TL;DR
- Cybersecurity took a median 9% of IT budgets in ENISA’s NIS Investments 2025 report.
- ENISA’s sector medians run from 6.0% in energy to 13.3% in ICT service management.
- Split the budget across six categories, from EDR and identity to compliance and incident response retainers.
- Test controls before funding them: in one simulation, attacker command-and-control traffic ran undetected for 6 days.
- The global average breach cost $4.99 million in IBM’s 2026 report, so frame each line as avoided loss.
Table of contents
- Benchmarks Your Board Expects You to Quote
- Cybersecurity Budget Benchmarks by Industry
- Cybersecurity Budget 2026 Drivers That Can Wreck or Rescue Your Plan
- Real-World Losses That Show What Underfunding Costs
- Cybersecurity Budget Allocation by Category
- How to Build a Cybersecurity Budget in Six Steps
- CFO Questions You’ll Be Asked and Why They Matter
- Frequently Asked Questions
Planning your 2026 cybersecurity budget means walking into a CFO meeting with a benchmark beside every line. Companies with 500 to 10,000 employees sit in an awkward middle: too tempting for attackers to ignore, without Fortune 500 wallets to throw at every new shiny tool.
AI phishing kits now cost less than your team’s Friday pizza order, SaaS sprawl is laughing at your perimeter firewalls, and your CFO is side-eyeing every new request like it’s a luxury yacht.
The upside? With the right moves, you can defend revenue and keep auditors off your back without outspending the giants. This guide gives you sourced benchmarks by industry, a breakdown by control category, and a six-step method to build the budget. For editable worksheets and deeper case studies, the 2026 Cybersecurity Budget Playbook has your back.
Get the 2026 Cybersecurity Budget Playbook. Download the playbook
Benchmarks Your Board Expects You to Quote
Boards and CFOs may not know their SIEM from their SOC, but they do love benchmarks. Many of the figures that circulate have no traceable source, and a CFO who checks one will doubt the rest. These are the numbers you can source and defend:
- Cybersecurity took a median 9% of IT budgets in ENISA’s NIS Investments 2025 report, based on 1,080 EU organizations.
- The same ENISA report found spending moving toward technology and outsourcing, with security staff at 10.6% of IT headcount, its lowest share yet.
- Gartner expects worldwide information security spending to reach $244 billion in 2026, with 11.6% growth in constant currency, in a forecast published in February 2026.
ENISA’s sample is mostly large organizations in regulated EU sectors (83% large enterprises), so treat 9% as a reference point and adjust it for your own risk. Per-employee figures vary too widely by industry and company size to quote without a source, and none of the 2025 or 2026 primary research checked for this guide publishes one.
Pro tip: Map these percentages to your actual risk before you copy them. A SaaS-heavy firm with European customers will skew differently than a manufacturing shop chasing SOC 2. And if a board member questions a line item, ask: “What would it cost us if we cut this and got breached?” IBM’s 2026 Cost of a Data Breach Report puts the global average at $4.99 million, which usually ends the debate.
Cybersecurity Budget Benchmarks by Industry
Your industry changes both how much you spend and where the money goes. The NIS Investments 2025 survey data that ENISA published in December 2025 breaks the cybersecurity share of IT spending out by sector, based on 2024 budgets:
| Sector | Median share of IT budget | Average share |
|---|---|---|
| ICT service management | 13.3% | 13.0% |
| Digital infrastructure | 11.5% | 11.4% |
| Financial market infrastructures | 10.5% | 10.9% |
| Space | 10.0% | 10.2% |
| Banking | 9.4% | 9.4% |
| Waste water | 9.1% | 9.2% |
| Health | 9.0% | 9.1% |
| Public administration | 8.3% | 8.8% |
| Transport | 7.1% | 7.7% |
| Drinking water | 6.7% | 7.4% |
| Energy | 6.0% | 7.0% |
Two caveats apply. The data covers EU organizations under NIS rules, and a low share of a very large IT budget can still be a large number. Use the table to check whether your request is in range for your sector, then size the lines from your own risks.
