Cybersecurity Budgets Planning Guide: How to Build, Break Down, and Defend a Cybersecurity Budget

A cybersecurity budget holds up when it is built in three passes: obligations first, then the remaining risks ranked by likelihood and impact, then a check against peers whose benchmark you can read correctly.

The question comes with the annual plan, when finance asks for next year's security number and its reason. Benchmarks complicate the answer: some divide by the IT budget, some by revenue, and an average can hide the median. A number built on the wrong one fails the cost review.

This approach is for the CFO or COO of a US mid-market company working with a security lead or a virtual chief information security officer (vCISO). The company answers customer security reviews, owes a SOC 2 report or ISO 27001 certification, and carries cyber insurance.

Key takeaways

• Fund the obligations first. Regulatory, contractual, and insurer-driven obligations set a floor that risk scores and last year's total cannot cut. List them with their sources and costs before ranking any other risk.
• Security took 9.9% of IT spending in 2026. That is IANS and Artico Search's figure from more than 500 CISOs. Read it as a reference point with its denominator, and compare against companies of your own size.
• People are the largest line. Staff and compensation took 37% of the average 2026 security budget in IANS's data, ahead of software and AI at 35%. A tool without the people or the service to run it is unfinished spending.
• An average increase is not a typical one. In IANS's 2026 data, average security budget growth was 5%, but median growth stayed at 0%. Plan from your own floor and risks, and treat the averages as context.
• Business risk wins budget more often than breach fear. In the same survey, 48% of CISOs whose budgets grew pointed to business or operational risk, against 3% for a breach. Lead the request with the business case.

What is a cybersecurity budget?

Think of the cybersecurity budget as the yearly amount set aside to protect the company's systems and data, sized to the risks it has decided to manage. It pays for people, technology, and outside services, including the audits and insurance the business owes. Outcome GV.RR-03 of NIST's Cybersecurity Framework (CSF) 2.0 asks that "Adequate resources are allocated commensurate with the cybersecurity risk strategy". The same outcome ties those resources to the organization's "roles, responsibilities, and policies". The framework sets no amount or percentage.

Part of a company's spending on cybersecurity sits outside the security line: AI tools and platforms that perform security functions can be funded through IT, data, or innovation budgets. A budget that counts only the security cost center understates the total. Step 1 finds it, and strategy 3 separates the AI share.

Why cybersecurity budget planning matters

Planning the budget, rather than rolling last year's total forward, makes the money follow the company's obligations and risks. That matters because:

• Obligations set a floor. Regulators, customer contracts, and insurers each ask for work that costs money whatever last year's number was. Step 2 lists them.
• Most cuts start outside security. In IANS and Artico Search's 2026 benchmark, most cuts (78%) traced back to enterprise-wide cost-cutting, not a security decision. A budget that shows what each line protects gives finance something to weigh in that round.
• A breach is priced in millions. IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at $4.99 million, a 12% increase and a record high, across 602 organizations with breaches between March 2025 and February 2026.

Cybersecurity spending benchmarks: how much companies spend

How much do companies spend on cybersecurity? Peer figures answer with a ratio, and its denominator decides what it means: a share of the IT budget shows how security competes with the rest of IT, and a share of revenue shows what security costs the business.

Security as a share of the IT budget

Security's overall share of IT spending fell back to 9.9% in 2026, the same level as in 2021, according to IANS and Artico Search's 2026 Security Budget Benchmark Report. IANS attributes the drop to AI-driven IT budgets that outgrew security's. The survey covered more than 500 CISOs between April and August 2026.

To compare your own budget with that figure:

• Use the same denominator. Divide your security budget by your IT budget for the same year, and count the security tools IT pays for the same way each year. For companies under $1 billion, IANS's small and mid-market report suggests one reason their share fell in 2025: "platforms that perform security functions but are funded through IT rather than the security budget".
• Compare like with like. The next section shows how far the share moves with company size.

Cybersecurity spending by company size

The share falls as revenue grows. In 2026, companies with less than $100 million in revenue spent an average of 21.6% of their IT budgets on security, and companies with more than $10 billion spent 7.7%. IANS's reason: small companies carry many of the same basic costs for tools, compliance, and staffing as large ones.

For companies under $1 billion, IANS and Artico Search's small and mid-market report gives medians for 2025 budgets from 307 CISOs:

• Under $50 million in revenue: a median security budget of $800,000 (middle half $300,000 to $1.5 million); a median team of 2 full-time equivalents (FTEs); 1.67% of revenue.
• $50 million to $200 million: $1.5 million (middle half $1.0 million to $2.1 million); 5 FTEs; 1.33% of revenue.
• $200 million to $600 million: $2.6 million ($1.5 million to $4.0 million); 8 FTEs; 0.67% of revenue.
• $600 million to $1 billion: $3.8 million ($1.6 million to $6.4 million); 10 FTEs; 0.50% of revenue.

