Kaspersky AI Security Spending Rises as Shadow AI Breaks the Control Model

Kaspersky says AI adoption has pushed 41% of enterprises to increase information security investment, even as employees keep bringing outside AI tools into work. The Kaspersky AI security spending data reveals a conflict that security teams cannot solve by purchasing another isolated product. Companies want faster AI adoption, but their existing controls often cannot see where AI is already operating.

The findings come from a global survey of 1,800 IT and cybersecurity decision-makers and specialists across 18 countries. Respondents represented industries including technology, manufacturing, finance, retail, and wholesale. Kaspersky published the global results on July 29, 2026, before regional reports brought renewed attention to the figures in September.

This is not simply another security-budget story. The harder problem is a widening gap between sanctioned enterprise AI and shadow AI, meaning AI tools used without formal approval or oversight. Organizations are funding adoption and protection simultaneously, while employees can still move corporate information through personal accounts, browser extensions, specialized assistants, and embedded AI features.

The central contest is therefore controlled AI adoption versus employee-led adoption. Blocking outside tools can push activity further from view. Permitting everything can expose sensitive data, credentials, internal documents, and business processes to systems that security teams did not evaluate.

What Kaspersky AI Security Spending Data Actually Says

The headline figure matters because AI adoption has become a direct security-budget driver, not merely another item on a threat list.

According to Kaspersky’s global survey, 41% of enterprises increased information security investment because of AI adoption. Other reported drivers included rising breach costs, cloud migration, and recent security incidents.

That result does not mean 41% expanded budgets only because of shadow AI. It also does not reveal the size of each increase. The published findings establish a relationship between adoption and spending decisions, but they provide no dollar totals or budget-growth distribution.

The broader responses help explain why budgets are moving. Nineteen percent of respondents ranked AI vulnerabilities among their most dangerous current threats. Phishing ranked higher at 22%, followed by mass malware attacks at 20%.

Those numbers put AI risk near established enterprise threats without displacing them. Security leaders must protect conventional systems while adding model access, prompts, plugins, agents, training data, and AI-generated code to their responsibilities.

The pressure is especially important in finance, government, and technology, according to Kaspersky. These sectors handle valuable data and operate systems that attackers have strong incentives to target. They also face significant pressure to automate knowledge work and customer-facing processes.

Adoption is not waiting for security programs to catch up. Kaspersky reported that 81% of surveyed companies were exploring or deploying internal tools powered by large language models. Eighteen percent had integrated those technologies into workflows.

Companies with internal AI systems cited three equally common motivations. Improved process efficiency, reduced human error, and better client deliverables were each selected by 59% of those organizations.

A related Kaspersky release found that employees were already using AI across several work categories. Data analysis and visualization led at 54%, followed by project management at 49% and information search at 47%. Department-specific work reached 46%, while text generation and editing reached 41%.

These use cases stretch across many data types. A project assistant might receive customer requirements, deadlines, and employee assignments. An analysis tool might process financial records, operational metrics, or exported database content.

The security boundary changes whenever that information reaches a model, plugin, or AI-enabled service. Teams must know who supplied the data, which account processed it, how long it remains available, and what connected systems the tool can reach.

This is why the spending shift extends beyond protecting models from technical attacks. It also covers identity, data classification, vendor review, network visibility, software development, incident response, and employee training.

Kaspersky has an obvious commercial interest in emphasizing those needs. The company sells security products and recommends its own services alongside the research. Readers should treat the percentages as vendor-sponsored survey evidence, not as an independent measure of the entire market.

Still, the sample covered 1,800 security-focused professionals across 18 countries. The findings capture a clear organizational concern: AI projects are creating expenses outside the original software license or infrastructure budget.

Every additional assistant can create another identity path, data flow, and vendor dependency. Every internal model can add infrastructure, monitoring, access, and testing requirements. Security spending is becoming part of the operating cost of enterprise AI.

That is the first important change. AI security no longer begins after a company deploys a major model. It begins when workers search for faster ways to complete ordinary tasks.

AI Adoption Is Expanding the Attack Surface

Enterprises are not only defending against AI-assisted attackers; they are adding AI systems that create new places for mistakes and exploitation.

An attack surface includes the systems, identities, interfaces, and data paths that an attacker can potentially reach. AI adoption expands it through model endpoints, retrieval systems, plugins, prompt inputs, autonomous actions, and third-party integrations.

These components introduce familiar software risks in unfamiliar combinations. Weak access control remains weak access control, but an AI agent can exercise that access across several tools. An exposed credential remains dangerous, but a connected assistant can use it at machine speed.

Kaspersky reported a sharp rise in recorded flaws affecting AI and large language model services. Its vulnerability analysis counted 935 vulnerabilities in the second quarter of 2026.

