Gartner forecasts the AI security market will grow sharply through 2028, driven by prompt injection, access control risks, and supply chain
Research firm Gartner estimates that the global AI security market will grow from $2.835 billion in 2026 to $4.783 billion in 2027, up 68.7% year over year, and will approach $7.7 billion in 2028. This growth reflects how, after enterprises adopt AI projects, they no longer focus only on model capabilities, but also face emerging vulnerabilities, increasing third-party and open source software vulnerabilities, and rising overall risk from supply chain attacks.
Gartner also noted that by 2029, more than half of successful attacks against AI agents will involve access control weaknesses and prompt injection. This means the focus of AI security is extending beyond traditional system protection to a higher-level form of risk governance: what AI will do, what it can do, and who can influence what it does.
Among the four major AI security segments identified by Gartner, AI Application Security will still be the largest market in 2027, with an estimated value of $851 million; AI Usage Control ranks second at $749 million and is growing at 73% year over year, making it the fastest-growing category. AI Governance Platforms and AI Gateway are projected to reach $462 million and $429 million, respectively.
The core signal in this forecast is not the expansion of a single product category, but the structural change in the attack surface of AI systems. Traditional application security mainly protects code, identities, and data flows; but once an AI application introduces agents, external tools, retrieval data sources, and automated actions, attackers can interfere with model decisions through prompt injection and further influence the behavior executed by the agent.
Gartner's 2029 outlook shows that the main risks for AI agents will center on access control. The reason is that agents typically have the ability to read documents, call APIs, modify content, and trigger workflows. If permission boundaries are designed poorly, attackers do not need to compromise the model itself directly; they may exploit prompt manipulation, indirect injection, or loose authorization to carry out unauthorized actions.
In addition, the rise in third-party and open source software vulnerabilities will expose AI projects to more complex supply chain risks. When AI applications depend on multiple frameworks, plug-ins, model services, and data pipelines, weaknesses in any link can become a breach in the overall trust chain. This is also why the growth of the AI security market is driven not only by the idea that AI itself is dangerous, but also by the fact that AI amplifies and connects existing system risks.
Among the four areas, AI Application Security can be seen as directly protecting AI applications and their interfaces, with a focus on input validation, output control, and behavior monitoring. AI Usage Control is more about restricting how models and agents are used, including who can invoke them, which data they can use, and what actions they can perform. AI Governance Platforms handle policy, auditing, and traceability; AI Gateway acts as a unified gateway for traffic and access control, reducing the governance gaps caused by decentralized configurations.
For enterprises, this growth means that AI security is no longer a point solution, but a shared issue spanning R&D, cybersecurity, compliance, and operations. Once an organization begins applying AI to customer service, content creation, knowledge search, software development, or workflow automation, it also introduces risks such as data leakage, privilege abuse, incorrect decisions, and supply chain contamination.
For security teams, the most direct impact is that the threat model must be updated. Defenses that previously focused mainly on malware, account theft, or weak passwords must now also include scenarios such as prompt injection, agent action abuse, tool-call abuse, and data source contamination. Without visibility into AI workflows, it is often difficult after an incident to quickly determine whether the issue was model distortion, misconfigured permissions, or manipulated external input.
For supply chain and procurement teams, risks from third-party components and open source software will also be amplified. AI platforms often rely on external packages, model services, and integration components. If vendors do not clearly disclose their security design, permission model, and audit capabilities, enterprises may lose the effectiveness of their protections even after deploying AI governance processes because the underlying controls are insufficient.
For management, Gartner's figures show that AI security has entered a phase of high growth, high investment, and high risk. Market expansion means solutions will become more mature, but it also means attackers are rapidly learning how to exploit AI's new features. Future competition will not be only about model capability, but about who can establish security boundaries and controllable agent behavior sooner.
Enterprises should first treat AI security as part of architecture design rather than an add-on feature introduced after deployment. The highest-priority direction is to establish a clear AI usage policy, layered permissions, and data segmentation to prevent agents from directly accessing highly sensitive data or performing irreversible actions without verification.
Second, defenses should be built against prompt injection and indirect injection. This includes limiting the sources of external content the model can accept, applying trust tiers to retrieved content and tool-returned results, and adding a human approval gate before high-risk operations. For agents with automation capabilities, the principle of least privilege should be used to narrow the scope of readable and writable resources.
Third, AI Application Security and AI Gateway should be incorporated into existing security control processes. The former is used to inspect inputs, outputs, and abnormal interaction behavior, while the latter can centrally handle authentication, traffic control, and policy enforcement, avoiding inconsistent standards caused by each AI service implementing controls on its own.
Fourth, AI Governance Platforms should be planned together with risk registers, audit logs, and model lifecycle management. Enterprises need to know which models are in production, what data they use, which tools they connect to, who operates them, and whether each change has been reviewed. Without traceability, it is difficult to assign responsibility and determine remediation scope after an incident.
Finally, third-party and open source software management must be strengthened at the same time. AI projects should review sources, control versions, and conduct security testing in line with high-risk supply chain processes, and they should establish alternatives and update mechanisms for critical components to reduce the cascading impact of a single vendor or a single package failure.