IANS says the high shares at the smallest companies often reflect "the minimum level of spending required to run a credible program rather than generous investment". Across the segment, security budgets run at a median of 0.78% of revenue and a mean of 1.08%, the revenue benchmark in Table 1. The report's categories have no insurance line, and it does not say whether premiums sit inside the budgets it measured, so note whether your number includes them.

Table 1. Security spending benchmarks and what each measures

Sources: IANS and Artico Search, 2026 Security Budget Benchmark Report and The Small and Mid-Market Company CISO (2026); read October 2026.

Cybersecurity budget breakdown: what goes into the budget

We break a cybersecurity budget into six lines: three for people, software, and managed services, and three for audits, testing, and incident response with insurance. In IANS's 2026 benchmark, staff and compensation is the largest category at 37%, and software and AI together take 35%, up from 29% in 2025. AI on its own, tracked as a category for the first time, accounts for 3% of the budget within that 35%.

Security staff, leadership, and training

This line pays for the security team, its leader, and the training they need. In ISC2's 2025 Cybersecurity Workforce Study, 33% of organizations lack the budget to staff their teams adequately and 29% cannot afford staff with the skills they need. IANS's small and mid-market report puts training and development at 4% of 2025 security budgets at companies under $1 billion.

Security software, tools, and AI

This line covers licenses and subscriptions for the tools that protect endpoints, identities, and cloud workloads, plus any AI bought for security. In IBM's 2026 report, organizations with extensive use of AI and automation in security saved $1.93 million per breach compared with organizations using none. Record how each tool bills and the month it renews; the summary table has a column for both.

Managed security services

Managed services buy capacity the team lacks, such as managed detection and response (MDR) or a security operations center (SOC) run as a service. In IANS's small and mid-market report, outsourcing took 12% of 2025 security budgets on average. IANS adds that for many of these companies, managed services and outsourced detection and response "are not a supplement to an internal team; they are the team".

Compliance audits and certifications

This line pays for the audits customers and contracts ask for, plus the readiness work before them:

• SOC 2. Under AICPA's Trust Services Criteria, a SOC 2 Type 2 attestation report covers how controls operated "throughout a specified period", so the fee returns with each period. Our guide to SOC 2 cost prices it.
• ISO 27001. Bureau Veritas, a certification body, describes its certification process as generally a three-year program with surveillance audits. Our guide to ISO 27001 certification cost prices that cycle.
• CMMC. Defense contractors also face Cybersecurity Maturity Model Certification (CMMC) assessments. While the Department of War's suspension of Phase 2 lasts, new procurement documents may require only Level 1 or Level 2 self-assessments.

Security testing

Testing buys an outside view of whether the controls work: penetration tests, and the retests that confirm the fixes. Schedule each test against the audit window it serves, so the report is current when an auditor or a customer asks for it. Our guide to penetration testing cost explains what moves the price, and strategy 5 covers budgeting for the retest.

Incident response and cyber insurance

This line covers an incident response retainer, the cyber insurance premium, and the retention the company pays before the policy responds. Coalition's 2026 Cyber Claims Report, based on more than 100,000 of its own policyholders in five countries, found that claims frequency rose 3% in 2025 and severity fell 19% to an average loss of $116,000. For the backup controls insurers ask about, see our guide to enterprise backup strategies.

Table 2 sums up the six lines.

Table 2. Six budget lines, how each bills, and when it recurs

How to build a cybersecurity budget in seven steps

The build takes seven steps, each ending with a document the approval pack uses.

1. Inventory current security spend, including spend outside the security line

Start from what the company already pays, line by line. List every current security cost under the six lines of the breakdown, with its vendor and renewal date. Then add the security work paid from other budgets, such as AI tools or platforms with security functions, and note who pays for each. You finish with a baseline of today's spend, by line and by the budget that pays for it.

2. List the obligations that set the budget's floor

List and price these; except where noted, they are funded whatever the risk ranking says:

• SEC rules (public companies). The SEC's 2023 rules require disclosure of cybersecurity risk management and board oversight, and a Form 8-K within four business days after determining an incident is material.
• FTC Safeguards Rule (financial institutions). The FTC's guide to the rule says covered financial institutions must keep an information security program.
• CMMC (defense contractors). A July 2026 Department of War implementation document suspended CMMC Phase 2: new procurement documents may require only the company's self-assessments at Level 1 or Level 2. Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, on safeguarding defense information and incident reporting, remains in effect.
• HIPAA Security Rule update. Watch it rather than fund it: it remains a proposed rule, published by HHS on January 6, 2025, with no final rule as of October 2026.
• Customers. Contracts and security reviews can require a current SOC 2 report, an ISO 27001 certificate, or a penetration test.
• Insurers. A cyber policy or its renewal application can set conditions, so the insurer is a source of obligations too; our article on new cyber insurance requirements describes how they have changed.