That figure was ten times the level recorded in the fourth quarter of 2025, according to the company’s vulnerability-management data. Kaspersky classified 119 of the second-quarter vulnerabilities as critical, almost five times the late-2025 level.

The most common categories included weak access controls, faulty authentication or authorization, and injection vulnerabilities. Injection occurs when manipulated input changes how a system interprets instructions or executes connected actions.

The increase requires careful interpretation. More recorded vulnerabilities can reflect greater deployment, increased researcher attention, better disclosure, or a genuine decline in software quality. The published totals do not separate those effects.

Even so, the categories point toward concrete engineering problems. Enterprises must secure the software surrounding models, not just examine the models themselves. Authentication, permission boundaries, input handling, logging, and dependency management remain essential.

AI agents raise the stakes because they can take actions rather than only produce text. An assistant connected to email, cloud storage, code repositories, and calendars has a larger potential impact than a standalone chatbot.

The agent also complicates attribution. A legitimate employee might authorize an action, while manipulated context changes what the system ultimately does. Security logs must preserve the user request, model decision, tool call, target resource, and resulting change.

The OWASP Foundation’s agentic security guidance addresses this broader governance problem. Its 2026 work focuses on securing autonomous systems through controls that span development, deployment, identity, and oversight.

That approach matters because traditional endpoint protection sees only part of the workflow. A browser session may look legitimate even when an employee pastes restricted material into an approved website. A valid agent token can still authorize an unsafe action.

Security teams therefore need several layers of evidence. They need an inventory of AI services, visibility into data movement, controls for connected identities, and a review process for high-impact actions.

The same principle applies to AI-generated code. A developer can accept a suggested dependency or configuration without understanding its security properties. The result then enters the normal software supply chain and may reach production.

Kaspersky also said its systems detected more than 33,300 attacks on small and medium-sized businesses during the first four months of 2026. Those attacks disguised malicious or unwanted PC software as popular AI services.

That total was almost five times the comparable 2025 period, according to the company. The finding shows how attackers can exploit demand for AI without compromising an actual model. Familiar social engineering can ride on AI branding.

The practical lesson is broader than purchasing AI-specific detection. Companies need to connect AI governance with existing security disciplines. Asset management, identity controls, secure development, vendor assessment, and incident response must share the same view of deployment.

This creates pressure on chief information security officers, but it also reaches technology and business leaders. A department that buys an AI service has made a security decision, even when the purchase never passes through the security budget.

A team building an internal assistant makes another decision when it chooses data sources and permissions. The risk changes again when that assistant gains the ability to send messages, modify records, or initiate transactions.

The attack surface is therefore shaped by business design. Security teams cannot reduce it without understanding which AI functions deliver value and which connections are unnecessary. That requires cooperation before deployment, not an approval meeting after launch.

Shadow AI Turns Productivity Into Governance Debt

Shadow AI grows when approved tools fail to match the speed, capability, or convenience that employees can obtain independently.

Kaspersky found that 31% of global respondents considered uncontrolled employee use of third-party AI tools a common risk factor. The company specifically cited services such as ChatGPT and DeepSeek.

The risk is not limited to workers deliberately breaking rules. AI features now appear inside writing tools, search products, meeting assistants, coding environments, analytics platforms, and browser extensions. Employees may not recognize every AI-enabled function as a separate data processor.

Kaspersky reported that 59% of organizations permitted third-party AI under restrictions. Those restrictions included prohibitions against uploading company names or internal documents. Another 23% allowed unrestricted access while providing guidance and training.

Together, those figures show that most surveyed organizations were not attempting a total ban. They were trying to preserve useful access while limiting harmful behavior.

That compromise is difficult to enforce. A rule against uploading internal documents sounds clear until employees work with fragments. A prompt can reveal sensitive information without containing an entire file.

A sales employee might paste customer objections into an assistant. An engineer might submit a code block containing internal endpoints. A recruiter might ask a tool to summarize candidate notes or compensation discussions.

Each action can feel smaller than uploading a confidential document. Collectively, those prompts can expose organizational relationships, product plans, customer information, and technical architecture.

Shadow AI also includes personal accounts used for company work. A service approved for enterprise use may still create risk when employees choose consumer accounts. Security teams can lose administrative controls, retention settings, audit records, and centralized access removal.

This reveals the main weakness in policy-only responses. A written rule describes expected behavior, but it cannot automatically discover tools, classify prompts, or revoke unknown integrations. Training helps people recognize risk, yet memory is not a technical control.

A total ban creates a different weakness. Employees still face deadlines and performance expectations. If an external assistant shortens hours of work, some users will seek personal devices, alternate accounts, or less visible services.

