Cyber Teams Stretched Too Thin as Attacks Intensify and Budgets Shrink, ISACA Research Finds

ISACA's 2026 State of Cyber report found that 38% of European IT and cybersecurity professionals saw more cyberattacks this year than last. Defenses are not keeping pace: 56% reported understaffing and 55% said their organizations were underfunded, while 54% expect attacks to increase further. The findings point to growing operational and security risks for European companies, alongside potential demand support for cybersecurity spending.

Analysis

The investable implication is a widening gap between security spending intent and deployment capacity: constrained internal teams favor vendors that reduce operational burden rather than point-product vendors requiring specialist administration. This supports relative demand for platformized, AI-assisted security operations—PANW, CRWD, MSFT, and Cisco (CSCO)—with the clearest second-order benefit accruing to managed security service providers and identity vendors such as OKTA and CyberArk (CYBR). For European enterprises, tighter budgets may delay large rip-and-replace projects, favoring consumption-based, bundled, and compliance-linked purchases over discretionary appliance refreshes.

This is not independently verifiable evidence of an imminent revenue inflection; survey-based concern is broadly consistent with an already well-understood cyber-spending narrative and should not justify chasing high-multiple names after strength. The 1-3 month catalyst path is vendor earnings guidance, billings/RPO trends, and European public-sector procurement; the 6-18 month upside depends on whether AI increases attack volume faster than automation lowers customers' security labor costs. The key contrarian risk is that budget pressure drives consolidation toward Microsoft rather than incremental spend, compressing standalone vendors' net-new ARR and valuation premiums. Falsification for a platform-over-point-product thesis would be sustained acceleration in CRWD/PANW net retention and large-deal activity relative to MSFT Security growth, rather than merely elevated incident headlines.

Key Decisions for Investors

• Maintain a 3-6 month relative-overweight bias toward PANW and CRWD versus legacy security hardware exposure such as FTNT, but enter only around earnings-related volatility; target 10-15% relative upside if platform billings and RPO remain resilient. Exit the pair if PANW or CRWD reduce next-quarter billings guidance or if FTNT product revenue reaccelerates materially.
• Use MSFT as the lower-volatility cyber-budget consolidation expression over the next 6-12 months: its bundle can absorb security spend that would otherwise go to standalone vendors, while Azure and enterprise software diversify the thesis. The trade is most attractive if standalone cyber multiples expand without corresponding acceleration in net-new ARR.
• Place an alert—not a position—on OKTA and CYBR for evidence that identity projects are being pulled forward through improving remaining performance obligations, large-deal commentary, or European bookings. A confirmed acceleration could create a 6-12 month long opportunity; absent that data, valuation sensitivity and execution risk make the survey signal insufficient.
• Avoid broad HACK/CIBR ETF beta as a primary expression: it dilutes the likely winner-take-most dynamic between integrated platforms and point products. Prefer a basket of PANW/CRWD/MSFT, sized against a short FTNT only after confirming divergent forward guidance.