You finish with a priced floor list.

3. Rank the remaining risks by likelihood and impact

Then score each remaining risk for likelihood and impact, and price its response. NIST SP 800-30 treats risk as "a function of the likelihood of a threat event's occurrence and potential adverse impact". SP 800-221A lists a risk response cost among the details planned for each risk on the register.

A smaller program can start from CIS Controls v8.1 Implementation Group 1, which CIS calls "essential cyber hygiene". CISA's voluntary Cybersecurity Performance Goals 2.0 also rate each goal for cost and impact. You finish with a ranked list, each risk priced.

4. Check coverage against the six CSF 2.0 Functions

CSF 2.0 sorts security outcomes into six Functions, from Govern to Recover, and links spending across them: "Investments in planning and testing in the GOVERN and IDENTIFY Functions will support timely detection".

Map each budget line and ranked risk to a Function; one with nothing against it is a gap to price or to accept in writing. NIST attaches no percentage to any Function. You finish with a gap list by Function.

5. Decide what to run in-house and what to buy as a service

For each line, decide who does the work: your staff, a provider, or both. Some small and mid-market CISOs lean on managed services and automation to stretch lean teams, IANS reports. Weigh the hours that need cover, the skills the work takes, and whether you can hire them at the price. Leadership is the same choice, between a full-time CISO and a fractional or virtual one. You finish with a sourcing decision per line.

6. Put recurring audits, assessments, and renewals on a 36-month calendar

Several obligations recur over more than a year, so plan three years ahead:

• CMMC Level 1 (Self): a self-assessment every year under 32 CFR part 170, plus an annual affirmation.
• CMMC Level 2 (Self): a self-assessment every three years, plus annual affirmations.
• CMMC certification assessments: Level 2 by a CMMC Third-Party Assessment Organization (C3PAO), or Level 3 by the government's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), every three years; show the line as suspended while new procurement cannot call for them.
• ISO 27001: Bureau Veritas describes its process as generally initial certification, surveillance audits at the one- and two-year marks, then recertification after three years.
• SOC 2 Type 2: the report covers a specified period; plan the next one to end before your customers' contracts ask for it.
• Tests and renewals: each test before its audit window, the retest after remediation, and every renewal month.

You finish with a calendar showing each cost in the year it falls due.

7. Size an incident reserve and set the review dates

Last, hold money for the unplanned. Size the incident reserve from your own terms, not a rule of thumb: the retention under your cyber policy, plus the recovery costs that neither the policy nor your incident response retainer covers. Set review dates at each contract renewal, each audit window, and each leadership or board meeting where security reports, so changes land before money is committed. You finish with a reserve and a review calendar.

Cybersecurity spending increases: 2026 budget growth and 2027 plans

Security budgets still grow on average, but most CISOs did not get an increase in 2026. IANS and Artico Search's 2026 report puts average growth at 5%, up from 4% in 2025, while median growth stayed at 0% for the second year in a row. Only 45% of CISOs received any increase, down from 78% of CISOs in 2022, and average growth remains well below its 17% peak of 2022.

IANS's small and mid-market report shows growth slowing for companies under $1 billion: 2% in 2025, down from 7% in 2024. Across the segment, 19% of budgets fell, 39% stayed flat, and 15% grew by more than 10%.

Plans for 2027 run ahead of this year's results:

• IANS: 64% of CISOs expect their budgets to grow next year, but the same share asked for an increase in 2026 and 45% received one.
• PwC: 84% of security and finance leaders in its 2027 Global Digital Trust Insights survey expect cyber budgets to rise over the next 12 months.
• Forrester: 82% of technology decision-makers expect budget increases in 2027, a figure for technology budgets as a whole.
• IBM: in follow-on research, 85% of organizations plan to raise security spending after learning of advanced frontier AI capabilities.

AI leads the plans for new money: in IANS's 2026 data, 69% of CISOs name AI for security as a focus of net-new budget, followed by SecOps automation at 51%. PwC's leaders rank data protection and trust (51%) first among the factors shaping their 2027 spend priorities, ahead of securing against AI-enabled attacks (46%).

Table 3 sets IANS's 5% average and 0% median beside the spending plans of PwC, Forrester, and IBM, each with the group it asked.

Table 3. Cybersecurity budget growth statistics, 2026 and 2027

Sources: PwC (2026); Forrester (July 2026); IBM (July 2026); IANS and Artico Search (2026); read October 2026.

Cybersecurity budget strategies: six ways to stretch and defend the budget

Each strategy below changes either a line of the budget or the case made for it.

