Introduction
Global spending on cybersecurity has never been higher.
- Worldwide spending in 2024
- $193B
- Worldwide spending in 2025
- $213B
- Expected spending in 2026
- ~$240B
According to Gartner, worldwide end-user spending on information security reached $213 billion in 2025, up from $193 billion in 2024. Gartner forecasts spending to grow by another 12.5% in 2026, reaching nearly $240 billion.
Every year, we continue to see the same headlines: ransomware paralyzes organizations and locks critical processes for months, supply chain attacks continue to grow, stolen credentials lead to multi-million dolar losses.
If organizations are investing more than ever, why do we still keep losing?
Because cybersecurity doesn't only have a detection problem. It also has a decision problem.
The Paradox
Organizations invest millions in security technologies. Many build dedicated security teams.
They deploy endpoint protection, email security, sandboxes, malware scanners, threat intelligence platforms and more recently, AI-powered detection systems and security agents.
In 2026, the problem is no longer whether we can detect threats. The problem is whether we understand them well enough to make the right decision.
Recent examples speak for themselves. Even some of the world's most recognized brands continue to suffer devastating cyber incidents despite investing heavily in cybersecurity.
Sample cyber incidents (2025–2026)
Hasbro
A cyberattack forced the company to temporarily shut down critical systems and rely on manual processes. Hasbro later reported approximately $25 million in lost revenue.
Marks & Spencer
The company expects the cyber incident to reduce operating profit by approximately ÂŁ300 million, before insurance recoveries and mitigation actions.
Co-op Group
Following a major cyberattack, the retailer reported ÂŁ206 million in lost revenue and an ÂŁ80 million impact on operating profit.
Jaguar Land Rover
The cyberattack disrupted manufacturing across multiple UK plants. According to the UK's Cyber Monitoring Centre, the incident caused an estimated ÂŁ1.9 billion in economic impact, affecting more than 5,000 organizations.
None of these organizations lacked security products, and none of them lacked experienced security teams. Yet all of them suffered significant operational and financial damage.
Cybersecurity products generate signals. People make decisions.
What does that actually mean? Let's look deeper.
The Wrong Optimization
For decades, the cybersecurity industry optimized technologies around answering one simple question: is this file / email malicious? And for a long time, that was exactly the right question.
Organizations were dealing with massive volumes of files, emails and common malware. They needed systems capable of producing fast, automated straightforward verdicts that could stop known threats at scale.
Additional context was often considered unnecessary because security teams simply didn’t have the time, tooling or processes to investigate every suspicious object in depth.
One of the things I enjoy most about working at Contextal is that I get to work with people who helped shape the cybersecurity industry in its early days.
One of them is Tomasz Kojm, the original creator of ClamAV and the Contextal founder. We've had many conversations about how malware detection evolved, from the early days of signature-based systems to today's much more complex threat landscape. One thing became very clear to me: the industry's focus on fast, automated verdicts wasn't a mistake. It was enough for organizations at that time. Security teams could sleep tight.
The Problem with Verdicts
Modern data is no longer that simple. Just like in life, the moment you’re asked about something, you often can’t simply answer yes or no. It requires you to think, elaborate on the topic, and sometimes even do additional deep research.
Emails may include attachments and URLs. Documents and multi-layered PDFs can contain embedded objects, scripts, external references, QR codes and so much more. Parts of the content itself may also be encrypted.
A file may exploit legitimate features without appearing obviously malicious. An archive may hide payloads within multiple nested layers. You could be just forwarding to your team a malformed Office document - the technique introduced by the end of 2024, where threat actors prepend specifically crafted data before the legitimate document content.
If you don't understand what's actually in front of you, a simple shallow "looks fine" can quickly turn into a security incident and enable a disaster mode for your organization. Nobody cares that you were rushing between meetings or survived thirty Zoom calls that week. The attacker certainly doesn't.
This is where context becomes everything, as well as a proper cyber threat investigation flow.
We Don’t Trust Without Context. Why Do We Trust Security Verdicts?
Imagine someone you trust tells you:
„This is the best decision you can make.”
Whether you’re choosing a bank, investing your savings or buying a house, you probably wouldn’t take action right away. Your first questions would be:
- Why?
- What evidence supports that recommendation?
- What assumptions were made?
Even if the recommendation comes from someone you trust, you still want to understand why. Trust doesn't replace evidence, especially when the decision has real consequences.
