Artificial intelligence has moved beyond being a promise and has become a reality that is redefining the cybersecurity landscape. Both businesses and governments face a dual challenge: on the one hand, harnessing the potential of AI to defend against increasingly sophisticated attacks; on the other, protecting themselves from the risks that the technology itself introduces. In this context, Spain is positioning itself as a key player , with public and private initiatives seeking to balance the scales.
The market for AI applied to cybersecurity is experiencing unprecedented growth. According to NTT DATA's Technology Foresight 2026 report, global investment will increase from $28.000 billion in 2024 to $79.800 billion in 2029 , nearly tripling in just five years. This growth reflects the need for organizations to protect an increasing amount of data, digital services, and identities, while security teams cannot keep pace. Automation and threat detection are becoming priorities, but a new front is also emerging: protecting the AI ​​models themselves.
The AI ​​market in cybersecurity is booming
The consulting firm NTT DATA ranks this segment among those with the greatest technological growth in the coming years. The attack surface is constantly expanding , and cybercriminals are also using AI to automate tasks, personalize social engineering campaigns, and improve impersonation techniques using deepfakes. José Manuel Moreno Guerra, Cybersecurity Director at NTT DATA, warns that "what is most concerning is AI's ability to make attacks faster, more scalable, and more convincing." This situation is already leading Spanish companies to increase their budgets: according to a PwC study, 60% of executives consider cybersecurity investment among their top three strategic priorities.
Furthermore, the latest data from the INE (National Institute of Statistics) shows that 21,1% of companies with ten or more employees were already using artificial intelligence technologies in the first quarter of 2025, a figure significantly higher than the previous year. The adoption of AI is advancing rapidly in the Spanish productive sector , but so is the risk. Kaspersky detected more than 33.300 attacks on SMEs impersonating popular AI services between January and April, and 13% of Spanish companies are already reporting incidents linked to AI vulnerabilities.
Spain is committed to AI and cybersecurity
In this context, public administrations are taking action. The Basque Government has increased its digital transformation programs for SMEs to €28 million this year, with €14 million earmarked for Artificial Intelligence projects and another €14 million for Industrial Cybersecurity. These grants, which cover up to 60% of the project cost with a maximum of €100.000 per company , are part of the Basque Country's industrial protection plan to address the consequences of the Middle East conflict. Regional Minister Mikel Jauregi noted that, according to the World Economic Forum, "in OECD countries, 80% of companies will adopt AI in their processes within the next five years, impacting the way 40% of jobs are performed." The programs are open until November and aim to strengthen strategic sectors such as IRABAZI, HAZI, and JAUZI.
The tech industry is also responding. Google has unveiled Gemini 3.8 Flash Cyber, its most advanced cybersecurity defense model, capable of detecting vulnerabilities and automatically patching them. In internal tests, it found a critical vulnerability in under two hours and generated 2,6 times more successful patches than larger commercial models. Furthermore, over one hundred companies, including OpenAI, IBM, Google, CrowdStrike, and NTT DATA, have signed an open letter calling for a collective response to mitigate the risks of AI-driven attacks. They argue that traditional security is outdated and that it is essential to share verified tools and solutions.
The industry's response: new models and alliances
On the stock market, cybersecurity companies are reaping record results. Okta and CrowdStrike surged 28,6% and 20,5% respectively after reporting their earnings. The expansion of AI agents is broadening the potential market for these companies , as each agent requires a reliable identity and precise controls. CrowdStrike posted its best second quarter ever, with revenue growth of 26%, and its CEO, George Kurtz, asserted that "ensuring the security of AI represents the greatest business opportunity in the history of the industry." The gains extended to Palo Alto Networks, SailPoint, Zscaler, Fortinet, and Check Point.
But it's not all optimism. Agentic AI, which allows systems to plan and execute actions autonomously, also poses risks. The rise of Shadow AI, where employees use external tools without supervision, leads to information leaks . Experts insist that technology does not replace the human factor: critical judgment and strategic direction remain the exclusive domain of people. The key lies in combining automation with expert oversight and applying principles such as security by design and risk education.
The challenge of agentic AI and the human factor
The integration of cloud computing, AI, and cybersecurity has become a strategic triangle. A cloud infrastructure without AI doesn't generate value, and AI without security is a danger . According to IBM, the average cost of a data breach reached $4,44 million in 2025, and the World Economic Forum ranks cyber threats among the greatest global risks. Companies that fail to integrate these three dimensions will fall behind. In the words of Paco Salcedo, president of Microsoft Spain, "it's not viable to implement security without artificial intelligence," but it's also necessary to establish safeguards for its responsible use.
In short, AI and cybersecurity form an essential alliance in the digital age. The market is growing, threats are evolving, and solutions are multiplying , but success will depend on organizations' ability to combine technology, human talent, and governance. Spain, with initiatives like those of the Basque Government and the increasing adoption of AI, has the opportunity to lead this transformation, provided that security is not neglected. The race between attackers and defenders has just begun, and artificial intelligence is the battleground.
