AI-driven cyber threats spur surge in intel spending

Most cybersecurity professionals expect to increase spending on threat intelligence in 2026 as concern grows over AI-assisted attacks and state-backed hacking campaigns, according to new industry research from Recorded Future.

The study surveyed more than 600 cybersecurity professionals across multiple sectors. It found that 91% plan to invest more in threat intelligence next year.

Respondents cited AI-assisted cyberattacks as a rising risk. They also highlighted state-sponsored operations and disruption from cybercriminals as key drivers of investment.

Rising AI risk

The report found that many security teams see artificial intelligence as a force multiplier for attackers. They expect adversaries to use AI to automate tasks and increase attack volume.

Richard LaTulip, a Field Chief Information Security Officer at Recorded Future, said organisations now face an expanded threat environment.

"AI has lowered the barrier to entry for cybercriminals, enabling them to scale the speed, volume and frequency of attacks. This is occurring against a backdrop of increasingly sophisticated state-sponsored cyberthreats and high-profile ransomware attacks that can disrupt businesses and markets for weeks and months," said LaTulip.

The research suggests many organisations are rethinking long-established cybersecurity models. It indicates a shift from incident-driven responses towards continuous monitoring of external threats.

Focus on threat intelligence

Threat intelligence refers to data and analysis about adversaries, their tools and their methods. Security teams use this information to understand who might attack them and how.

Recorded Future's study found that 68% of professionals use threat intelligence to enhance existing security tools. These tools include firewalls, intrusion detection systems and endpoint protection platforms.

More than half of respondents, 58%, said that awareness and understanding of the threat landscape guides business risk assessment. This information influences how organisations judge their most critical vulnerabilities.

A third of respondents, 32%, use knowledge from proactive monitoring of cyberthreats in daily decision-making. Security leaders apply this data when setting priorities and allocating team workload.

Budgets and teams

The report also examined current spending levels. It found that three quarters of organisations, 76%, invested more than GBP £188,000 (USD $250,000) in threat intelligence in 2025.

The research showed that 83% of organisations now have dedicated, full-time threat intelligence teams. These teams collect, analyse and disseminate threat data across the business.

Insights from threat intelligence programmes also influence procurement decisions. The report said 65% of respondents use threat intelligence findings to guide purchasing of security technology.

LaTulip said organisations are reshaping cybersecurity strategies around this intelligence-led model.

"Organisations realise cyberthreats are constantly shifting and want to be better informed about what they are up against. This is driving investment in threat intelligence, with cybersecurity evolving from a reactive, defensive approach to a proactive, holistic strategy that better informs risk management and security," said LaTulip.

Operational impact

The survey asked security professionals how threat intelligence programmes affect day-to-day operations. Over half, 54%, said such programmes improve threat detection and response times.

Half of respondents, 50%, reported improved security team efficiencies. They said structured threat data enables faster triage and incident handling.

Two in five respondents, 40%, saw a reduction in the number of incidents after implementing threat intelligence programmes. Organisations attributed this fall to better preparation and targeted controls.

Some teams also reported improvements in strategic planning. A total of 37% said they can better prioritise security efforts when they have clearer insight into the most relevant threats.

LaTulip said these changes affect staff wellbeing as well as technical outcomes.

"Threat intelligence programmes are helping cybersecurity teams to avoid burnout. Rather than being overwhelmed by constant threats, professionals can prioritise the highest risks and concentrate on addressing these before they materialise into full-blown attacks. Budget, time and resource can be better managed, while also improving the speed and effectiveness of incident response," said LaTulip.