Sourced · dated · auditable
Data Sources
Every figure in the calculator traces back to a named, dated source. We publish the full list so you can verify it yourself. Where a source is licensed and not freely redistributable — such as Gartner or IANS — we cite it only from published or openly available figures (press summaries, public benchmarks, and headline statistics) and never reproduce paywalled detail. Verification dates indicate when we last confirmed each figure against the source.
| Source | Publisher | What it proves | Verified |
|---|---|---|---|
| IANS / Artico 2025 Security Budget Benchmark | IANS Research & Artico Search | Spend benchmarks (% IT budget, % revenue, per employee) | Jun 2026 |
| Deloitte / FS-ISAC cybersecurity spend study | Deloitte, FS-ISAC | Spend benchmarks (% IT budget, % revenue, per employee) | Jun 2026 |
| Kaspersky IT Security Economics | Kaspersky | Spend benchmarks (% IT budget, % revenue, per employee) | Apr 2026 |
| Avasant IT Spending as % of Revenue by Industry | Avasant / Computer Economics | Spend benchmarks (% IT budget, % revenue, per employee) | Jun 2026 |
| IBM Cost of a Data Breach 2025 | IBM / Ponemon | Breach impact & ROI denominator | Jun 2026 |
| Verizon Data Breach Investigations Report 2025 | Verizon | Control frameworks & maturity mapping | May 2026 |
| BLS — Information Security Analysts (OES wage data) | U.S. Bureau of Labor Statistics | Staffing cost inputs | May 2024 |
| NIST Cybersecurity Framework 2.0 | NIST | Control frameworks & maturity mapping | Jun 2026 |
| CISA guidance & Known Exploited Vulnerabilities | CISA | Control frameworks & maturity mapping | Jun 2026 |
| Endpoint pricing — CrowdStrike, SentinelOne, Microsoft Defender (list) | Vendor pricing pages | Per-control unit costs | Jun 2026 |
| Identity pricing — Microsoft Entra, Okta, Cisco Duo (list) | Vendor pricing pages | Per-control unit costs | Jun 2026 |
| Email security pricing — Microsoft Defender for O365, Proofpoint, Mimecast | Vendor pricing pages | Per-control unit costs | Jun 2026 |
| SIEM pricing — Splunk, Microsoft Sentinel (ingest-based) | Vendor pricing pages | Per-control unit costs | Jun 2026 |
| MDR pricing — Huntress, Arctic Wolf, CrowdStrike, SentinelOne | Vendor pricing / buyer data | Per-control unit costs | Jun 2026 |
| Vulnerability management pricing — Tenable, Qualys, Rapid7 | Vendor pricing pages | Per-control unit costs | Jun 2026 |
| Security awareness pricing — KnowBe4, Proofpoint | Vendor pricing pages | Per-control unit costs | Jun 2026 |
| Penetration test pricing — Astra & industry guides | Astra Security / industry surveys | Per-control unit costs | Jun 2026 |
| Compliance cost guides — Secureframe, Centraleyes, Thoropass | Compliance vendors | Per-control unit costs | Jun 2026 |
| Cloud security pricing — Microsoft Defender for Cloud, Wiz, Prisma Cloud, Orca | Vendor pricing / buyer data | Per-control unit costs | Jun 2026 |
| Network security pricing — Palo Alto, Fortinet, Cisco, Darktrace, Vectra | Vendor pricing / Vendr | Per-control unit costs | Jun 2026 |
| PAM pricing — CyberArk, Delinea, BeyondTrust | Vendor pricing / Vendr | Per-control unit costs | Jun 2026 |
| DLP pricing — Microsoft Purview, Forcepoint, Zscaler, Symantec | Vendor pricing / buyer data | Per-control unit costs | Jun 2026 |
| Threat intel / dark web pricing — Recorded Future, Flare, ZeroFox, SpyCloud, HIBP | Vendor pricing / Vendr | Per-control unit costs | Jun 2026 |
| IR retainer pricing — Mandiant, CrowdStrike, Unit 42, Arctic Wolf | Vendor pricing / buyer data | Per-control unit costs | Jun 2026 |
For how each of these maps to a specific claim in the model, see the Methodology.
Estimates are based on public pricing, industry benchmarks, and security frameworks. For planning only — not professional, financial, or legal advice.