Open data · v2026.11
Cybersecurity budget benchmarks 2026: open dataset
What's in the dataset
Four CSV files with the benchmark distributions, company-size ranges, control unit costs and industry ratios behind the cybersecurity budget calculator and the 2026 cybersecurity budget benchmark report. They're free to download, reuse and chart, with attribution.
Security spend benchmark distributions
Total security spend (including personnel) as % of IT budget, % of revenue, and USD per employee, at the 10th, 25th, 50th, 75th and 90th percentiles.
| framing | label | unit | p10 | p25 | median | p75 | p90 | sources |
|---|---|---|---|---|---|---|---|---|
| pct_it_budget | % of IT budget | % | 7 | 9 | 11 | 14 | 20 | IANS / Artico 2025 Security Budget Benchmark; Kaspersky IT Security Economics |
| pct_revenue | % of revenue | % | 0.3 | 0.5 | 0.69 | 1 | 2 | IANS / Artico 2025 Security Budget Benchmark; Deloitte / FS-ISAC cybersecurity spend study |
| per_employee | $ / employee | $ | 900 | 1500 | 2300 | 3400 | 5000 | Deloitte / FS-ISAC cybersecurity spend study; IANS / Artico 2025 Security Budget Benchmark |
Column definitions
- framing
- Benchmark denominator: pct_it_budget, pct_revenue or per_employee.
- label
- Human-readable name of the framing.
- unit
- "%" for percentage framings, "$" for USD per employee per year.
- p10 / p25 / median / p75 / p90
- Peer distribution percentiles.
- sources
- Publications the distribution is blended from.
Security budget by company size
Typical annual security budget, % of IT budget and spend per employee for five company-size bands, plus the controls and staffing typical at each stage.
| size_band | employees_min | employees_max | annual_budget_low_usd | annual_budget_high_usd | pct_it_budget_low | pct_it_budget_high | per_employee_low_usd | per_employee_high_usd | typical_controls | typical_staffing |
|---|---|---|---|---|---|---|---|---|---|---|
| <50 | 1 | 49 | $45,000 | $250,000 | 9 | 20 | $1,500 | $5,000 | MFA/SSO, EDR, email security, backups, awareness training | IT-led; vCISO advisory |
| 50-250 | 50 | 250 | $135,000 | $1,100,000 | 9 | 16 | $1,500 | $4,500 | + MDR, vulnerability management, first compliance audit (SOC 2) | First security hire |
| 250-1,000 | 250 | 1000 | $500,000 | $3,400,000 | 9 | 14 | $1,500 | $3,400 | + SIEM, formal IR plan, pentesting, DLP, vendor risk | Small security team |
| 1,000-5,000 | 1000 | 5000 | $1,500,000 | $12,000,000 | 8 | 14 | $1,200 | $3,000 | + in-house/hybrid SOC, IAM platform, red teaming, GRC tooling | Dedicated function + CISO |
| 5,000+ | 5000 | $7,500,000 | $40,000,000 | 7 | 14 | $900 | $2,300 | + platform consolidation, threat intel, global compliance, automation | Full org under CISO |
Column definitions
- size_band
- Employee-count band.
- employees_min / employees_max
- Band bounds (max blank for open-ended).
- annual_budget_low_usd / annual_budget_high_usd
- Typical annual total security budget range, USD.
- pct_it_budget_low / pct_it_budget_high
- Security as a share of the IT budget, %.
- per_employee_low_usd / per_employee_high_usd
- Annual security spend per employee, USD.
- typical_controls / typical_staffing
- Controls and staffing model usually added at this stage.
Security control unit costs
Planning unit costs for 16 security controls (EDR, MDR, SIEM, identity, email, PAM, DLP and more): typical price range, the annual rate used by the calculator, confidence, and source.