Breach costs also differ by industry. IBM’s 2026 report puts the average financial services breach at $6.3 million and the average energy breach at $5.2 million. Verizon’s 2026 Data Breach Investigations Report (DBIR) shows where breaches start in each industry, which tells you which categories to fund first:
| Industry | Most common initial access vector | Breaches with third-party involvement |
|---|---|---|
| Manufacturing | Exploited vulnerabilities, 38% | 61% |
| Retail | Exploited vulnerabilities, 42% | 68% |
| Financial and insurance | Exploited vulnerabilities 22%, phishing 20% | 34% |
| Healthcare | Exploited vulnerabilities, 20% | 32% |
| Public administration | Exploited vulnerabilities, 40% | 36% |
| Educational services | Exploited vulnerabilities, 34% | 40% |
Read the two tables together. A manufacturer or retailer should weight patching, supplier access, and EDR heavily, because exploitation is the top way in and suppliers figure in most of their breaches. A bank or insurer splits more evenly between vulnerability management, identity, and phishing controls. A healthcare provider adds money for staff error, which Verizon calls a chronic source of breaches in the sector.
Cybersecurity Budget 2026 Drivers That Can Wreck or Rescue Your Plan
Your CFO thinks budgets are about columns and formulas. Attackers know they’re about timing, blind spots, and one forgotten MFA rollout. IBM’s 2026 Cost of a Data Breach Report found that one in four malicious breaches was AI-enabled, a 56% increase over the year before.
People are the other pressure. In ENISA’s 2025 survey, 76% of organizations reported difficulty attracting cybersecurity professionals and 71% difficulty retaining them. Here are the big 2026-specific forces shaping cybersecurity budgets, enough to steer you right without giving away all the playbook secrets:
| Driver | What changed | Quick budget move |
|---|---|---|
| AI-enabled attacks | Cheap phishing kits, deepfake voice scams, and auto-recon tools | Pair automated triage with analysts who decide |
| Cloud and SaaS sprawl | Workloads now sit outside the old perimeter | Fund cloud monitoring, identity governance, and SaaS checks |
| Compliance pressure | DORA, NIS2, PCI DSS v4.x, and SOC 2 spread | Reserve funds for audits, GRC tooling, and evidence collection |
| Cyber insurance pitfalls | Claims denied over missing controls such as MFA | Meet every policy requirement before the renewal date |
| Hiring and retention | Experienced SOC analysts are expensive and hard to keep | Blend your team with outsourced 24/7 coverage |
Why stop here? Because the playbook goes deeper: sample allocations, risk-ranking worksheets, and ROI math for each driver. If you want to walk into the boardroom with polished numbers, and answers to seven CFO curveballs, download the full 2026 Cybersecurity Budget Playbook.
Real-World Losses That Show What Underfunding Costs
A breach leaves scars that outlast fiscal years. Consider Hamilton, Ontario (2024): a ransomware attack disabled nearly 80% of the city’s network. Recovery cost $18.3 million, more than $14 million of it for external experts, and the city’s insurer denied the claim because multi-factor authentication had not been fully implemented. Taxpayers are covering the full bill.
Then there’s Synnovis Lab Services (2024), a U.K. pathology provider whose ransomware attack disrupted hospital diagnostics in London. Synnovis put the cost of the attack at £32.7 million, and the Financial Times reported that the costs far outstripped the company’s profits.
These stories show why a 2026 cybersecurity budget can’t be a copy-and-paste of last year’s numbers. Underfunding MFA or skipping a price comparison for 24/7 coverage could result in months of downtime or a denied claim. The full 2026 Cybersecurity Budget Playbook dives deeper, with cases where early investments, breach warranties, and cost comparisons for 24/7 coverage prevented six-figure losses.
Cybersecurity Budget Allocation by Category
Benchmarks tell you how big the budget should be; allocation tells you what it buys. Most security budgets split across six control categories, and each has its own cost drivers. Price each one from your own environment, because the 2025 and 2026 primary research cited here publishes no reliable percentage split by category.
Endpoint Detection and Response (EDR)
EDR is usually the first line on the budget, because ransomware still runs through endpoints. Verizon’s 2026 DBIR found ransomware in 48% of breaches, up from 44% a year earlier. EDR licenses are priced per endpoint or per device, so your count of laptops, servers, and cloud workloads sets the number.