The company then loses the limited visibility available through managed systems. Blocking can reduce casual use, but it can also make the remaining activity harder to measure.

The better comparison is therefore not permissive access versus strict security. It is visible, governed access versus invisible, improvised access. Security improves when the approved route is useful enough to attract voluntary adoption.

That route needs more than a company subscription. Employees need clear guidance about acceptable data, supported tasks, and escalation paths. They also need approved alternatives that fit different jobs.

A developer may need code-aware assistance and repository context. A researcher may need document analysis with traceable sources. A project manager may need summaries across meetings, tasks, and decisions.

For knowledge-intensive workflows, teams should understand the difference between a shared enterprise repository and a personal system before granting AI access. A practical knowledge base guide can help frame ownership, scope, and retrieval decisions.

Governance debt accumulates when companies deploy capabilities before defining those boundaries. Like technical debt, it remains hidden while systems appear to work. The cost becomes visible during an audit, incident, employee departure, or vendor change.

AI can accelerate that accumulation because adoption is often decentralized. A marketing team can activate an assistant without waiting for a central deployment. A developer can connect a model through an application programming interface within hours.

Embedded AI creates another blind spot. A company might approve a software platform before that vendor adds an assistant or automated agent. The organization’s earlier assessment may not cover the new data path or model provider.

Vendor review must therefore become continuous enough to capture material feature changes. Contracts should address data use, retention, subprocessors, incident notification, and administrative controls. Technical teams must verify that configured behavior matches those terms.

Inventory is the starting point, but inventory alone is not governance. Security teams must distinguish experimentation from production, low-risk drafting from sensitive analysis, and read-only assistants from agents that can change systems.

That classification determines the controls. A public brainstorming tool should not receive customer records. An internal retrieval assistant needs permissions that mirror the underlying sources. An action-taking agent needs narrower authority and stronger approval gates.

The core tradeoff remains unavoidable. Every guardrail adds friction, while every removed control increases exposure. The winning design will not eliminate that tension, but it can place friction where consequences are highest.

Companies should reserve the strictest checks for sensitive information and consequential actions. Low-risk tasks can use simpler controls. This risk-based model offers employees a credible path without treating every prompt as equally dangerous.

The Survey Shows Pressure, Not Proof

Kaspersky’s findings show that security leaders feel pressure, but they do not prove that higher spending has produced safer AI adoption.

The 41% figure measures organizations that increased investment because of AI adoption. It does not measure whether those organizations reduced incidents, discovered shadow AI, or prevented data exposure.

The survey also combines decision-makers and specialists across multiple industries and countries. That breadth makes the pattern relevant, but it can hide significant differences in organizational size, regulation, maturity, and threat exposure.

Kaspersky’s publication does not provide a full questionnaire, response distribution, sampling procedure, or margin of error. It also does not break the 41% figure into investment categories. Buyers could be funding products, personnel, consulting, training, or infrastructure.

Those limitations do not invalidate the results. They narrow what readers should conclude. The research supports a statement about reported budget behavior, not a verdict on security effectiveness.

Vendor sponsorship creates another reason for caution. Kaspersky recommends its own security portfolio in the same publication. Its commercial position does not make the survey false, but independent validation would strengthen broader market claims.

The risk metrics also depend on respondent perception. Nineteen percent called AI vulnerabilities a leading danger, while 31% identified shadow AI as a common factor. Those answers describe awareness and experience, not independently verified incident counts.

A separate Kaspersky release said 82% of organizations expressed concern about AI risk. Among the 87% that experienced a cyber incident during the previous year, 13% reported threats arising specifically from AI-related vulnerabilities.

Again, attribution is hard. An incident involving AI-branded malware differs from an exploited model service. Data leakage through an employee prompt differs from an agent acting on malicious instructions.

Combining every case under “AI risk” can lead to vague spending. Companies might purchase overlapping monitoring products without defining the exposures they need to reduce. They may also treat governance as a security-team responsibility alone.

The National Institute of Standards and Technology offers a more structured starting point. Its generative AI profile adapts the AI Risk Management Framework to risks across generative AI development, deployment, and use.

The framework organizes work around governing, mapping, measuring, and managing risk. That sequence encourages organizations to define context before selecting controls. It also treats risk management as a lifecycle process.

For an enterprise, “govern” includes ownership, accountability, and policies. “Map” means understanding systems, users, data, and consequences. “Measure” covers testing, monitoring, and evidence. “Manage” turns that evidence into prioritized action.

This structure exposes a weakness in spending-led responses. A company can buy tools before it maps where AI appears. It can collect alerts before deciding which behaviors matter. It can train employees without measuring whether risky practices change.

Effective spending should produce observable outcomes. The organization should know which AI services are active, which data categories reach them, and which identities can authorize external actions.