| control_name | category | typical_price | annual_cost_basis | confidence | source_name | verified |
|---|---|---|---|---|---|---|
| Security Staffing | Govern | ~$168K loaded / FTE (BLS) | security FTEs x $168000 loaded salary (1 FTE per 300 employees, min 1) | medium | BLS — Information Security Analysts (May 2025 wage data) | Aug 2026 |
| Endpoint Protection (EDR/XDR) | Detect & Respond | $3–$20 / user / mo · ~$8 typical | employees x $96 | high | Endpoint pricing — CrowdStrike, SentinelOne, Microsoft Defender (list) | Jun 2026 |
| Identity Security | Protect | $3–$12 / user / mo · ~$7 typical | employees x $84 | high | Identity pricing — Microsoft Entra, Okta, Cisco Duo (list) | Jun 2026 |
| Email Security | Protect | $2–$8 / user / mo · ~$4 typical | employees x $48 | high | Email security pricing — Microsoft Defender for O365, Proofpoint, Mimecast | Jun 2026 |
| SIEM | Detect | Ingest-based · ~$30K–$150K mid-market | endpoints x $60 + cloudWorkloads x $150 | medium | SIEM pricing — Splunk, Microsoft Sentinel (ingest-based) | Jun 2026 |
| MDR / SOC | Detect & Respond | $3–$45 / endpoint / mo · ~$6 typical | endpoints x $72 | medium | MDR pricing — Huntress, Arctic Wolf, CrowdStrike, SentinelOne | Jun 2026 |
| Vulnerability Management | Identify | ~$17–$42 / asset / year | endpoints x $30 + applications x $30 | medium | Vulnerability management pricing — Tenable, Qualys, Rapid7 | Jun 2026 |
| Security Awareness | Protect | $12–$45 / user / year | employees x $25 | high | Security awareness pricing — KnowBe4, Proofpoint | Jun 2026 |
| Compliance | Govern | Per framework / year | hipaa $15000 + soc2 $40000 + pci $20000 + gdpr $60000 + iso27001 $40000 | medium | Compliance cost guides — Secureframe, Centraleyes, Thoropass | Jun 2026 |
| Testing | Identify | $5K–$50K / engagement · ~$18K | $18000 flat | high | Penetration test pricing — Astra & industry guides | Jun 2026 |
| Cloud Security (CSPM/CNAPP) | Protect | ~$60–$1,200 / workload / year | cloudWorkloads x $800 | medium | Cloud security pricing — Microsoft Defender for Cloud, Wiz, Prisma Cloud, Orca | Jun 2026 |
| Network Security (NGFW/NDR) | Detect | NGFW + NDR · ~$50K–$200K / year | $20000 flat + employees x $75 | medium | Network security pricing — Palo Alto, Fortinet, Cisco, Darktrace, Vectra | Jun 2026 |
| Privileged Access Management | Protect | Per privileged user (~10% of staff) | employees x $50 | medium | PAM pricing — CyberArk, Delinea, BeyondTrust | Jun 2026 |
| Data Loss Prevention | Protect | $3–$15 / user / month | employees x $60 | medium | DLP pricing — Microsoft Purview, Forcepoint, Zscaler, Symantec | Jun 2026 |
| Dark Web Monitoring & Threat Intel | Identify | ~$5K–$250K / year by size | $10000 flat + employees x $25 | medium | Threat intel / dark web pricing — Recorded Future, Flare, ZeroFox, SpyCloud, HIBP | Jun 2026 |
| Incident Response Retainer | Detect & Respond | Annual retainer · ~$10K–$150K | $20000 flat + employees x $25 | high | IR retainer pricing — Mandiant, CrowdStrike, Unit 42, Arctic Wolf | Jun 2026 |
Column definitions
- control_key / control_name / category
- Control identifier, name and NIST CSF-style category.
- typical_price
- Typical market price range and unit, as published on the site.
- annual_cost_basis
- Annual USD rate(s) the calculator multiplies by its inputs.
- confidence / risk_reduction
- Confidence in the price range; relative risk reduction.
- source_name / source_url / verified
- Primary pricing source and when it was last checked.
IT and security spend by industry
IT budget as a share of revenue by industry, and the implied security share of revenue if security takes the 11% median share of IT spend.
| industry | it_budget_pct_revenue | implied_security_pct_revenue |
|---|---|---|
| Healthcare | 5 | 0.55 |
| Financial Services | 7.5 | 0.825 |
| Technology | 7.5 | 0.825 |
| Retail | 3.5 | 0.385 |
| Manufacturing | 2.5 | 0.275 |
| Energy & Utilities | 3 | 0.33 |
| Government & Public | 5 | 0.55 |
| Education | 4.5 | 0.495 |
| Professional Services | 5.5 | 0.605 |
Column definitions
- industry_key / industry
- Industry identifier and name.
- it_budget_pct_revenue
- IT budget as % of revenue (Avasant / Computer Economics benchmarks).
- implied_security_pct_revenue
- Derived: it_budget_pct_revenue x 11% (median security share of IT). A SecurityBudget calculation, not a reported figure.
Sources, method and limitations
- Percent-of-IT and percent-of-revenue distributions are anchored on the IANS / Artico Security Budget Benchmark (median 10.9% of IT, 0.69% of revenue), blended with Kaspersky and Deloitte data. See data sources.
- The per-employee distribution skews toward financial services, where most published per-employee data comes from.
- Control unit costs come from public vendor pricing and buyer data; negotiated prices are often lower. Each row names its source and verification month.
implied_security_pct_revenueis a SecurityBudget calculation (IT share of revenue × median security share of IT), not a reported figure.- The full model, assumptions and changelog are in the methodology.
How to cite
SecurityBudget.com (2026). Cybersecurity Budget Benchmarks 2026 (version 2026.11) [Data set]. https://securitybudget.com/datasets/cybersecurity-budget-benchmarks-2026
Licensed under CC BY 4.0: reuse, chart or republish the data with a credit and a link to this page. Figures attributed to third-party publishers remain theirs; please cite the original source alongside us when you quote them.
Changelog
- v2026.11 (Nov 2026): first public release of the four CSV files.
Benchmark your own budget
Plug your headcount, industry and controls into the calculator to see where you land against these distributions.
Open the budget calculator