Guide · per-employee benchmark
Average security budget per employee
Per-employee benchmarks by size
Per-employee spend is the most intuitive way to compare yourself to peers — but it is also the most misread, because it moves inversely with size. The table below shows fully-loaded annual security cost per employee (tooling, services, staff, and compliance) across the size spectrum.
| Segment | Headcount | $ / employee / year | Why it lands here |
|---|---|---|---|
| Startup / micro | < 50 | $1,500 – $5,000 | Fixed tool minimums and first audits dominate. |
| SMB | 50 – 250 | $1,500 – $4,500 | First dedicated security hire; MDR over in-house SOC. |
| Mid-market | 250 – 1,000 | $1,500 – $3,400 | Tooling matures; some economies of scale appear. |
| Upper mid-market | 1,000 – 5,000 | $1,200 – $3,000 | Volume discounts and an internal team amortize cost. |
| Enterprise | 5,000+ | $900 – $2,300 | Maximum scale leverage; cost shifts to staff & platform. |
Distribution anchored on the Deloitte / IANS and Kaspersky benchmarks; the cross-industry median is approximately $2,300 including personnel.
How industry shifts the number
Two companies of the same size in different sectors can differ nearly 2× per employee. Regulation and the value of the data being protected are the dominant factors. The multipliers below are applied to a cross-industry midpoint of roughly $2,300/employee.
| Industry | Relative intensity | ~$ / employee (mid-market) |
|---|---|---|
| Financial services | High | $2,800 – $5,000 |
| Technology / SaaS | High | $2,500 – $4,500 |
| Healthcare | Elevated | $2,300 – $4,000 |
| Energy & utilities | Elevated | $2,200 – $3,800 |
| Professional services | Moderate | $1,800 – $3,200 |
| Retail | Lower | $1,200 – $2,500 |
| Manufacturing | Lower | $900 – $2,300 |
The caveats that make this number useful
Per-employee spend is widely quoted and widely misused. Three caveats keep it honest:
- It is an output, not an input. Headcount doesn't drive security cost — endpoints, log volume, cloud workloads, and compliance scope do. A 100-person fintech with 5,000 cloud workloads will dwarf a 100-person agency.
- Scope changes the figure dramatically. Tooling-only numbers exclude the largest line item at scale: people. Always confirm whether salaries and services are in or out before comparing.
- Averages hide bimodality. Many small firms spend near zero on security until a triggering event, then jump to the high end. The "average" sits in a valley few companies actually occupy.
"If you only remember one thing about per-employee benchmarks: use them to ask 'am I in the right neighborhood?' — never to set the budget. The neighborhood is wide, and your address depends on your risk."
— SecurityBudget Research Team
Frequently asked questions
What is the average cybersecurity spend per employee?
Total security spend has a cross-industry median of roughly $2,300 per employee per year, with a broad peer range from about $900 to $5,000. Always confirm that people, services, tooling, and compliance are included before comparing.
Why do small companies spend more per employee on security?
Most security costs are fixed or carry license minimums — a SIEM platform, an MDR contract, a SOC 2 audit, or a baseline of expertise. A 40-person company cannot amortize those across thousands of staff, so per-employee cost rises even though total dollars are small.
Is per-employee spend a good way to budget for security?
It is a useful sanity check, not a budgeting method. Headcount does not drive most security cost — endpoints, log volume, cloud workloads, and compliance scope do. Use per-employee figures to compare against peers, then build the actual budget bottom-up from controls.
How does industry change per-employee security spend?
A lot. Financial services and technology often run 1.5–2× the cross-industry median per employee, while low-regulation sectors like basic manufacturing or retail sit below it. Regulatory burden and the value of the data being protected are the main swing factors.
Does per-employee spend include salaries?
It depends on the benchmark. A fully loaded figure includes security staff salaries, tooling, services (MDR, pentests), and compliance. Tooling-only figures are lower. When comparing numbers, always confirm whether headcount cost is in or out.
References
Go deeper
Budget by company size
See the per-employee figures rolled up into typical annual dollars and % of IT budget across five size bands.
Read the company-size guideGet your per-employee number
Enter your headcount, industry, and footprint to see where you land in the benchmark distribution.
Open the budget calculatorEstimates are based on public pricing, industry benchmarks, and security frameworks. For planning only — not professional, financial, or legal advice.