The Security Training Budget Isn't Shrinking. It's Being Redirected to AI
October 16, 2026
Randy Hall, CEO— AI-assisted and reviewed prior to publication.
Security leaders no longer face a simple yes-or-no question on training spend. The money is still there in aggregate, but it's being rationed toward specific skills, and AI governance credentials are winning that competition for budget over general awareness training. If your next certification request doesn't tie to AI risk, it's facing a harder sell than it did two years ago.
Is the Security Training Budget Actually Shrinking?
No, not in total. What's shrinking is leadership's willingness to fund training without a clear skills target attached to it. The 2025 ISC2 Cybersecurity Workforce Study found that reports of budget cuts held at 36%, down only one point from the prior year, meaning the sharp cuts of 2023 and 2024 have leveled off rather than deepened. Corporate training spend overall actually grew, with U.S. employee training expenditures reaching $102.8 billion in 2025, a 4.9 percent increase year over year.
What changed is the filter leadership applies before approving a line item. Fortinet's 2025 skills gap research found that only 73 percent of organizations would now pay for an employee's cybersecurity certification, down from 89 percent in 2023. That is not a budget freeze. It is a sixteen-point drop in blanket approval, which tells you the money moved rather than vanished. At the same time, 62 percent of decision makers said a breach made them mandate certifications for staff, so the willingness to spend is still there when the business case is explicit.
ISACA's State of Cybersecurity 2025 report adds a harder data point on where that tightening is landing. Only 29 percent of enterprises trained non-security staff to move into security roles, down from 41 percent the prior year, even though nearly half of current cyber staff originally transitioned in from outside the field. General upskilling pipelines are the first thing to get deprioritized. Specific, defensible, risk-tied credentials are the opposite.
Which Certifications Are Actually Winning Budget Approval Right Now?
The ones that map directly to a named, current risk the board already worries about, and right now that risk is AI. ISACA launched its Advanced in AI Security Management (AAISM) credential in August 2025, built specifically for security leaders who already hold CISM or CISSP and need to prove they can govern AI risk rather than just discuss it. The prerequisite structure is deliberate. AAISM is open only to professionals who already hold CISM or the related CISSP credential, which signals this is a budget line for people already trusted with security decisions, not an entry-level add-on.
The demand data backs up why that credential cleared budget review so fast. ISACA's own AI Pulse Poll found that 89 percent of digital trust professionals say they'll need AI training within two years to keep or advance their roles, with 45 percent saying they need it within six months. That is not a long-range planning concern. It is a near-term staffing gap that a CFO can see coming, which is exactly the kind of risk that survives a tightened training budget rather than getting cut from it.
The same pattern shows up on the ISC2 side. A recent industry report found nearly half of respondents, 47 percent, said their companies now consider AI the single most important skill for employees to learn, and that security training budgets are rising specifically to prepare teams for AI-driven work. Put those two data points together and the shape of the decision becomes clear. Leadership isn't asking "should we fund certification training." It's asking "does this specific credential address a risk we can name," and AI governance currently answers that question better than almost anything else on the table.
Why the Old Blanket Training Model Is Losing the Argument
A blanket "send everyone to a conference and a cert" training model never had a tight feedback loop back to risk reduction, and boards have stopped tolerating that looseness. Research from Splunk's security visualization team, cited in a CSOonline analysis, found that 36 percent of CISOs reported scaling back or eliminating security training due to budget constraints, and 45 percent of that same group went on to experience a successful breach or attack. That correlation is the argument every CISO now has to make in reverse: training cuts that look like easy savings show up later as incident costs, and leadership increasingly tracks that line.
That is also why generic awareness training gets cut before role-specific credentials do. A board can't easily connect "we ran an annual phishing refresher" to a dollar figure of risk avoided, but it can connect "our security managers are certified to govern the AI tools we just deployed" to a specific, nameable exposure. The credential with the clearer causal story to risk wins the budget line, every time, regardless of how good the underlying training content actually is.
What This Means for Your Next Certification Decision
If you're deciding where to spend training dollars this cycle, the data points toward a short list rather than a scattershot approach. Consider these questions before submitting a request:
- Does this certification map to a risk the board has already named out loud, or does it require you to first educate leadership on why the risk matters?
- Is it a credential that builds on something your team already holds, the way AAISM builds on CISM and CISSP, or does it require starting a certification track from zero?
- Can you point to a specific operational decision, like approving an AI vendor or signing off on an agentic workflow, that the certified person will now be qualified to make?
Certifications that answer all three tend to clear approval faster than broad, foundational requests, even when the broad request is objectively still valuable. That's a real tradeoff and it's worth naming to your own leadership rather than pretending the old blanket model still works the way it did three years ago.
If you're building out a security management track inside your own team, a good first move is checking a current curriculum overview against the skills your organization has actually named as priorities, which is exactly what the Forge University resources page is built to help you do before you commit budget to a specific path. For teams where CISM or CISSP holders are already on staff and the next conversation is about AI governance specifically, the AAISM certification prep is the direct next step rather than a parallel one.
None of this means skip foundational training entirely. It means sequence it deliberately, and make the AI-adjacent step explicit rather than assumed. If you want a study plan built around where your team's skills actually sit today, you can start training whenever you're ready rather than waiting for the next budget cycle to force the decision.
The broader lesson for anyone managing a security training budget in 2026 is that the fight isn't over whether training survives. It already has, at $102.8 billion and rising nationally. The fight is over which specific credentials get named in the approved line item, and right now the ones tied to AI governance and risk management are winning that argument on the strength of the data alone.