1. Benchmark against companies like yours, not the overall average

IANS advises CISOs to look past overall averages for 2027 and "benchmark against organizations that are similar to theirs in size, ownership, and financial performance". Ownership is one of those differences: 71% of VC-backed companies increased their security budgets, with growth averaging 14%, while 52% of publicly listed companies reported increases. Take the size tier from the benchmarks chapter that matches your revenue, and name the peer group you used when you present the number.

2. Argue business risk and regulation, not breach fear

In IANS and Artico Search's 2026 benchmark, 48% of CISOs whose budgets grew cited increased business or operational risk, and 3% cited a breach. Increases were largest where board or executive focus on cybersecurity was a driver (23% on average) and where new regulations or compliance requirements were a driver (22%), against 9% for a major breach. Board focus takes time to build; the request itself should name the business risk and the regulation it answers.

3. Give AI its own budget line

Companies that give AI its own line report increased AI funding more often. In IANS's 2026 data, 24% of organizations track AI as a separate line or subcategory, while 38% embed it in the security budget. Another 38% fund it elsewhere, through IT, data, or innovation budgets. About 70% of organizations with a formal line reported increased AI funding, against 42% where AI was embedded and 31% where it was funded elsewhere.

4. Consolidate overlapping tools before asking for new money

Renewals can absorb a budget before any new work is funded. IANS's small and mid-market report notes that where budgets hold flat, vendor renewals "consume most of or all available spending before it reaches the team". Before asking for more, map the tools you own against the controls they serve and retire the duplicates; renegotiate the rest at renewal. The savings and the retired licenses become part of the case for new money.

5. Budget the remediation and the retest, not only the test

A penetration test that finds problems creates two more costs: fixing them and proving they are fixed. PCI DSS v4.0.1 states this for card data in requirement 11.4.4: exploitable vulnerabilities found during penetration testing are corrected, and "Penetration testing is repeated to verify the corrections". We apply the same logic to any test a customer or an auditor will read. Put engineering time for remediation and the retest fee in the testing line, and schedule both before the audit window.

6. Map one control set to every framework you owe

If you owe two frameworks, such as SOC 2 and ISO 27001, plan one control set for both rather than one per framework. NIST lists Informative References, "mappings that indicate relationships between the Core and various standards", among the online resources of CSF 2.0. AICPA publishes mappings between the Trust Services Criteria behind SOC 2 and other frameworks. Those mappings are reserved for AICPA and CIMA members, so ask your audit firm for them. In our view, a control tested once can serve as evidence in several audits, lowering the compliance line over the cycle.

How to justify a cybersecurity budget to leadership and the board

Justify the budget with the documents the build already produced, because together they show what each dollar is for. Put these in the approval pack:

• The floor list. Each obligation from step 2 with its source and cost, so leadership sees which part of the budget a cut would turn into a compliance or contract gap.
• The ranked, priced risk list. The output of step 3, showing which risks the money addresses first and which ones the company accepts.
• The benchmark comparison. Your security spend as a share of IT and of revenue, set beside the peer group you chose, with each benchmark's source and sample.
• The 36-month calendar. The audits, assessments, tests, and renewals from step 6, so a year-two or year-three cost is approved before it arrives.
• The ask, framed as business risk. The increase itself, tied to the business risks and obligations it covers, as strategy 2 recommends.

NIST SP 800-55 Volume 2 describes this use of measurement: a measurement program "provides evidence to support decisions" that include "budget and personnel requests and the allocation of available resources". For the return on a single investment, ENISA's Introduction to Return on Security Investment gives the ROSI formula. Our guide to cybersecurity metrics and KPIs for board reporting covers how to keep presenting the numbers quarter after quarter.

Common cybersecurity budgeting mistakes

These mistakes undo a budget that is otherwise sound:

• Quoting a superseded edition. Budget surveys and breach reports publish new figures every year, and a number from last year's edition invites doubt about everything else in the pack. Cite the current edition with its year.
• Treating an average as a target. An average growth rate can sit well above what the typical company received, as the median in the increases chapter shows. Plan from your own floor and risks, then compare.
• Copying a percentage split. A split across Functions or categories taken from another company has no basis in NIST's framework. Build the split from your own gap list in step 4.
• A one-year view of multiyear cycles. ISO 27001 surveillance audits, CMMC assessments, and SOC 2 report periods fall in different years, and a one-year budget meets them as surprises. Use the 36-month calendar.
• Tools without the people to run them. A new tool needs staff time or a service to operate it. Budget the operator in the staff or managed-services line in the same year as the license.

Conclusion

A defensible cybersecurity budget starts with what the company must fund, adds the risks it chooses to reduce, and only then looks at what peers spend. Built that way, each line has a reason you can repeat in a cost review, and each recurring audit has a date. Revisit the approval pack at each renewal and audit window, and next year's budget starts from a record rather than from last year's total.