategy
Talent shortages remain another key challenge. More than half of respondents cited a lack of qualified cybersecurity professionals as a high-impact issue, along with the rising cost of attracting and retaining talent.
To address these gaps, organizations are investing in training and upskilling existing employees, increasing compensation and benefits and relying on external partners to supplement internal teams, according to the survey.
“The data doesn’t just point to steady growth; it signals a potential boom. We’re seeing a major market pivot where cybersecurity is now a fundamental driver of business strategy,” stated Michael Isensee, Cybersecurity & Tech Risk Leader, KPMG. “Leaders are moving beyond reactive defense and are actively investing to build a security posture that can withstand future shocks, especially from AI and other emerging technologies. This isn’t just about spending more; it’s about strategic investment in resilience.”
Quiz