Pro toolSecurity budget benchmark
How much should you spend on security?
Benchmark your security budget against peer ranges by revenue and industry, drawn from public Gartner/IANS/Deloitte figures. Get a defensible number for your next board or budget conversation.
Typical allocation of that budget
Indicative peer ranges compiled from public Gartner IT-spend, IANS/Artico security-budget, and Deloitte State of Cyber figures. These are broad averages — the right number follows your risk profile, not the benchmark. For planning and board discussion only.
Loading…
Sample report · illustrative data
Sample result: Security budget benchmark
Example inputs for a made-up technology company: $100,000,000 annual revenue, 500 employees and $450,000 current security spend.
Peer benchmark
- Typical security budget
- $700,000 (range $300,000 to $1,200,000)
- Share of revenue
- 0.3% to 1.2% (typical 0.7%)
- Share of IT budget
- 8% to 18% (typical 13%)
- Per employee
- $600 to $2,400 (typical $1,400)
- Your position
- Within the typical peer range for your revenue and industry
Typical allocation of the $700,000 typical budget
| Area | Share | Amount |
|---|---|---|
| People (salaries, MSSP/SOC) | 38% | $266,000 |
| Tooling & technology | 30% | $210,000 |
| GRC, audit & compliance | 15% | $105,000 |
| IR readiness, testing & training | 12% | $84,000 |
| Contingency / emerging (AI security) | 5% | $35,000 |
Read this as a starting point
Ranges are indicative peer figures drawn from public sources and are broad averages. The right number follows your own risk profile, so use the benchmark for board and budget discussion, not as a target.
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.