This is how we naturally make important decisions. We look for context, review the evidence and understand the reasoning before taking action. Cybersecurity decisions are no different. They can affect businesses, customers and sometimes millions of people.
In cybersecurity, we often ask analysts to trust a single verdict while giving them little or no context behind it.
The obvious question is: why?
A Different Way of Thinking
Automation isn’t the problem. In fact, automation is one of the greatest achievements of modern cybersecurity. Without it, no SOC could process millions of events, files and alerts generated every day. Automated detection has been the industry standard for decades now, and for good reasons.
When a solid detection engine confidently identifies a file as malicious, that verdict is extremely valuable. It allows organizations to react quickly and stop known threats at scale but…
But security rarely operates in such ideal conditions. Not every file is obviously malicious. Not every verdict is clear enough. And not every security decision can be reduced to yes or no.
False positives are not unusual. Neither are conflicting results between detection engines. Anyone who has worked with multi-engine malware analysis platforms has probably encountered situations where different AV engines reach completely different conclusions about one and the same file.
Imagine a simple scenario.
61 reputable engines classify a document as clean. Only 1 engine flags it as malicious. Now what? Which engine is right? Should the file be blocked? Should it be allowed? Should it trigger an incident? Most importantly: what evidence do you actually have to make that decision? I believe, you won’t reach Reddit to ask the community and make the verdict for you.
To sum up - the verdict alone rarely answers those questions, and the data available to the analyst is often not enough to make the right decision. This is not a hypothetical problem. It is a daily reality for security researchers and SOC analysts.
A common misconception is that more detection engines and more security products automatically lead to better security.
Security isn’t built by collecting products. It's built on evidence and a deep understanding of your own environment.
Organizations often ask: "Which platform should we buy next?"
A beter question is: "What information are we still missing to make better and more confident security decisions?"
Those are two very different investment strategies. For years, cybersecurity has optimized for producing faster verdicts but modern threats don’t exist in isolation. Modern security data carries structure, metadata, relationships, execution paths, embedded objects, behavior signals. None of these individually proves malicious intent. Together - it builds so-called context. And context is what enables analysts to distinguish between malicious, suspicious or clean.
We get used to simplifying difficult questions into binary answers: safe or unsafe, malicious or clean, allow or block. That mindset works well for automation. It works much less well for investigation. Real security decisions require answers to questions such as:
- What is this file and what does it actually contain?
- Which behaviors does it expose?
- Which techniques does it use?
- Was this document manually created or programmatically generated?
- What evidence supports this assessment?
- What uncertainty still remains?
The „one-size-fits-all” approach simply doesn’t work for most organizations. Adding yet another platform to your stack might increase your security budget, but it doesn’t automatically make your organization more secure.
What actually improves security is the quality of your systems, security awareness, real understanding of your environment, skilled analysts, and most importantly access to the complete picture of your data.
So what’s your starting point when you decide to buy another cybersecurity solution? Are you driven by market trends, automation capabilities, AI features and how well it fits into your environment? Or is it the attractive price compared to competitors? Or maybe… it’s because vendor X has been selling cybersecurity software for 30+ years, so it must be the best choice?
Conclusion
Having more security tools in your stack does not guarantee better security. The same goes for spending more on licenses.
What really matters is whether your tools, detection mechanisms, and data analysis processes fit your organization’s risk profile.
The „one-size-fits-all” mindset simply does not apply in today’s threat landscape. A single advanced attack can cost millions in breach recovery, legal fines, and lost business.
The cybersecurity industry has spent decades building better detection engines. It is time to spend the next decade building better decision systems.
Organizations do not lose millions because they lacked one more malware verdict. They lose millions because they lacked the context needed to make the right decision. And yes, you can't turn back time.
One bad decision, just like one good decision, can be a game changer these days. Nowadays, every security decision is ultimately a business decision.
Context is everything. In a world where nothing is black and white anymore, context plays a critical role in every security decision. Ignoring it can come at a very high cost.
One lesson has always stayed with me.
People remain both the weakest and the strongest part of the security process.
About the Author
I’m Maciej Kuran-Janowski, and I work with Contextal, where I develop clens.io with my team - a threat and data intelligence platform that contextually detects and analyzes malicious content. Although I work with Contextal, the opinions expressed in this article are my own and are based on my personal experience.