Today we’re publishing the CISO AI Market Map, Edition 1 — a companion to the CISO AI Leverage Report inside the Enterprise AI Buying & Budget Index, Open Future Forum’s research program on how executives who hold AI budgets are actually buying and funding AI.
Where the Leverage Report reads the CISO seat itself, the Market Map reads the supply side: a workflow-based map of 63 AI vendors selling into agent and model security, threat detection and AI SOC, identity and access, cloud exposure, application security, data security, GRC, and security automation — paired with first-party demand signals from 79 application-stage survey responses. We don’t score vendors. We don’t rank them. We show where the supply is crowded and where the room actually stands on funding and proof.
What’s in it
The clearest signal is agent access. 22 of 40 small-base responses named securing AI agents and their access as the problem they’re actually solving for — more than any other theme. Data leakage and shadow AI follow, each appearing in 10 of 40 any-mention responses.
Funding is real but uneven. A dedicated AI security budget line and case-by-case buying tie at 14 of 40 any-mentions each, with 8 of 40 carved from existing security budget and 6 of 40 with no AI security spend yet. The signal is qualified interest, not verified buying — proof still needs to be narrow: one workflow, one risk owner, one budget source, one sign-off path, and visible value inside two quarters.
Why we built this
Vendor lists are everywhere. What’s missing is the demand side: who’s actually funded, what security leaders wanted to see before buying, and where the budget logic and sign-off paths actually sit. This edition reads indirect categories — cloud exposure, AppSec, GRC, and operating workflow claims — with care, since the survey set didn’t ask category-specific budget questions for all of them.
The Market Map sits alongside the CISO AI Leverage Report as a release in the Enterprise AI Buying & Budget Index. Each report carries a stable URL so the vendor categories and the demand read can be cited and compared edition to edition.