The license is the smaller part of the cost. An EDR raises alerts that someone has to investigate around the clock, and its policies need tuning after rollout. Budget for the people or the provider who act on a detection at 2 a.m., and for the tuning work in the first months.
Identity Security and ITDR
Identity threat detection and response (ITDR) watches how accounts behave after login: new MFA devices, unusual locations, and privilege changes. Fund MFA on every account first, then monitoring of the identity provider you already run, such as Microsoft Entra ID or Okta.
Verizon’s 2026 DBIR found credential abuse as the initial access vector in 13% of breaches, down from first place the year before. The same report found that only 23% of third-party organizations fully fixed missing or weak MFA on their cloud accounts. Missing MFA can also cost you the insurance payout, as Hamilton’s denied claim shows.
Security Awareness Training
Training is cheap per seat, which makes it easy to underfund and hard to measure. Verizon’s 2026 DBIR found a human element in 62% of breaches, and click rates in voice and text simulations ran 40% higher than in email.
Simulations show where training money should go. In a phishing simulation UnderDefense ran for a US food producer, 43 of the 331 employees in the first wave clicked the malicious links. A second wave went to 529 employees: 64 clicked and 40 entered their credentials. In all, 860 of the company’s 10,000 employees received the emails.
Budget for training that tests voice and text as well as email, and track click and report rates every quarter.
SIEM and Log Management
A SIEM is often the line a compliance framework forces into the budget, because auditors expect centralized, retained logs. Its cost grows with ingest volume and retention, so a license sized on today’s data will miss next year’s cloud and SaaS logs.
Price three things separately: the license or ingest, storage for the retention period your framework requires, and the people who write detection rules and read the alerts. A SIEM bought for compliance with nobody to run it pays for logs that no one reads.
Compliance and Audit Readiness
Compliance is the line most likely to get approved: it was the main investment driver for 70% of organizations in ENISA’s 2025 survey. Budget for readiness work, evidence collection, the auditor’s fee, and the fixes the first gap assessment uncovers.
The audit itself sits outside any tool you buy. A SOC 2 report comes from an independent CPA firm, and an ISO 27001 certificate comes from an accredited certification body. Map the deadlines first: DORA has applied to EU financial entities since January 2025, and PCI DSS v4.x is the current standard for card data.
Incident Response Retainers
An incident response retainer buys guaranteed hours and response times from a team that already knows your environment. Ransom economics explain why it belongs in the budget: Verizon’s 2026 DBIR found that 69% of ransomware victims didn’t pay, and the median ransom paid fell to $139,875.
Refusing to pay still leaves a recovery bill, and most of it goes to outside experts, as Hamilton’s did. An incident response retainer sets the rates, the team, and the response clock before you need them. Check whether your cyber insurer requires a panel firm before you sign one.
How to Build a Cybersecurity Budget in Six Steps
A budget the CFO approves is built bottom-up from your risks and defended top-down with benchmarks. Work through these six steps in order, and every line of the final budget will have a reason and a source behind it.
Step 1: Inventory What You Spend and What You Own
List every security tool, contract, and renewal date, plus the people who run each one. Include the security spend hidden in IT, cloud, and legal budgets, such as MFA licenses, cloud-native security features, and outside counsel for incidents. Mark the tools that overlap or sit unused, because consolidating them is often the first saving you can show the CFO.
Step 2: Rank Your Risks by How Attacks Start
Use your incident history and your industry’s attack paths from the tables above to rank the risks that would hurt most, such as ransomware on production systems, a compromised identity provider, or a supplier breach. Add the regulatory and customer deadlines that fall inside the budget year. Each ranked risk becomes a budget line with an owner.
Step 3: Test Your Controls Before You Fund Them
A control you own earns its line only if it works under attack. A penetration test or a purple team exercise shows which controls hold, so you fund fixes before you buy more tools.
The food producer above had network security, endpoint protection, and a SOC in place when it asked UnderDefense for a purple team assessment. A simulated command-and-control channel stayed active for six days without any response from the SOC or the network monitoring tools, and a 10 GB file was exfiltrated to Dropbox. The findings gave the company a list of gaps to fix, which is exactly what a budget request needs.
