IT budget benchmarks by industry 2026 (and how much goes to security)

“What’s a normal IT budget?” has no single answer — it depends heavily on industry. IT spend as a share of revenue ranges from around 2.5% in manufacturing to 7.5% in financial services and technology. And since cybersecurity is usually measured as a percentage of the IT budget (median ~11%), your industry’s IT-spend norm shapes what a “normal” security budget looks like too.

Here are the 2026 IT budget benchmarks by industry, and how security fits on top.

IT budget as a percentage of revenue, by industry

Industry	IT budget (% of revenue)
Financial services	~7.5%
Technology	~7.5%
Professional services	~5.5%
Government / public	~5.0%
Healthcare	~5.0%
Education	~4.5%
Retail	~3.5%
Energy / utilities	~3.0%
Manufacturing	~2.5%

Figures are drawn from public IT-spend-by-industry benchmarks (Avasant / Computer Economics). Data-and-transaction-heavy sectors (finance, tech) spend the most on IT relative to revenue; asset-heavy sectors (manufacturing, energy) spend the least, because revenue is driven by physical operations rather than software.

Where cybersecurity fits

Security is typically ~11% of the IT budget (IANS/Artico 2025), or about 0.69% of revenue and ~$2,300 per employee cross-industry. Combine those and you can sanity-check a security budget two ways:

• Top-down from revenue: industry IT ratio × ~11% for security. A financial-services firm (~7.5% IT) lands near ~0.8% of revenue on security; a manufacturer (~2.5% IT) far less.
• Bottom-up from headcount: ~$2,300 per employee as a cross-industry anchor.

Watch the denominator

Here’s the trap: because ”% of IT budget” divides by IT spend, a lean-IT industry can look like it over-invests in security while spending little in absolute terms. Healthcare is the classic example — modest IT budgets mean security can be a high share of IT yet a low figure per employee. Always cross-check at least two framings before concluding a budget is high or low. (We break this down in why security budgets should be measured more than one way.)

Don’t forget staffing

Both IT and security budgets are dominated by people. Security headcount — loaded around $162K per FTE (BLS wage data) — is usually the single largest security line, and it’s already inside these benchmark percentages. A budget that only counts tools will look artificially small against them.

Benchmark your own budget

To turn these industry ratios into a defensible number for your organisation — with the percentile detail behind them — run the free, ungated cybersecurity budget calculator or read the full Cybersecurity Budget Benchmark 2026 report.