32.5% of security leaders plan to invest in browser security over the next 12–18 months — more than any other category, and well ahead of the second-place option.
When Neon Cyber asked 169 U.S. security and IT leaders where they plan to spend on AI security next, one category led by a margin wide enough to be worth explaining, not just reporting.
Where are security leaders planning to invest?
We asked where security and IT leaders were planning to invest in the next 12-18 months to improve security. Respondents could select multiple responses, and choices were randomized for each survey respondent. This is what they said:
- Browser security / enterprise browser: 32.5%
- AI gateways / AI-aware proxies: 26.6%
- SaaS security posture management: 20.1%
- Security awareness training: 19.5%
- DLP enhancements: 17.2%
- IAM / PAM: 16.6%
- Endpoint / EDR / XDR: 16.0%
- Network security / zero trust: 11.8%
- SIEM / SOC: 10.7%
Browser security and AI gateways are the only two categories above 21%, and together they're named by 51.5% of all surveyed leaders.
Browser security operates at the point of intent — inside the browser session, at the interface where the paste, the prompt, and the click occur. AI gateways sit further upstream, inspecting content in the network path before it reaches its destination. Both address a surface that URL filtering and traditional DLP were never designed to reach, which lines up with what leaders in this same survey named as their current blind spots.
And, though budgets are tight, it isn't what's holding back more investment, either. Asked to name their obstacles to improving AI security, leaders ranked budget constraints third:
- Lack of skills or expertise: 28.4%
- Organizational alignment / silos: 27.8%
- Budget constraints: 23.7%
- Lack of suitable tools: 23.1%
The friction, where it exists, is more likely to show up in staffing the initiative than in getting the line item signed off.
Why is browser security so critical to managing shadow AI?
For the most part, browser security layers onto the browsers a workforce already uses — no re-platforming, no isolated browser environment, no new workflow for IT to manage.
For an IT team, that means not having to manage an enterprise-wide change management process to force employees to use a specific tool.
For a security team that may lack skills and have organizational silos as its top obstacles for AI risk, easy adoption matters more than it might in a category with more mature internal expertise. That's likely part of why this category is outpacing options like IAM/PAM or DLP/SWG that typically require more specialized in-house setup.
How to build a business case for browser security?
Start with where your peers are already spending — 32.5% of security leaders name browser security their top 2026 investment, ahead of every other category.
But more than that, there's urgency because of what's already happening: 59.2% of security leaders confirmed at least one AI-related security incident in the past 12 months in a companion piece from this same research. 60% of those involved data leaking out, most weren't caught until after the fact, and employees stayed silent about the incident they were part of 82% of the time. (Read the full findings.)
If your business case needs a "what happens if we don't" section, that's where it lives: not in a projected cost, but in how common these incidents already are and how late they're typically caught.
Before the strategy and budget meetings, benchmark where you actually stand
This research shows where the market is moving. It won't tell you where your own program sits against it. This Shadow AI Exposure Assessment gives you that comparison directly — a short, structured way to see your organization's gaps against the same categories this research measured, before you walk into a budget conversation citing numbers that may or may not describe your situation.
How to use this data with the people who'll push back
Here's how these findings can help your stakeholder conversations, depending on who's asking the questions.
If the pushback is coming from finance: Don't lead with "we need more budget." The stronger ask is removing the non-budget blockers: getting clarification on ownership lanes and highlighting the lack of in-house expertise or resources. The “what happens if we do nothing” discussion earlier around AI risk and AI-security related incidents will also be critical for overcoming finance’s objections.
If the pushback is coming from IT: Lead with ease of deployment, since innovative browser security solutions no longer require dedicated, proprietary browsers — meaning no need for thorny organizational change processes. Browser security delivered as an extension ranks as a top choice because it deploys so easily and simply through an existing MDM, is compatible with all major Chromium browsers, and plugs directly into existing IT workflows, which means the resourcing constraints that would stall a larger initiative don't have to stall this one.
If the pushback is "we already have EDR/DLP/an AI gateway": Lead with how browser security is a complementary technology to these tools, not replacement. Your peers are already treating browser security and AI gateways as filling different gaps. As the two top-ranked investment categories in this research, named together by 51.5% of leaders, your peers do not think one makes the other redundant.
What to bring to the budget meeting
- Peer benchmark: 32.5% of security leaders are prioritizing browser security for 2026 — the top-ranked category, ahead of AI gateways, SaaS security (SSPM), and IAM.
- The obstacle isn't budget: Skills (28.4%) and organizational alignment (27.8%) rank above budget constraints (23.7%) as the real blockers.
- Deployment fits existing constraints: No re-platforming, no new infrastructure, deploys through existing MDM. Implementing a lightweight browser security solution is a lower lift than most competing line items.
- It's not a rip-and-replace: Position browser security and AI gateways as complementary. They help extend your existing stack to tackle the latest AI risks.
FAQs
If we already have an AI gateway, do we still need browser security too?
They cover different surfaces. An AI gateway inspects content in transit between the workforce and the AI provider; browser security observes and enforces at the point where the content is typed, pasted, or uploaded, before it ever reaches the gateway. In Neon Cyber's research, the two were the top two investment categories, together named by 51.5% of leaders — treated as complementary, not substitutes.
Our security roadmap already has six priorities for next year. How do security leaders decide whether browser security belongs in the top three?
The obstacle data in this research offers a useful filter: if your top barriers to improving AI security are skills or organizational alignment rather than budget, a single specialized tool covering a broad set of AI security use cases does more than avoid a hard deployment — it lets a stretched team lean on vendor expertise instead of building that expertise in-house from scratch. Browser security's deployment profile (no re-platforming, no new infrastructure, no change to existing browsers) means that expertise gap gets addressed without a long integration project sitting between you and the coverage. It's not the right first investment for every organization, but for teams short on specialized skills, the ability to borrow that expertise rather than hire or train for it is the real value, not just the light deployment lift.
Does "no re-platforming" mean there's no implementation work at all?
No — it means the browser employees already use doesn't change and IT doesn't stand up new infrastructure, not that deployment is zero-effort. The heavier lift is policy configuration: deciding which data categories to monitor, which actions to block versus log, and how to handle exceptions. That's where the skills and organizational alignment obstacles this survey named actually show up in practice — not in the deployment itself, but in the policy decisions that make it useful once it's running.