2026 cybersecurity budgets are shifting toward identity and containment

At a glance

What this is: Elisity argues that 2026 cybersecurity budgets are moving toward identity controls and containment as spending rises and attacker movement accelerates.

Why it matters: For IAM, PAM, NHI, and Zero Trust teams, the budget signal is clear: organisations are buying controls that limit blast radius, govern privilege, and slow lateral movement rather than simply adding more tools.

By the numbers:

• Gartner projects global cybersecurity spending will reach $240 billion in 2026, a 12.5% increase over 2025.
• Most enterprises should spend 8% to 12% of their total IT budget on security, rising to 10% to 15% in high-threat industries.
• The average time from initial compromise to lateral movement has dropped to 48 minutes, according to CrowdStrike and ReliaQuest data cited by Elisity.
• Microsegmentation can reduce vulnerable lateral movement paths by 70% to 90%, according to Elisity's budget analysis.

Context

Cybersecurity budgeting is no longer just a capacity planning exercise. When attackers can move from initial access to lateral movement in under an hour, spending decisions have to focus on control points that change the shape of an incident, not just the number of tools in the stack.

This article ties spending growth to a governance problem that IAM, PAM, NHI, and Zero Trust teams already see in practice: too many environments still rely on detection that arrives after the attacker has moved. Identity controls and containment are becoming the budget categories that matter because they reduce standing access, limit blast radius, and make compromise harder to turn into enterprise-wide impact.

Key questions

Q: What breaks when organisations rely on detection but leave lateral movement paths open?

A: Detection can confirm compromise, but it cannot stop a compromised identity from reaching every system it is allowed to touch. When internal paths remain open, the incident becomes a breach through spread, not through the first entry point. Teams need containment controls that reduce the reachable blast radius before analysts finish triage.

Q: Why do privileged accounts and standing access drive higher cybersecurity costs?

A: Because persistent privilege forces organisations to invest more in monitoring, investigation, and recovery after compromise. If access is broad and long-lived, one stolen credential can unlock multiple systems and create a much larger containment problem. Narrower privilege reduces the cost of every other defensive layer.

Q: How do security teams know whether containment is actually working?

A: They should test whether the identity can still execute privileged actions after revocation, not just whether the API call succeeded. A working containment model prevents re-escalation, blocks credential regeneration, and remains effective even when the target is polling for state changes. If any of those fail, containment is only partial.

Q: Should IAM, PAM, and microsegmentation be funded before more monitoring tools?

A: When lateral movement is fast and credential abuse is common, yes in many environments. Monitoring tells you that compromise happened, while IAM, PAM, and microsegmentation limit what the attacker can do next. The right sequence is to reduce reachable privilege first, then improve detection around the remaining risk.

Technical breakdown

Why budget growth is flowing toward identity and containment

Cybersecurity budgets are rising because the control model is changing. Traditional perimeter assumptions break down once attackers use legitimate credentials, move laterally in minutes, and exploit flat internal networks. That pushes spend toward identity governance, privileged access management, and segmentation because those controls act at the point where trust is granted and where movement is constrained. The practical shift is from buying more visibility to buying narrower trust boundaries and shorter access windows.

Practical implication: prioritise controls that reduce reachable access paths rather than adding another layer of alerting.

How microsegmentation changes the economics of breach containment

Microsegmentation changes the unit of defence from the network perimeter to the workload or segment. Instead of assuming a compromised identity or host can traverse an environment freely, segmentation enforces explicit communication paths and blocks unauthorised east-west movement. In budget terms, that reduces the blast radius of one compromise, which is why it competes well against broad control sprawl. For identity teams, the link matters because segmented environments make privileged access and machine identity scope far more governable.

Practical implication: map your highest-risk applications and identities to containment boundaries before expanding detection tooling.

Why lateral movement speed turns IAM into a containment control

The article's budget logic is rooted in speed. If attackers can reach lateral movement in 48 minutes, identity review workflows that take days or weeks are not a sufficient compensating control. That makes IAM, PAM, and NHI governance part of incident containment, not just access administration. Short-lived privilege, stronger authentication, and tighter account scoping matter because they determine whether an initial compromise becomes a network-wide event or stops at first access.

Practical implication: treat privilege scope and credential lifetime as containment variables, not only governance metrics.

Threat narrative

Attacker objective: The attacker objective is to turn a single foothold into broad internal access that supports theft, disruption, or ransomware impact.

1. Entry occurs through legitimate credentials, exposed services, or other initial access paths that let attackers blend into normal traffic.
2. Escalation follows when standing privilege, flat internal access, or weak segmentation lets the attacker reach additional systems quickly.
3. Impact arrives when lateral movement converts one compromise into broader intrusion, ransomware spread, or environment-wide disruption before human response can catch up.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Budget planning is now an identity governance decision, not a tool-counting exercise. When credential abuse drives a large share of intrusions, the most defensible spend is on controls that change who can move, what they can reach, and how long privilege lasts. That makes IAM, PAM, and NHI governance central to resilience, not adjacent to it. Practitioners should budget for access scope reduction as a core security outcome.

Containment has become the economic logic of Zero Trust. The article correctly frames microsegmentation as a spending priority because it converts a compromise from an enterprise event into a bounded one. That is not just a network design issue, it is a governance issue for identities and workloads because containment only works when privileged pathways are defined and enforced. Practitioners should align budget requests to reduced blast radius, not abstract architecture language.

Standing privilege is now a cost multiplier. Environments that preserve broad, persistent access force organisations to buy more monitoring, more response capacity, and more recovery capability. Short-lived and tightly scoped access changes the economics by limiting what an attacker can do after a foothold. Practitioners should use budget cycles to reduce persistent privilege where it creates unnecessary lateral movement exposure.

Microsegmentation is a named response to containment fatigue. Many programmes accumulate visibility tools without materially narrowing attack paths, which creates the appearance of maturity without the security effect. Containment fatigue is what happens when organisations keep funding detection while leaving east-west movement largely untouched. Practitioners should treat segment design as a control objective that deserves its own budget line.

What this signals

Identity controls now belong inside the breach-containment budget. Organisations that still separate IAM from network containment are treating the attacker’s path as two different problems when it is one chain. The stronger programme design is to fund privilege reduction and east-west restriction together, because that is where the attack is stopped.

Containment fatigue is a real governance risk. Many teams keep buying visibility, logging, and response orchestration while leaving the internal network shape largely unchanged. That produces activity without materially changing blast radius, and it is exactly the gap attackers exploit when compromise-to-movement times keep shrinking.

For practitioners

• Build the budget around blast-radius reduction Link spending requests to fewer reachable systems, shorter privilege duration, and lower lateral movement potential rather than to tool volume.
• Prioritise microsegmentation for critical segments Start with high-value workloads, crown-jewel applications, and known lateral movement corridors where containment changes incident outcomes most.
• Reduce standing privilege before buying more monitoring Review admin, service, and workload access that persists beyond task scope and remove unnecessary persistence where it increases containment cost.
• Tie identity controls to Zero Trust budget lines Separate funding for MFA, PAM, identity governance, and workload access control so the programme reflects how attackers actually move.

Key takeaways

• Cybersecurity budget growth is being pulled toward controls that restrict movement, not just controls that detect compromise.
• The operational evidence points to a shrinking window between initial access and lateral movement, which makes containment more valuable than ever.
• Identity governance, privileged access, and microsegmentation now function as one budget conversation because they determine whether a foothold stays local or spreads.

Key terms

• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and workload identity alongside agentic AI identity and secrets management. It is designed for practitioners who need to connect access governance to broader security decision-making.