% of IT budget vs % of revenue: which framing should you use?

When someone asks “are we spending enough on security?”, the answer depends almost entirely on which denominator you pick. The two most common framings — share of IT budget and share of revenue — can both be reasonable and still disagree with each other.

What each benchmark actually says

From the IANS / Artico 2025 data (roughly 587 CISOs), the central tendencies are:

• Security as % of IT budget: median near 11% (about 7% at the 10th percentile, 20% at the 90th).
• Security as % of revenue: median about 0.69%.
• Per employee: roughly $2,300 per employee across industries.

Each of these is a legitimate way to size a program. The trouble starts when you assume they should produce the same answer for your organization. They usually do not.

Why the two framings disagree

The hidden variable is how much your industry spends on IT in the first place. IT budget as a share of revenue varies widely:

Industry	IT as ~% of revenue
Financial services	~7.5%
Healthcare	~5%
Manufacturing	~2.5%

Now apply the same 11%-of-IT security benchmark to each:

• A bank spending 7.5% of revenue on IT lands near 0.83% of revenue on security at the median.
• A manufacturer spending 2.5% of revenue on IT lands near 0.28% of revenue — well under the 0.69% revenue benchmark, while still being perfectly on-benchmark as a share of IT.

Same security maturity, same percentile against the IT benchmark — yet one looks like an overspender on the revenue framing and the other looks like an underspender. Neither conclusion is correct.

This is also why per-employee figures can diverge from both: headcount-light, capital-intensive businesses look different per person than people-heavy service firms.

When to use which framing

A simple rule of thumb:

1. Use % of IT budget when you are benchmarking program maturity against peers and you want to control for how technology-intensive your business is. It is the most stable framing across industries because it already normalizes for IT scale.
2. Use % of revenue when you are communicating to a board or CFO who thinks in revenue terms, or when comparing across companies with very different IT structures — but pair it with your industry’s IT-spend context so the number is not read naively.
3. Use per-employee as a sanity check, especially when headcount is your main cost driver. It is intuitive but most sensitive to business model.

The strongest budget narratives cite at least two framings and explain the gap between them rather than cherry-picking the most flattering one. Sector-specific studies — for example Deloitte’s work with FS-ISAC on financial institutions — reinforce that the “right” percentage is industry-dependent, not universal.

Watch the denominators, not just the ratio

A second source of confusion is that the denominators themselves are slippery. “IT budget” may or may not include cloud consumption, telecom, or staff costs depending on who built the number, and “revenue” can be gross or net, trailing or projected. Two organizations quoting “11% of IT” may be measuring against very different bases.

Before you compare yourself to any benchmark, pin down three things:

• What is in your IT budget? If cloud spend lives in a separate business-unit line, your IT denominator is artificially small and your security ratio will look inflated.
• Is security spend itself inside or outside the IT budget? Some organizations report security as a carve-out of IT; others fund it separately. The IANS benchmark treats it as a share of IT, so align your accounting before comparing.
• Which revenue figure? Use a consistent, defensible top line — and the same one every year — so trends are real rather than artifacts of definition changes.

Getting the denominators right does more for comparability than agonizing over a tenth of a percentage point on the ratio.

A practical reconciliation

When framings disagree, do not average them — explain them. State your security spend in all three terms, note where each lands relative to the benchmark, and attribute the differences to your IT intensity and headcount profile. A CFO is far more persuaded by “we are at the 11% IT-budget median but below the revenue median because our IT spend runs lean for our sector” than by a single decontextualized percentage.

Want to see all three framings side by side for your own numbers? Run them through the cybersecurity budget calculator.