Security Staffing and Salary Report (2026)

People are almost always the largest line in a security budget, and they are the hardest to estimate because the number lives at the intersection of headcount ratios, loaded salary cost, and the build-vs-buy decision on monitoring. This report uses public wage data from the U.S. Bureau of Labor Statistics (BLS) and budget-benchmark patterns from the IANS / Artico Security Budget Benchmark to put defensible ranges around each of those. The figures are ranges, not promises — your actual cost depends on geography, seniority mix, and how much you outsource.

What a security hire actually costs

BLS reports a median wage of $129,180 for Information Security Analysts in May 2025, with a wide spread by experience and market: $75,090 at the 10th percentile and $199,850 at the 90th. Once benefits, payroll taxes, equipment, software seats, training, and management overhead are added at a planning assumption of 30%, the fully loaded median lands near $168K per FTE.

Wage point (BLS, Information Security Analysts)	Base salary	~Loaded (+30%)
10th percentile	$75,090	~$97,600
Median	$129,180	~$168,000
90th percentile	$199,850	~$259,800

When you build a staffing budget, use the loaded figure. A plan that counts only base salary will understate the true cost of every hire by roughly a third.

How many people do you need?

Headcount ratios are blunt instruments, but they anchor the conversation. A widely used planning heuristic is about one security FTE per 300 employees. That ratio tightens to roughly 1:100 in heavily regulated or mature organizations (finance, healthcare, critical infrastructure) and loosens toward 1:500 in lean or lower-risk shops that lean heavily on automation and managed services. IANS / Artico benchmark data consistently shows staffing as the single largest category of security spend, so small changes in this ratio move the whole budget.

Employees	FTE at 1:300 (typical)	Loaded cost (~$168K/FTE)	Regulated (1:100)	Lean (1:500)
50	~0.2–0.5 (often fractional/outsourced)	~$80K–$160K	~0.5	~0.1
200	~0.7 → round to 1	~$168K	~2	~0.4
800	~2.7 → 3	~$504K	~8	~1.6
2,500	~8.3 → 8–9	~$1.34M–$1.51M	~25	~5
5,000	~16.7 → 16–17	~$2.69M–$2.86M	~50	~10

A few notes on reading the table. Below roughly 200 employees, the security function is often a fraction of one role — a part of an IT generalist’s time plus outsourced services — rather than a dedicated hire. As organizations cross into the thousands, the “typical” column understates need if any 24/7 monitoring is done in-house, because shift coverage does not scale linearly with employee count.

The 24/7 problem: in-house SOC vs. MDR

Round-the-clock monitoring is where staffing math breaks the simple ratios. Covering a security operations center 24 hours a day, 7 days a week — across shifts, weekends, holidays, and vacations — requires roughly 8–12 FTE purely for coverage, regardless of company size. At a loaded cost near $168K each, that is $1.34M–$2.02M per year in salaries alone, before tooling and management.

For most mid-market organizations, building a 24/7 in-house SOC is the most expensive way to buy detection. The shift-coverage floor of 8–12 analysts arrives long before the company is large enough to keep them all busy — which is exactly why managed detection and response exists.

This is the core of the build-vs-buy decision. Managed detection and response (MDR) delivers 24/7 monitoring as a service, typically priced per endpoint in the range of ~$3–$45 per endpoint per month depending on coverage depth and vendor. For an 800-person firm with, say, 1,000 endpoints, even the upper end of that range stays well under the $1.3M–$2M salary floor of an in-house SOC — and it removes the recruiting and retention burden of staffing night shifts in a tight labor market.

Approach	Rough annual cost	Notes
In-house 24/7 SOC	$1.3M–$2M (salaries only)	8–12 FTE for shift coverage; tooling extra
MDR service	~$3–$45 / endpoint / month	Scales with endpoints, not shifts

The point is not that MDR is always cheaper or always right — large, mature, highly regulated organizations often run hybrid models with an in-house team plus an MDR partner. But for organizations below a few thousand employees, the shift-coverage math usually favors buying monitoring and reserving in-house FTEs for engineering, governance, and incident leadership.

Building the staffing line

Put the pieces together in this order:

1. Pick a ratio based on your regulatory profile and maturity (1:100, 1:300, or 1:500).
2. Multiply by loaded cost (~$168K/FTE) rather than base salary.
3. Decide on 24/7 coverage — fold in either an 8–12 FTE SOC floor or an MDR line, not both.
4. Add a seniority mix. The BLS percentile spread means a team blending junior analysts (near the 10th percentile) with senior engineers and a leader (toward the 90th) will cost more than a flat median assumption suggests.

Staffing scenarios by operating model

Operating model	Internal roles	External coverage	Planning implication
Lean SMB	IT owner or fractional security lead	MDR, vCISO, annual testing	Avoids a premature full-time SOC hire but requires clear vendor accountability.
Mid-market hybrid	Security lead, engineer, GRC, incident owner	MDR for nights and queue coverage	Internal staff focus on architecture, remediation, and business risk.
Regulated enterprise	Dedicated engineering, GRC, threat, and response teams	Specialist retainers and surge support	Higher ratio and seniority mix; validate role overlap before adding tools.

These models are not maturity rankings. An outsourced monitoring service can be the more resilient design if it provides coverage that an undersized internal team cannot sustain.

Methodology and limitations

Base wages use the BLS May 2025 Information Security Analyst distribution. The 30% loading factor is a planning assumption for benefits and overhead, not a BLS statistic. The 1:300 headcount ratio is a budgeting heuristic rather than an occupational standard; regulation, product-security scope, geography, and outsourcing can produce substantially different staffing levels. Contractor and managed-service costs belong in the same operating-model comparison so the analysis does not make internal labor look artificially expensive or cheap.

How to use this

Use the Cybersecurity Budget Calculator to turn your headcount and risk profile into an estimated staffing line, then layer in the in-house-vs-MDR decision above. Treat the ratios and salary figures as planning ranges to pressure-test against your own market data — not as fixed targets — and refresh them as wage data and your coverage needs evolve.