Benchmark security spend against IT budget and revenue, then split it across people, tooling, services and improvement work.
Security spend is benchmarked against IT budget rather than revenue because it scales with the size of the estate being defended, and published ranges run from roughly 6% in low-regulation sectors to 14% in critical infrastructure. The revenue percentage is a useful cross-check, since IT budget definitions vary wildly between organisations. The people share is the most diagnostic single number: budgets skewed hard either way underperform. Benchmarks do not tell you the right number, but they tell you when you are an outlier — and an outlier is the position you have to be able to defend.
Security Budget
benchmarkBudget = ITBudget × sectorPercentage × maturityMultiplier, with sector percentages spanning 6% for manufacturing and retail to 14% for critical infrastructure.
Sanity checks
Sanity checks: security spend usually lands between 0.3% and 1.5% of revenue, and a healthy split keeps people at 40–60% of the security budget.
benchmarkBudget = ITBudget × sectorPercentage × maturityMultiplier, with sector percentages spanning 6% for manufacturing and retail to 14% for critical infrastructure. Security spend is benchmarked against IT budget rather than revenue because it scales with the size of the estate being defended, and published ranges run from roughly 6% in low-regulation sectors to 14% in critical infrastructure. The revenue percentage is a useful cross-check, since IT budget definitions vary wildly between organisations. The people share is the most diagnostic single number: budgets skewed hard either way underperform.
Benchmarks do not tell you the right number, but they tell you when you are an outlier — and an outlier is the position you have to be able to defend.
This calculator takes 8 inputs: Annual revenue, Annual IT budget, Current security spend, Sector benchmark, Maturity ambition, Security headcount, Fully loaded cost per security employee, Total employees. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Only to a point, and allocation matters more than total. Organisations at benchmark with poor allocation — heavy licence spend, no operators, no improvement capacity — routinely underperform ones below benchmark with focused investment.
Treat it as capability, not people, unless you are comparing staffing ratios. If a provider runs the out-of-hours SOC, count it as service spend and note the coverage it buys, otherwise the people share reads misleadingly low.