Is our cybersecurity budget enough? How to tell without a benchmark

You can't tell from a percentage. "Peers spend X% of IT on security" tells you what other companies spend, not whether yours is enough, and the companies in the benchmark include plenty that got breached. The budget is enough when it funds the controls that close your top risks to a level leadership has accepted in writing, and when you can show that those controls work. If you can't name the top risks, can't map spend to them, or can't demonstrate the controls, the budget isn't "too small," it's unmeasured, and more money won't fix that.

Why the benchmark question keeps coming back

It's an honest question from executives who have no other way to judge. Security spend is hard to evaluate because the product is something not happening. So people reach for the only comparable number available. The trouble is that spend-to-IT ratios vary enormously with industry, size, cloud adoption, and what gets counted as "security," and that the same dollar can buy a control that matters or one that doesn't. A company spending generously on tools nobody has tuned is overspending and under-protected at the same time.

The question to ask instead

Three questions, in order:

What are we protecting against? Not "cyber threats." The specific scenarios that would hurt: an outage of the systems that make money, theft of the data that would trigger notification, fraud through the payments process, a compromised supplier. NIST's risk assessment guidance is built for exactly this: identify the threats and vulnerabilities that matter to your organisation and estimate likelihood and impact for each, so the list is yours and not the news cycle's (Joint Task Force Transformation Initiative, 2012).

What does the budget buy against each? Map the spend to the scenarios. Most organisations find that a large share of the budget goes to things with no clear line to a top risk, and that one or two top risks have almost nothing against them. That mapping is the real answer to "is it enough," and it usually says "wrong shape" rather than "wrong size."

Can we prove the controls work? A budget line for backups isn't the same as a restore that's been timed. A line for detection isn't the same as a test that showed an intrusion would be seen. CISA's performance goals are useful here because they're a short list of practices with measurable outcomes rather than a shopping list of products (Cybersecurity and Infrastructure Security Agency, 2025). Ask which of them you can demonstrate.

What "enough" looks like when you write it down

NIST's framework treats risk appetite as a governance decision: leadership decides how much risk the organisation will carry, and the programme is sized to get there (Pascoe et al., 2024). In practice that's a short table: each top scenario, the current exposure, the target exposure, what it costs to get there, and a named executive who accepts whatever gap remains. If the board has seen that table and accepted the gaps, the budget is enough by definition. If nobody has seen it, every budget conversation will be a negotiation about fear.

Where budgets go wrong

Tools bought before the problem was defined. Licences for capabilities nobody has staff to run. Renewals that happen because they happened last year. Security spending hidden inside IT so nobody can see it. And the quiet one: a budget that's adequate on paper but can't be spent, because every hire takes nine months and every purchase needs three approvals. I'd rather see a smaller budget that's deployed than a larger one that's stuck.

The conversation with the CFO

Finance leaders respond well to this framing because it's how they think about everything else: what's the exposure, what does it cost to reduce, who owns the residual. Bring the table, not the percentage. If you also bring the two or three places where spend could be cut because it doesn't map to a risk, you'll get a hearing for the places where it needs to rise.

What I'd do next

Build the table: top five scenarios, current controls, spend against each, evidence the controls work, who owns the residual. It takes a few weeks and it changes the budget conversation permanently. If you'd like help building it, or an independent read on where your spend is and isn't working, request a briefing. The longer piece on judging security spend is Your Security Budget Is Not a Security Outcome.