IT budget benchmarks by industry 2026 (and how much goes to security)

“What’s a normal IT budget?” has no single answer — it depends heavily on industry. IT spend as a share of revenue ranges from around 2.5% in manufacturing to 7.5% in financial services and technology. And since cybersecurity is usually measured as a percentage of the IT budget (median ~11%), your industry’s IT-spend norm shapes what a “normal” security budget looks like too.

Here are the 2026 IT budget benchmarks by industry, and how security fits on top.

IT budget as a percentage of revenue, by industry

Industry	IT budget (% of revenue)
Financial services	~7.5%
Technology	~7.5%
Professional services	~5.5%
Government / public	~5.0%
Healthcare	~5.0%
Education	~4.5%
Retail	~3.5%
Energy / utilities	~3.0%
Manufacturing	~2.5%

Figures are drawn from public IT-spend-by-industry benchmarks (Avasant / Computer Economics). Data-and-transaction-heavy sectors (finance, tech) spend the most on IT relative to revenue; asset-heavy sectors (manufacturing, energy) spend the least, because revenue is driven by physical operations rather than software.

Where cybersecurity fits

Security is typically ~11% of the IT budget (IANS/Artico 2025), or about 0.69% of revenue and ~$2,300 per employee cross-industry. Combine those and you can sanity-check a security budget two ways:

• Top-down from revenue: industry IT ratio × ~11% for security. A financial-services firm (~7.5% IT) lands near ~0.8% of revenue on security; a manufacturer (~2.5% IT) far less.
• Bottom-up from headcount: ~$2,300 per employee as a cross-industry anchor.

Watch the denominator

Here’s the trap: because ”% of IT budget” divides by IT spend, a lean-IT industry can look like it over-invests in security while spending little in absolute terms. Healthcare is the classic example — modest IT budgets mean security can be a high share of IT yet a low figure per employee. Always cross-check at least two framings before concluding a budget is high or low. (We break this down in why security budgets should be measured more than one way.)

Don’t forget staffing

Both IT and security budgets are dominated by people. Security headcount — loaded around $168K per FTE using BLS May 2025 wage data plus a 30% planning load — is usually the largest security line and is already inside these benchmark percentages.

Worked revenue examples

For a company with $100M in annual revenue, applying the industry IT ratio and then the 11% security-share benchmark produces very different top-down anchors:

Industry	Illustrative IT budget	11% security share	0.69% revenue cross-check
Manufacturing	$2.5M	$275K	$690K
Healthcare	$5.0M	$550K	$690K
Professional services	$5.5M	$605K	$690K
Financial services / technology	$7.5M	$825K	$690K

The spread is the point. If manufacturing’s bottom-up control plan is closer to $700K, that does not automatically mean overspending; it may mean the company runs an unusually lean IT denominator, has operational-technology exposure, or includes security costs that peers book elsewhere.

Normalize before presenting the benchmark

State whether revenue is trailing or forecast, whether IT includes cloud consumption and telecom, and whether security includes product security, privacy, fraud, resilience, or insurance. Then show all three framings on one page. Executives can understand a disagreement between denominators when the definitions are visible; they cannot evaluate a single percentage whose scope is hidden.

Benchmark your own budget

To turn these industry ratios into a defensible number for your organisation — with the percentile detail behind them — run the free, ungated cybersecurity budget calculator or read the full Cybersecurity Budget Benchmark 2026 report.