Three major resilience deadlines fell in 2025: the EU DORA applied from 17 January, UK firms had to meet impact tolerances by 31 March, and the Australian standard CPS 230 began on 1 July.
Why this market is moving now
- The EU DORA has applied since 17 January 2025, and the first list of critical ICT providers followed on 18 November 2025.
- UK firms had until 31 March 2025 to show they can keep important business services within impact tolerances.
- The Australian operational risk standard CPS 230 commenced on 1 July 2025.
- Outages are getting costlier: 71% of data center operators said their most damaging outage cost at least $100,000 in 2026, up from 57% in 2025.
Key figures
Global figures for this market, with the year each one describes. Use Cite to copy a reference to this page.
| Figure | Value | Year | Cite |
|---|---|---|---|
| Organizations worldwide are forecast to spend $310.42 billion on security in 2026, up 13.2% from 2025. | 310.42 USD billion | 2026 | |
| A faulty CrowdStrike security update in July 2024 affected 8.5 million Windows devices worldwide, less than 1% of all Windows machines. | 8.5 million devices | 2024 | |
| In 2026, 71% of data center operators worldwide said their most damaging outage cost at least $100,000, up from 57% in 2025. | 71 % of operators | 2026 | |
| 122 major IT and data center outages were tracked from public reports worldwide in 2025, up from 119 in 2024. | 122 publicly reported outages | 2025 | |
| The size of extreme losses from cyber incidents has more than quadrupled since 2017 to $2.5 billion (2024 analysis). | 2.5 USD billion | 2024 | |
| The EU Digital Operational Resilience Act (DORA) has applied since 17 January 2025, and in-scope financial entities must keep a register of their ICT third-party contracts. | 17 January 2025 application date | 2025 | |
| On 18 November 2025 the EU supervisory authorities published their first list of critical ICT third-party providers under DORA, including Amazon Web Services, Google Cloud and Microsoft. | 18 November 2025 publication date | 2025 | |
| UK firms in scope of the operational resilience rules had until 31 March 2025 to show they could keep important business services within impact tolerances. | 31 March 2025 | 2025 | |
| The Australian operational risk management standard CPS 230 commenced on 1 July 2025 for all APRA-regulated entities. | 1 July 2025 start date | 2025 |
Calculated figures (shares, changes and prices per kilogram) are plain arithmetic on the reported values. Read how we work.
Companies to watch
Microsoft
Named, as Microsoft Ireland Operations Limited, on the first EU list of critical ICT third-party providers in November 2025.
Amazon Web Services
Named, as Amazon Web Services EMEA Sarl, on the first EU list of critical ICT third-party providers in November 2025.
Google Cloud
Named, as Google Cloud EMEA Limited, on the first EU list of critical ICT third-party providers in November 2025.
SAP
Named, as SAP SE, on the first EU list of critical ICT third-party providers in November 2025.
Oracle
Named, as Oracle Nederland B.V., on the first EU list of critical ICT third-party providers in November 2025.
IBM
Named, as International Business Machine Corporation, on the first EU list of critical ICT third-party providers in November 2025.
LSEG
Named, as LSEG Data and Risk Limited, on the first EU list of critical ICT third-party providers in November 2025.
CrowdStrike
Security vendor whose faulty update in July 2024 affected 8.5 million Windows devices, less than 1% of all Windows machines.
What the full report covers
- 01Executive summary
The answer in one page: size, direction and what moves it - 02Market definition and scope
What is in and out of the global market - 03Global market size, 2021 to 2025
Historical series and growth rates - 04Countries and regions
Demand, supply and trade by country and region - 05Outlook to 2031
Base, low and high scenarios with stated assumptions - 06Rules, policy and deadlines
Regulation and programmes that change demand - 07Drivers and barriers
What accelerates or slows adoption, by customer segment - 08Prices, costs and margins
Unit economics where public data allows - 09Competitive landscape
8 to 12 company profiles with recent moves - 10Opportunities and risks
For new entrants, suppliers and investors - 11Method and assumptions
How every figure was built
Included with the full report
- PDF report, 40 to 60 pages
- Excel data pack
- Ready-to-use charts
- Method note and assumptions
- Written to order in 5 working days
Frequently asked questions
How big is the global market for security and operational resilience?
Organizations worldwide are forecast to spend $310.42 billion on security in 2026, up 13.2% from 2025.
Which operational resilience rules apply to financial firms?
The EU DORA has applied since 17 January 2025. UK firms had until 31 March 2025 to meet impact tolerances for important business services. The Australian standard CPS 230 commenced on 1 July 2025.
Which companies are critical ICT third-party providers?
The first EU list, published on 18 November 2025, names providers including Amazon Web Services, Google Cloud, Microsoft, SAP, Oracle, IBM and LSEG Data and Risk.
How costly are IT outages?
In 2026, 71% of data center operators said their most damaging outage cost at least $100,000, up from 57% in 2025. In 2025, 122 major outages were tracked from public reports worldwide.
Why is third-party concentration risk a concern?
A single faulty security update in July 2024 affected 8.5 million Windows devices, less than 1% of all Windows machines, with broad economic impact. The size of extreme losses from cyber incidents has more than quadrupled since 2017 to $2.5 billion.
Free sample
Get a free sample of this report
We send the table of contents, two sample chapters and the method note, usually within one working day. It is free to ask.
- Full table of contents
- Two sample chapters
- Method note and data outline