It should also know whether employees prefer sanctioned tools. Low adoption of approved services can signal missing capabilities, excessive friction, weak communication, or distrust. That is a governance measurement, not merely a software metric.

Security teams should track review times for new tools. Long approval cycles can encourage unsanctioned alternatives. Faster reviews do not require lower standards if organizations use repeatable risk categories and preapproved configurations.

Incident exercises offer another test. Companies can simulate a leaked AI credential, a malicious plugin, a sensitive prompt, or an agent making an unauthorized change. The response exposes gaps that budget totals cannot reveal.

Procurement should measure vendor dependencies and exit options. An organization needs to know whether it can export logs, remove data, revoke integrations, and migrate workflows. Those capabilities become important when products change terms or security posture.

None of this guarantees safety. AI systems are changing quickly, and organizations will face imperfect information. The reasonable goal is controlled learning with evidence, not a promise that every risk has been eliminated.

The Kaspersky AI security spending trend becomes meaningful only when investment improves visibility and limits consequences. Otherwise, rising budgets can coexist with expanding shadow AI and weak accountability.

Three Signals That Will Test the Spending Shift

The next test is whether higher budgets produce measurable control without driving employees toward even less visible tools.

The first signal is discovery. Over the next several months, enterprises should report whether they can identify AI services, personal accounts, embedded features, and agent integrations across their environments.

Discovery matters because policies cannot govern unknown activity. A useful inventory should connect each service to an owner, business purpose, data classification, identity method, and set of external connections.

If organizations publish stronger visibility metrics, the spending thesis gains support. It would show that security investment is turning unknown activity into managed activity. Flat visibility would suggest that spending remains detached from adoption.

The second signal is the adoption rate of sanctioned tools. Companies should compare approved usage with blocked attempts, exception requests, and employee demand for alternative systems.

High approved adoption would indicate that governance and productivity can coexist. It would also reduce the incentive to use personal accounts for ordinary work. Persistent workarounds would weaken claims that existing programs address shadow AI.

The quality of approved tools matters more than the number of licenses purchased. A sanctioned assistant that cannot access needed information or support specialized tasks will not displace better outside options.

Organizations should examine which groups avoid the approved route. Engineers, researchers, sales teams, and analysts have different requirements. A single general assistant may not satisfy every workflow.

The third signal is incident evidence. Companies need consistent definitions for AI-related events, including model vulnerabilities, exposed credentials, unsafe generated code, sensitive prompts, malicious plugins, and unauthorized agent actions.

Clear categories would improve comparisons between periods and organizations. They would also reveal whether the main exposure comes from attackers, software flaws, employee behavior, or excessive permissions.

A decline in repeat incidents would strengthen the case for current spending. Rising detection numbers would require more context. They might reflect worsening exposure, or they might show that improved monitoring is finally finding hidden activity.

Security leaders should therefore pair incident totals with time to detect, time to contain, affected data, and business impact. They should also document which control failed and which change followed.

The technical market will offer another layer of evidence. New agent security standards, updated vulnerability guidance, and broader audit support will show whether vendors can deliver interoperable controls.

Interoperability matters because AI workflows cross many systems. A model provider, identity platform, data source, browser, endpoint, and security service may all observe different parts of one transaction.

Organizations need records that can be connected across those layers. Without that connection, an investigation becomes a manual reconstruction of partial logs. Autonomous actions make that delay more costly.

Security investment should also include people who understand both workflows and controls. A monitoring platform cannot decide whether a task is appropriate for a department. That judgment requires business owners, legal teams, security specialists, and users.

Employee education remains necessary, but companies should avoid presenting workers as the sole problem. Staff often adopt outside tools because official processes do not meet operational needs.

The durable response is to make safe behavior easier. That means useful approved tools, clear data boundaries, quick review channels, narrowly scoped permissions, and visible accountability for high-impact actions.

Kaspersky’s research captures a real budget transition. AI is no longer funded only through experimentation, infrastructure, or productivity programs. Security has become part of the adoption bill.

The unresolved question is whether enterprises are buying control or merely buying reassurance. Budget growth alone cannot answer it. Inventory coverage, sanctioned usage, and incident outcomes can.

For enterprise buyers, the immediate action is straightforward: ask what new evidence each security investment will produce. If a product cannot improve visibility, constrain access, or shorten response, its connection to AI risk remains uncertain.

Developers should ask which permissions an assistant truly needs. Knowledge workers should check which data is safe to submit and which account governs the interaction. Leaders should compare policy with actual employee behavior.

Kaspersky AI security spending will remain a useful market signal, but shadow AI is the harder operational test. Over the next quarter, watch whether companies can bring real work into governed systems without removing the value that drove adoption.