Security Budget Benchmark: how much to spend on cybersecurity
PlayCISO's Security Budget Benchmark helps you size a cybersecurity budget as a percentage of IT spend and revenue, by industry and company size, using a transparent model you can run yourself for free. The model is built from publicly reported figures — security is commonly around 5–15% of the IT budget (Gartner), with industry-specific ranges on this page — and it is designed to give a defensible starting number for a board or budget conversation, not a single authoritative statistic.
There is no single "correct" cybersecurity budget. What peers spend varies enormously with risk profile, regulatory exposure and threat landscape. What a benchmark can do is bracket a defensible range: given your revenue, industry and headcount, roughly what do comparable organisations invest in security?
This page publishes PlayCISO's benchmark model in full — the exact percentage ranges the free Security Budget Benchmark tool uses — so you can see where the numbers come from and judge whether they fit your situation. These are indicative peer ranges, framed as the model's ranges, not a quoted survey headline.
The model's ranges, by industry
The model expresses security spend two ways: as a share of the IT budget (where security sits as a line item) and as a share of total revenue (a much smaller number). Each cell shows the model's low, typical and high points.
| Industry | % of IT budget low · typical · high | % of revenue low · typical · high |
|---|---|---|
| Financial services | 10% · 15% · 20% | 0.3% · 0.6% · 1% |
| Healthcare | 7% · 11% · 16% | 0.2% · 0.45% · 0.8% |
| Technology | 8% · 13% · 18% | 0.3% · 0.7% · 1.2% |
| Energy | 7% · 12% · 17% | 0.2% · 0.4% · 0.7% |
| Retail | 5% · 9% · 13% | 0.1% · 0.25% · 0.5% |
| Manufacturing | 4% · 8% · 12% | 0.1% · 0.2% · 0.4% |
| Public sector | 5% · 9% · 14% | 0.15% · 0.35% · 0.6% |
| Other / general | 5% · 10% · 15% | 0.2% · 0.4% · 0.7% |
Read a row like this: a technology company sits in a model range of 8–18% of its IT budget (typical 13%) and 0.3–1.2% of revenue (typical 0.7%). The tool multiplies the revenue range by your headcount to also show a per-employee figure.
How the model splits a security budget
Once the model estimates a typical budget, it breaks it into an indicative allocation across five areas. This is a planning split, not a prescription.
Methodology & sources
The ranges above are compiled from publicly reported figures. They are approximate and broad by design — the model combines them into indicative peer ranges rather than quoting any single study verbatim. The named sources are:
- Gartner — IT-spend research. Security is commonly reported at roughly 5–15% of the IT budget.
- IANS / Artico Search — security-budget benchmarks used to shape the industry ranges.
- Deloitte "State of Cyber" — a typical point of around 10% of IT spend and roughly 0.5% of revenue.
These figures are cited exactly as the underlying model names them; no percentage on this page is attributed to a source that the model does not reference. Because the inputs are approximate public ranges, treat the output as a bracket, not a precise figure. A benchmark is a starting point, not a target — spend should follow your risk, not the average.
As of October 14, 2026. The model's ranges reflect the published version of PlayCISO's Security Budget Benchmark on this date.
Cite this: PlayCISO, "Security Budget Benchmark: how much to spend on cybersecurity," https://playciso.com/guides/security-budget-benchmark (accessed October 14, 2026).
Run the benchmark on your own numbers
Enter your revenue, industry and headcount to turn these ranges into a dollar figure, a per-employee number and an allocation split — free, in your browser, nothing uploaded.
Open the Security Budget Benchmark tool →Frequently asked questions
What % of IT budget should go to security?
A common benchmark is roughly 5–15% of the IT budget, with the typical point near 10% (Gartner). PlayCISO's model varies this by industry: it uses 10–20% for financial services, 8–18% for technology, 7–16% for healthcare, 7–17% for energy, 5–14% for public sector, 5–13% for retail, 4–12% for manufacturing, and 5–15% as a general range. These are indicative peer ranges, not targets — the right figure depends on your risk profile.
How much should a company spend on cybersecurity?
As a share of revenue, security spend is much smaller than as a share of IT budget — commonly a fraction of one percent. PlayCISO's model uses typical points of about 0.6% of revenue for financial services, 0.7% for technology, 0.45% for healthcare, 0.4% for energy and manufacturing-to-public ranges below that, with full ranges spanning roughly 0.1% to 1.2% depending on industry. Enter your revenue, industry and headcount in the free tool to turn these percentages into a dollar figure and a per-employee number.
Is this benchmark free?
Yes. The Security Budget Benchmark tool runs entirely in your browser at playciso.com/tools/budget-benchmark with no signup and nothing uploaded. The model and its source ranges are published openly on this page.
How is a security budget typically allocated?
PlayCISO's model splits a security budget roughly as: 38% people (salaries, MSSP / SOC), 30% tooling and technology, 15% GRC, audit and compliance, 12% incident-response readiness, testing and training, and 5% contingency and emerging areas such as AI security. This is an indicative split, not a prescription.
Where do these benchmark numbers come from?
The ranges are compiled from publicly reported figures: Gartner IT-spend research (security commonly 5–15% of the IT budget), IANS / Artico Search security-budget benchmarks, and Deloitte's "State of Cyber" survey (around 10% of IT spend and roughly 0.5% of revenue as a typical point). PlayCISO combines these into indicative peer ranges by industry; they are approximate public figures, not a single quoted statistic.
Should I treat the benchmark as a target?
No. A benchmark is a starting point for a budget conversation, not a goal to hit. Spend should follow your organisation's risk, regulatory exposure and threat profile — not the industry average. Being below the typical range is a frequent audit finding, but being inside it does not by itself mean a program is adequate.