The National Cybersecurity Authority’s new report, Key Economic Indicators in the Cybersecurity Sector 2026, puts a price on the Kingdom’s digital defenses: a market of SR16.3 billion ($4.35 billion) in 2025, compounding at 10.7 percent a year since 2023. The more telling number is who paid. Private buyers accounted for SR11.2 billion of the spending, 69 percent of the market, against about SR5.1 billion from government entities. Cybersecurity in the Kingdom is no longer mainly a state purchase. Companies carry more than two thirds of the bill, which means demand now rises and falls with the commercial economy rather than with budget cycles.

The authority also counts the sector as a producer, not only a cost. Its report puts the sector’s contribution to output at about SR20 billion at current prices in 2025, growing at a compound 13.2 percent over two years, split between SR9.7 billion generated directly by product and service providers and SR10.3 billion in indirect effects. That equals 0.42 percent of total GDP and 0.71 percent of non-oil GDP, official figures the authority publishes alongside the market data. Few governments issue national accounts for their security industry at all. The decision to do so signals how Riyadh wants the sector read: as an industry in formation, not an insurance premium on digitization.

The composition supports that reading. Products took SR8.3 billion of 2025 spending and services SR7.9 billion, a near-even split, and the authority’s list of in-demand areas, endpoint security, network security, security operations, system integration and data security, reads like the procurement list of an economy moving its critical functions online. The report itself rests on a classification of five categories, 25 activities and more than 100 products and services, the kind of taxonomy statistics offices usually reserve for established industries.

The workforce numbers carry a labor-market story. More than 22,000 professionals worked in the sector in 2025, a headcount growing at about 5.9 percent a year, and women hold 33 percent of those jobs against a global average near 22 percent. Cybersecurity is a young field in the Kingdom with no incumbent workforce to displace, which has made it one of the clearer tests of whether new technical industries hire differently from old ones. The authority’s CyberIC program, launched in 2022, is the localization arm, training national capability and building a domestic supplier base rather than importing both.

The timing of the measurement matters as much as the measurement. The 2025 figures largely predate the heaviest spending of the Kingdom’s AI buildout, the data centers, cloud regions and government platforms now under construction. The Digital Government Authority put government ICT spending near SR32 billion this year, and the Digital Government Strategy for 2025 to 2030 is projected to add a cumulative SR11.4 billion to GDP and more than 26,000 jobs by the end of the decade. Every riyal of that compute and platform investment carries a security increment, because the attack surface grows with the digital economy and so does the addressable market for protecting it.

Outside assessments point the same direction. The IMD World Competitiveness Yearbook has ranked the Kingdom first on its cybersecurity index for three consecutive years. Mohamad Hashem, Kaspersky’s general manager for Saudi Arabia and Bahrain, told Arab News the sector is becoming an economic contributor in its own right and that resilience requires sustained investment. The economist Ahmad Chreim put global security spending at $240 billion to $308 billion for 2026 and named AI-driven threat detection, cloud security and identity management as the openings for markets entering the field now.

The number to watch is the next edition’s. The 2026 figures will test whether the market can hold double-digit growth at a larger base once the buildout’s spending lands, and whether services overtake products, the usual mark of a maturing industry. A sector measured this carefully is one the state intends to grow.

Reporting basis: National Cybersecurity Authority, Key Economic Indicators in the Cybersecurity Sector 2026 (report dated 14 October 2026); Arab News (17 October 2026).