Step 4: Price Each Category and Decide What to Build or Buy
Price each category from step 2 for your environment, then decide which ones your team runs and which ones you buy as a service. The hardest line is usually 24/7 coverage, because nights, weekends, and holidays need analysts on shift, plus the SIEM and EDR they work in.
If you need 24/7 coverage without the budget for a 24/7 team, the UnderDefense Agentic AI SOC works on top of the SIEM, EDR, cloud, and identity tools you already own. AI agents investigate every alert, with about 2 minutes from alert to triage, and analysts respond to critical alerts within a 20-minute SLA, so your team wakes up to finished investigations.
UnderDefense publishes 24/7 monitoring from $11 per device per month, with paid tiers quoted, so you can put a real number next to your in-house estimate.
To build that in-house estimate, the SOC cost calculator compares an internal SOC with an outsourced one side by side.
Step 5: Reserve Funds for Response and Deadlines
Hold back a contingency for the year’s surprises: an incident, a new customer’s security questionnaire, or an emergency patch cycle. Verizon’s 2026 DBIR found that only 26% of critical vulnerabilities in the CISA KEV catalog were fully remediated in 2025, with a median of 43 days to fix them, so plan for unplanned remediation work.
Step 6: Present the Budget in CFO Terms and Review It Quarterly
Show each line as the risk it reduces, the benchmark it sits against, and the cost of the incident it helps prevent. Then agree on a quarterly review, because threats, headcount, and compliance scope change faster than an annual cycle. If you are already sizing next year, the 2027 security budget planning guide covers AI SOC and compliance automation lines. The questions in the next section are the ones to rehearse.
CFO Questions You’ll Be Asked and Why They Matter
Your CFO is defending cash flow and shareholder confidence, so security buzzwords won’t carry a line item. When you pitch your cybersecurity spend for 2026, prepare for pointed questions:
- Expect “Why this spend?” first, and answer it by linking every line to an avoided loss or protected revenue, with the IBM breach cost as your anchor.
- Expect “Is this normal for our size and industry?” and answer with a sourced benchmark, such as ENISA’s sector medians.
- Expect “What risk remains if we fund only these items?” and be candid: trimming incident response retainers or skipping a breach warranty might save money now and invite multi-million-dollar losses later.
Boards also ask about CapEx vs. OpEx choices: why you’d choose a flexible outsourced 24/7 model over a costly in-house SOC buildout. They’ll probe automation promises against proven outcomes. Four more of these curveballs, with polished, CFO-ready responses, are inside the downloadable CFO’s Cheat Sheet bundled with the playbook.
Need 24/7 coverage without funding a 24/7 team? See it on your stack
Frequently Asked Questions
How much should we budget per employee for cybersecurity?
Per-employee figures vary too widely by industry and company size to use as a target. Build the number bottom-up instead: price the six categories for your headcount, devices, and compliance scope, then divide by employees to report it. Check the total against your sector’s share-of-IT-budget benchmark before it goes to the CFO.
Is outsourced 24/7 detection cheaper than building our own SOC?
Often, yes. Outsourced 24/7 detection and response turns a large capital expense into a predictable operating cost, and it covers nights, weekends, and holidays without hiring for every shift. Compare a provider’s quote with the full in-house cost: salaries for every shift, the SIEM and EDR licenses, and the time to tune detections.
Why do breach warranties and cyber insurance matter?
Because one breach can cost millions, and insurers can deny claims over missing controls such as MFA, as Hamilton, Ontario found. Insurance transfers part of the financial loss. UnderDefense’s Breach Protection Warranty is a separate warranty with its own conditions, so read the requirements of both before you count on either.
What new compliance pressures affect budgets in 2026?
DORA and NIS2 in the EU, PCI DSS v4.x for card data, and customer demands for SOC 2 reports now reach SaaS, fintech, and healthcare companies of every size. Budget for readiness work, evidence collection, auditor fees, and the remediation the first assessment uncovers, so a deal or a deadline doesn’t stall on a missing report.
How can a company get enterprise-grade protection without overspending?
Fund risks in priority order, consolidate overlapping tools, and test controls before you buy new ones. For 24/7 coverage, the UnderDefense Agentic AI SOC works on top of the stack you already own and pairs AI triage with analysts who make the decisions, so you don’t staff every shift yourself.
