How to Build a Cybersecurity Budget
A security budget that is just last year's number plus a percentage falls apart the moment someone asks why. This guide shows you how to build one you can defend — grounded in a real baseline, benchmarked against peers, mapped to the risks it reduces, balanced across people and tooling and services, and measured by the outcomes it delivers.
In plain words
Building a cybersecurity budget means benchmarking your spend against peers, mapping every dollar to the risk it reduces, and defending the plan to the board — and PlayCISO has a free, browser-based budget benchmark tool to anchor it. The two ratios that matter are security as a share of the IT budget and as a share of revenue, read against your own sector and size.
Budget from risk, not from inertia. Balance tools against the people to run them, separate run from grow from transform, and report outcomes so next year's ask is easy.
Step by step
- 1
Establish your baseline spend
Before you can plan, you need an honest picture of what you already spend. Pull together licensing and tooling, salaries and contractors, managed services, training, insurance, and the security share of cloud and infrastructure costs — including the shadow spend hiding in other teams’ budgets. A clear baseline is the foundation for every benchmark and justification that follows.
- 2
Benchmark against peers
Compare your spend using the two common ratios: security as a percentage of the overall IT budget, and security as a percentage of revenue. Typical figures vary widely by sector and maturity, so benchmark against your own industry and size rather than a single headline number. Benchmarks tell you whether you are an outlier, not what the right answer is — a low number can mean efficiency or neglect.
- 3
Map spending to risk
Tie each line of spend to the risk it reduces, using your risk register or framework assessment as the map. This exposes the two failure modes: money piled on well-covered risks, and severe risks with little or no investment. Budgeting from risk — rather than from last year plus a percentage — is what lets you defend both cuts and increases on their merits.
- 4
Balance people, tooling and services
A healthy budget is not all software. Tools you cannot staff become shelfware, so weigh headcount and skills against licensing, and consider managed services where 24/7 coverage or scarce skills make them cheaper than hiring. The right mix depends on your size and maturity; small teams often lean on services, while larger ones build internal capability.
- 5
Plan for run, grow and transform
Separate the budget into keeping the lights on (run), improving existing capability (grow), and new strategic initiatives (transform). This framing stops essential operational spend from being raided to fund shiny projects, and makes it obvious when the run cost is crowding out any ability to improve. Fund resilience and the basics before novelty.
- 6
Justify it to the board
Translate the ask into business language: the risks it reduces, the expected loss it avoids, the obligations it meets, and what happens if it is cut. Avoid fear-only pitches and tool jargon; show scenarios and trade-offs, and offer tiered options rather than a single take-it-or-leave-it number. Benchmarks and a risk-mapped plan make the request credible instead of defensive.
- 7
Track outcomes, not just spend
Close the loop by measuring what the budget bought — coverage of critical assets, time to detect and respond, control maturity movement, audit findings closed, phishing-test results. Reporting outcomes rather than activity builds the trust that makes next year’s budget conversation easier, and shows where to reallocate from low-impact spend to higher-impact work.
Compare your spend against peers by percentage of IT and revenue, and see where you sit for your sector and size — free, in your browser.
Related
The interactive peer-comparison tool this guide walks you through.
Security budget benchmark guideDeeper reference on the ratios and typical figures behind the benchmark.
PCI DSS compliance guideA worked example of mapping mandated controls to budget line items.
PlayCISO labsBudget-siege and boardroom simulations to practice defending a plan under pressure.
Frequently asked questions
What percentage of the IT budget should go to security?
There is no single correct figure — it depends heavily on your sector, regulatory exposure, risk appetite and maturity. Benchmarks are useful for spotting whether you are a clear outlier, but a lower percentage can reflect either efficiency or dangerous under-investment, and a higher one can reflect either strong posture or wasted spend. Use the ratio to start a conversation, then justify the actual number against your specific risks.
Should I budget from last year or from risk?
Budgeting from risk is far more defensible than last year plus a percentage. Risk-based budgeting ties each line of spend to a specific risk it reduces, which lets you argue for increases where exposure is high and cuts where a risk is already well covered. Incremental budgeting tends to lock in whatever imbalance you started with and gives you nothing to say when the board asks why.
How do I split spend between tools, people and services?
Start from the work that needs doing and the skills and coverage required, not from a vendor shortlist. Tools you cannot staff or operate become shelfware, so pair every significant tool with the headcount to run it, and use managed services where round-the-clock coverage or scarce expertise would cost more to build in-house. The right mix shifts with size: smaller teams often rely more on services.
How do I justify a budget increase to the board?
Frame it in business terms: the specific risks the increase reduces, the expected loss it avoids, the compliance obligations it satisfies, and the concrete consequences of not funding it. Offer tiered options rather than a single number, back the ask with peer benchmarks, and avoid pure fear or technical jargon. Boards fund credible, risk-mapped plans far more readily than open-ended "we need more" requests.
What happens if I spend less than my peers?
It is a signal to investigate, not a verdict. Lower spend can mean you have simplified your estate, automated well, or outsourced efficiently — or it can mean critical risks are unfunded and will surface in an incident. Map your spend to your risks to find out which it is; the benchmark only tells you that you differ from peers, not whether that difference is good or bad.
How do I show the budget was worth it?
Measure outcomes, not activity. Track coverage of critical assets, time to detect and respond, movement in control maturity, audit findings closed, and the results of phishing and tabletop exercises, then report the trend. Demonstrating that last year’s spend moved real metrics is the single most effective thing you can do to make the next budget conversation easier.