Security Staffing and Salary Report (2026)

People are almost always the largest line in a security budget, and they are the hardest to estimate because the number lives at the intersection of headcount ratios, loaded salary cost, and the build-vs-buy decision on monitoring. This report uses public wage data from the U.S. Bureau of Labor Statistics (BLS) and budget-benchmark patterns from the IANS / Artico Security Budget Benchmark to put defensible ranges around each of those. The figures are ranges, not promises — your actual cost depends on geography, seniority mix, and how much you outsource.

What a security hire actually costs

BLS reports a median wage of about $124,910 for Information Security Analysts, with a wide spread by experience and market: roughly $69,660 at the 10th percentile and $186,420 at the 90th. That base salary is only part of the story. Once you add benefits, payroll taxes, equipment, software seats, training, and management overhead — commonly modeled at around 30% — the fully loaded cost lands near $162K per FTE.

Wage point (BLS, Information Security Analysts)	Base salary	~Loaded (+30%)
10th percentile	~$69,660	~$90,600
Median	~$124,910	~$162,000
90th percentile	~$186,420	~$242,300

When you build a staffing budget, use the loaded figure. A plan that counts only base salary will understate the true cost of every hire by roughly a third.

How many people do you need?

Headcount ratios are blunt instruments, but they anchor the conversation. A widely used planning heuristic is about one security FTE per 300 employees. That ratio tightens to roughly 1:100 in heavily regulated or mature organizations (finance, healthcare, critical infrastructure) and loosens toward 1:500 in lean or lower-risk shops that lean heavily on automation and managed services. IANS / Artico benchmark data consistently shows staffing as the single largest category of security spend, so small changes in this ratio move the whole budget.

Employees	FTE at 1:300 (typical)	Loaded cost (~$162K/FTE)	Regulated (1:100)	Lean (1:500)
50	~0.2–0.5 (often fractional/outsourced)	~$80K–$160K	~0.5	~0.1
200	~0.7 → round to 1	~$162K	~2	~0.4
800	~2.7 → 3	~$486K	~8	~1.6
2,500	~8.3 → 8–9	~$1.3M–$1.5M	~25	~5
5,000	~16.7 → 16–17	~$2.6M–$2.8M	~50	~10

A few notes on reading the table. Below roughly 200 employees, the security function is often a fraction of one role — a part of an IT generalist’s time plus outsourced services — rather than a dedicated hire. As organizations cross into the thousands, the “typical” column understates need if any 24/7 monitoring is done in-house, because shift coverage does not scale linearly with employee count.

The 24/7 problem: in-house SOC vs. MDR

Round-the-clock monitoring is where staffing math breaks the simple ratios. Covering a security operations center 24 hours a day, 7 days a week — across shifts, weekends, holidays, and vacations — requires roughly 8–12 FTE purely for coverage, regardless of company size. At a loaded cost near $162K each, that is $1.3M–$2M per year in salaries alone, before tooling (SIEM, EDR, threat intel) and before management.

For most mid-market organizations, building a 24/7 in-house SOC is the most expensive way to buy detection. The shift-coverage floor of 8–12 analysts arrives long before the company is large enough to keep them all busy — which is exactly why managed detection and response exists.

This is the core of the build-vs-buy decision. Managed detection and response (MDR) delivers 24/7 monitoring as a service, typically priced per endpoint in the range of ~$3–$45 per endpoint per month depending on coverage depth and vendor. For an 800-person firm with, say, 1,000 endpoints, even the upper end of that range stays well under the $1.3M–$2M salary floor of an in-house SOC — and it removes the recruiting and retention burden of staffing night shifts in a tight labor market.

Approach	Rough annual cost	Notes
In-house 24/7 SOC	$1.3M–$2M (salaries only)	8–12 FTE for shift coverage; tooling extra
MDR service	~$3–$45 / endpoint / month	Scales with endpoints, not shifts

The point is not that MDR is always cheaper or always right — large, mature, highly regulated organizations often run hybrid models with an in-house team plus an MDR partner. But for organizations below a few thousand employees, the shift-coverage math usually favors buying monitoring and reserving in-house FTEs for engineering, governance, and incident leadership.

Building the staffing line

Put the pieces together in this order:

1. Pick a ratio based on your regulatory profile and maturity (1:100, 1:300, or 1:500).
2. Multiply by loaded cost (~$162K/FTE) rather than base salary.
3. Decide on 24/7 coverage — fold in either an 8–12 FTE SOC floor or an MDR line, not both.
4. Add a seniority mix. The BLS percentile spread means a team blending junior analysts (near the 10th percentile) with senior engineers and a leader (toward the 90th) will cost more than a flat median assumption suggests.

How to use this

Use the Cybersecurity Budget Calculator to turn your headcount and risk profile into an estimated staffing line, then layer in the in-house-vs-MDR decision above. Treat the ratios and salary figures as planning ranges to pressure-test against your own market data — not as fixed targets — and refresh them as wage data and your coverage needs evolve.