The channel is taking an ever-larger share of the cybersecurity market as attackers pull ahead in what Omdia’s chief analyst Matthew Ball calls an “AI arms race.” According to Ball, partners are becoming central as security architectures grow more complex — even as defenses struggle to match the speed and precision of AI-powered attacks.
The channel confirms its dominance
Ball says channel partners today account for about 90% of the cybersecurity market within the roughly $300 billion sector — a reversal of the trend seen in IT overall, where partner share is about 65% and has been slipping for five years. “Cybersecurity is actually moving the opposite way,” he summarizes: the more complex security becomes, the more customers turn to partners to design, integrate and manage solutions.
Cybersecurity: the advantage is shifting to attackers
Ball warns that cybercriminals currently hold an edge thanks to AI. They “use AI to move faster, hit more targets, and increase their yield by being more precise.” The figures he cites highlight this shift: the shortest time between intrusion and data exfiltration has fallen to 72 minutes — four times faster than a year ago — AI-assisted attacks are up 89% year over year, and victims are 4.5 times more likely to click on a phishing email written by AI than one written by a human. Ball also points out that recent restrictions on Anthropic’s most powerful models show defenders cannot necessarily rely on free, immediate access to the same advanced tools attackers use.
Platforms, marketplaces and new buying models
AI is also reshaping how companies buy cybersecurity. Ball notes an acceleration from point products to platforms “because AI needs better telemetry.” Platforms provide context and decision velocity essential to protecting AI-augmented environments. At the same time, hyperscaler marketplaces are expected to grow at a 35% CAGR and approach $10 billion by 2030. But Ball warns that these marketplaces favor partners who can transact at scale, co-sell with hyperscalers and appear in large platform deals.
Toward orchestration of a digital workforce
Technological convergence and automation are changing partner value propositions. The old model — picking vendors, assembling components and managing complexity — is evolving: platforms unify data layers and automated agents are taking over tasks previously performed by manual services. In this new landscape, Ball expects partners to become “the orchestrators of the digital workforce,” managing specialized agents. He says partners will generally follow one of three paths: reselling managed services built on agents, developing their own IP on top of vendor platforms, or running end-to-end engagements.
Opportunities and margin pressure
AI increases the attack surface but also creates demand for advisory and governance — high-potential segments such as vCISO services. Conversely, falling technology costs could compress margins for “detect-and-react” services. Ball highlights a clear economic dynamic: in EMEA, cybersecurity is forecast to grow 12% to just under $100 billion by 2026, split roughly one-third technology and two-thirds services. “Every dollar of technology generated by partners creates more than two dollars of services,” he concludes, underscoring the central role of the channel.
