Cybersecurity buyers are moving fast as AI risks reshape vendor selection

New research from The Hoffman Agency shows 67% of cybersecurity organizations plan to raise investment in the next 12 months, while 62% are shopping for a new provider or considering a switch. The study also finds buyers are making faster decisions, leaning on peers, analysts and LLMs, and prioritizing easy integration, value for money and proof of results.

Why it matters: - Cybersecurity vendors are competing in a faster-moving market where buyers are making decisions in months, not years. - AI security is becoming a major purchase driver, but core protections like network, endpoint and identity security still matter. - Marketing teams now have to influence both human buyers and LLM-driven research paths.

What happened: - The Hoffman Agency launched new research, Fast decisions, high stakes, on how AI cyberattacks are changing cybersecurity buying. - Coleman Parkes Research surveyed 500 cybersecurity decision makers in the U.K., U.S., France and Germany. - The research found 67% of organizations plan to increase cybersecurity investment in the next 12 months. - The study found 62% are looking for a new provider or considering switching providers. - The top planned new investments are AI security, Security Operations and Identity Access Management. - The solutions most likely to be replaced are Network Security, Endpoint Security and Security Analytics.

The details: - The biggest reason for new spending is the need to respond to threats, cited by 55% of respondents. - The threats driving that spending include phishing, malware, ransomware and social engineering. - Securing AI systems is the second-biggest reason for investment, cited by 38% globally and 48% in the U.K. - On average, cybersecurity purchases take 7 months from need identification to vendor selection across all countries surveyed. - Most purchases, 55%, take less than 6 months. - 65% of potential buyers contact vendors before the shortlisting stage. - Just 9% wait until final decision time to reach out. - For initial awareness, the top sources are direct peers at 35%, industry analysts at 32%, industry events at 28% and industry trade media at 26%. - For final selection, the top sources are industry analysts at 23%, industry events at 23%, direct peers at 22% and management consultants at 22%. - 20% of buyers use LLMs for both awareness and selection, rising to 24% in the U.S. - For final selection, the top content types are industry analyst reports featuring the vendor at 39%, vendor conference panels at 32%, case studies at 29% and LLMs at 29%. - LLM use for final selection rises to 30% in the U.S. and 34% in the U.K. - LLMs rank above email marketing, but below case studies and webinars. - 89% say value for money and simple integration will drive decision-making the most. - 87% say evidence of delivering for similar businesses is also important. - Florie Lhuillier, Head of Cybersecurity & SVP at The Hoffman Agency, said the market remains buoyant across cybersecurity solutions and services despite AI adoption, geopolitical tensions and economic uncertainty. - Lhuillier said cybersecurity marketers need an integrated strategy across multiple channels and content types because there is no single marketing silver bullet. - The Hoffman Agency said the full report is available here.

Between the lines: - Buyers appear willing to spend more if the offer feels worth it, which makes proof of value more important than low price alone. - The rise of LLMs adds another layer to vendor visibility, since companies now need content that shapes what buyers read directly and what AI tools surface. - The mix of fast decisions, early vendor contact and heavy reliance on third-party validation favors vendors with strong analyst, peer and event presence.

What's next: - Cybersecurity vendors are likely to push harder on integration, ROI and proof points as buyers shorten the path to purchase. - Marketing teams will need to optimize content for analyst coverage, case studies, events, peers and LLM discovery at the same time. - More buying activity is likely over the next 12 months if current investment plans hold.