Topic starter
21/08/2026 4:51 pm
TL;DR: 85% of organisations increased security spending this year, yet 56% of security professionals still say budgets are insufficient, exposing a detection-to-resolution mismatch rather than a simple funding problem, according to Pixee. The real constraint is remediation capacity, and that makes automation, consolidation, and exploitability-driven triage more urgent than adding another scanner.
Editorial analysis by NHI Mgmt Group, based on content published by Pixee: “The $19M Paradox: Why Security Spending and Security Debt Both Keep Rising”.
By the numbers:
- 85% of organisations increased security spending this year, according to Pixee.
- 88% plan to spend even more next year, according to Pixee.
- 56% of security professionals do not believe their budgets are sufficient to counter the risks they face, according to Pixee.
Key questions
Q: What breaks when security tools generate more fixes than teams can review?
A: The review queue becomes the control failure point.
Q: Why do higher security budgets still leave remediation behind?
A: Because budget often flows to discovery tools, monitoring layers, and staffing for triage instead of to the workflow, ownership, and automation needed to close findings.
Q: What are the signs that a security programme is drowning in tool noise?
A: Common signs include duplicate findings across platforms, large percentages of alerts going unexamined, slow movement from discovery to fix, and analysts spending more time reconciling outputs than reducing exposure.
Practitioner guidance
- Rebalance spend toward remediation throughput Shift budget review from tool acquisition to the proportion of spend that reduces open findings, closes exposed paths, or automates fixes.
- Measure backlog by exploitability Classify findings by whether they are reachable in the current environment, then prioritise the issues that combine exposure with realistic attack paths.
- Consolidate overlapping security tools Inventory duplicate scanners, dashboard layers, and correlation workflows that create repeated findings without improving resolution.
Bottom line: Security programmes fail when they optimise for finding issues faster than they can fix them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:10 pm
Security debt is the real governance problem here: when organisations discover more issues than they can fix, they are not failing at visibility, they are failing at control ownership. A mature programme should treat unresolved findings as operational debt with an explicit service level, not as a permanent side effect of better scanning. The practitioner conclusion is to govern backlog reduction as a security outcome, not a hygiene task.
A few things that frame the scale:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should teams decide whether to invest in more tools or more automation?
A: They should prioritise the option that shortens the path from discovery to closure. If the main constraint is remediation capacity, adding more detection only widens the gap. Automation is the better bet when the organisation already knows what to fix but lacks the throughput to fix it consistently.
👉 Read our full editorial: Security budgets are rising while remediation capacity falls behind