Quick answer: Gartner projects the market for securing AI will reach almost $4.8 billion in 2027, up 68.7% from 2026. That growth isn't optional spending. The World Economic Forum's latest outlook found AI-related vulnerabilities are now the fastest-growing cyber risk companies face. Most organizations are exposed to that risk already, and most don't have the people or the tools sorted out to deal with it yet.

The risk is already sitting inside your company

It's easy to read a market forecast and file it under "future problem." This one isn't that.

The World Economic Forum's Global Cybersecurity Outlook 2026 found that 87% of respondents named AI-related vulnerabilities the fastest-growing cyber risk of the past year. Not ransomware. Not phishing. AI itself, and the ways employees are already using it.

Here's the part that should worry any team that thinks they're not "an AI company" yet. More than 57% of workers admit to using personal GenAI accounts for work tasks, and about a third say they've entered sensitive company information into AI tools that were never approved for that use. Nobody had to roll out an AI strategy for this exposure to exist. It walked in through employee laptops on its own.

That's the real reason Gartner's spending number is climbing so fast. Companies aren't buying AI security tools because they decided to. They're buying them because the risk already showed up, and someone finally noticed.

Where the $4.8 billion is actually going

Gartner splits this spending into four buckets. Worth knowing what each one covers, because they solve different problems.

AI application security is the largest category, expected to hit $851 million in 2027. This locks down the AI-powered software itself, the models and the pipelines behind them.

AI usage control comes in at $749 million and is growing the fastest of the four, up 73%. This is the policy layer, deciding who can use which AI tool, for what, with what data.

AI governance platforms and AI gateways round things out. Governance covers oversight and compliance. Gateways sit between your systems and the AI models, filtering what passes through in both directions.

Here's the twist. Gartner's own analysts pointed out that governance platforms and gateways tend to stay with established vendors, the companies already running your enterprise systems. But application security and usage control? Those two categories are getting flooded with startups right now. New vendors, new tools, new claims, all launching at once, all chasing the same fast-growing budget line.

If you've tried to evaluate an AI security vendor in the last six months, you already know what that feels like. It's not a shortage of options. It's too many options, most of them unproven, none of them easy to compare against each other on a level playing field.

The other half of the problem: almost nobody's trained to run any of it

So the risk is real, and the tools exist, sort of. There's still a third piece missing. People.

A SANS Institute workforce report found that for the first time in the report's three-year history, skills gaps overtook plain headcount shortages as the industry's top challenge. Companies aren't just short-staffed. They're staffed with people who've never had to secure an AI system before, because the job barely existed two years ago.

Fortinet's research backs this up with a harder number. 56% of IT leaders say talent shortages are a major cause of breaches, for the third year running. And a separate Infragistics survey found AI engineers now rank as the hardest role to fill of any technical position, narrowly ahead of cybersecurity engineers.

Put it together and you get a strange industry-wide moment. The risk is already here. The budget to fight it is growing fast. But the tools are hard to sort through, and the people who know how to use them are hard to find. That's three separate bottlenecks stacked on top of each other, and most companies are only prepared to deal with one.

Two practical ways companies are closing the gap

You can't fix all three bottlenecks with one hire or one tool purchase. But you can chip away at the two that are actually solvable in the short term: who does the work, and which tools they use to do it.

Finding the right people, without a six-month search

The AI security talent shortage isn't going to fix itself through more job postings. When SANS found skills gaps outpacing headcount gaps, that's a sign the usual hiring playbook doesn't work here yet. There simply aren't enough people with two years of AI security experience to fill every open role with a full-time hire.

This is where contract and freelance talent has become a real strategy, not a stopgap. A Robert Half survey of 2,000 hiring managers found 55% plan to increase contract hiring specifically to close skills gaps in 2026. If your budget got approved before your hiring plan did, or you need a usage policy written and a governance framework stood up before a compliance deadline, waiting on a full-time search often costs more than it saves.

This is exactly what BeGig was built for. Instead of sorting through unvetted freelance profiles on a general marketplace, you're matched with people who've already been screened for this kind of work, whether that's an AI application security audit, a usage control policy, or hands-on governance setup. For a role category that's only a couple years old, skipping the guesswork on who's actually qualified is worth more than it usually would be.

Finding the right tools, without wading through every startup pitch yourself

The vendor side has its own version of the same problem. When a market segment doubles in a year and gets flooded with new entrants, comparing them properly takes real time, and most security teams don't have spare hours to run vendor bake-offs across four different AI security categories.

This is the kind of sprawl Alternates.ai was built to cut through. Rather than chasing down every new AI security or governance tool announcement one by one, it's built for side-by-side comparison across categories like AI application security and usage control platforms, so teams can shortlist based on what actually fits their stack instead of who has the loudest launch post.

Neither of these fixes the whole problem alone. But between the two, a company can move from "we know we're exposed" to "we've got a person and a tool in place" in weeks instead of a quarter.

FAQ

Why is AI-related risk considered the fastest-growing cyber threat right now? 

The World Economic Forum's Global Cybersecurity Outlook 2026 found 87% of respondents named AI-related vulnerabilities as the fastest-growing risk of the past year, driven partly by employees already using unapproved AI tools with company data before any formal security policy exists.

What are the four categories of AI security spending Gartner tracks? 

AI application security, AI usage control, AI governance platforms, and AI gateways. Application security is the largest spending category, usage control is the fastest-growing, and governance and gateways tend to stay with established enterprise vendors while application security and usage control are seeing the most new startup activity.

Should I hire an AI security specialist full-time or bring in a contractor? 

It depends on whether the need is ongoing or a one-time project. Teams shipping AI features as a core product need someone permanent eventually. Teams that need a specific policy, audit, or governance framework built quickly, especially against a compliance deadline, are often better served starting with a contractor.

How do I compare AI security vendors without spending weeks on it? 

Given how many new vendors have entered the AI application security and usage control categories recently, side-by-side comparison tools built specifically for AI software, like Alternates.ai, can cut down the research time significantly compared to evaluating each vendor's claims individually.