Cybersecurity Budget Benchmark 2026: What Organizations Actually Spend

Almost every security budget conversation eventually runs aground on the same question: compared to what? A number that looks generous against one yardstick can look thin against another, and the answer often hinges on which industry you sit in rather than on how mature your program is. This benchmark pulls together the three framings practitioners actually use — security as a share of IT, as a share of revenue, and per employee — using the IANS/Artico 2025 dataset of roughly 587 CISOs alongside Deloitte, Kaspersky, and Avasant industry context.

The three framings, and why they disagree

There is no single “right” denominator for a security budget. Each of the three common framings answers a slightly different question, and each carries a blind spot. Share of IT tells you how security is prioritized inside the technology organization, but it moves whenever total IT spend moves. Share of revenue normalizes against the size of the business, but it ignores how technology-intensive that business is. Per-employee spend is intuitive and easy to compare across peers, but it flattens differences in data sensitivity and regulatory load.

The practical takeaway is to triangulate. A budget that looks reasonable on all three framings is defensible; one that only looks reasonable on the framing you happened to pick deserves a second look.

A high security-as-percent-of-IT ratio is not automatically a sign of strong investment. In lean-IT industries it can simply mean the IT denominator is small.

Security as a share of IT budget

This is the most widely quoted framing, and the IANS/Artico 2025 data shows a clear central tendency with meaningful spread at the tails. Reading the percentiles matters: the median is the typical organization, while the p10 and p90 mark the lean and heavily-invested ends of the distribution rather than targets to chase.

Percentile	Security as % of IT budget
p10	7%
p25	9%
Median (p50)	11%
p75	14%
p90	20%

If your number lands between roughly 9% and 14%, you are in the broad middle alongside most peers. Sitting near p90 (20%) is not inherently better — it often reflects a recent breach, a regulated industry, or, as discussed below, an unusually small IT budget inflating the ratio.

Security as a share of revenue

Normalizing against revenue removes the IT-denominator distortion but introduces its own. A capital-intensive manufacturer and a software company can have similar revenue and wildly different appropriate spend. Across the IANS/Artico and Deloitte data, the median lands near 0.69% of revenue, with a wide band from about 0.3% at p10 to 2.0% at p90. Financial-services firms, which Deloitte tracks closely, sit toward the upper half of that band.

Use this framing as a sanity check rather than a primary target. If your security spend is a vanishingly small fraction of revenue while your IT spend ratio looks healthy, it usually means your business simply runs lean on technology overall.

Per-employee spend

Per-employee spend is the framing executives grasp fastest. The cross-industry median sits around $2,300 per employee per year, within a typical range of roughly $900 to $5,000. Financial services skews toward the high end of that range, reflecting both regulatory expectations and the value of the data at stake.

Framing	Typical center	Common range
% of IT budget	11%	9%–14%
% of revenue	0.69%	0.3%–2.0%
Per employee / year	~$2,300	~$900–$5,000

Per-employee figures are most useful for peer comparison within an industry. Comparing a 5,000-person bank to a 200-person logistics firm on this metric alone will mislead; comparing two mid-market healthcare providers is far more instructive.

Industry context: the IT-spend denominator

The single most common mistake in benchmarking is forgetting that the IT budget itself varies enormously by industry. Avasant’s IT-spend-as-a-share-of-revenue data makes the point plainly. When the denominator is small, even a modest security program consumes a large share of IT.

Industry	IT spend as % of revenue
Financial services	7.5%
Technology	7.5%
Professional services	5.5%
Government	5.0%
Healthcare	5.0%
Education	4.5%
Retail	3.5%
Energy / utilities	3.0%
Manufacturing	2.5%

A worked example the calculator uses illustrates the trap. An 800-person, $120M healthcare firm running a roughly $1.2M security program lands near 20.3% of its IT budget — a figure that looks alarmingly high until you notice it is driven by healthcare’s lean IT spend, not by lavish security investment. On a per-employee basis the same program is about $1,520, comfortably mid-range. The high ratio is an artifact of the denominator, not evidence of overspending.

How to read percentiles without overreacting

Percentiles describe where organizations land, not where they should aim. Treat the median as a reference point, the interquartile range (p25–p75) as the “normal” band, and the tails as context for outliers. A program below p25 is worth examining for gaps; one above p75 is worth examining for whether the spend is buying down real risk or simply accumulating tools. Neither position is automatically right or wrong, and no level of spend makes an organization fully secure — the benchmarks measure investment, not outcomes.

How to use this

These figures are inputs, not verdicts. Plug your own headcount, revenue, and IT budget into the calculator to see where you fall across all three framings at once and against your industry’s IT-spend ratio: run the cybersecurity budget calculator. Triangulating across the framings, rather than anchoring on a single number, is the fastest way to a budget you can defend.