Security Budget Calculator

benchmarkBudget = ITBudget × sectorPercentage × maturityMultiplier, with sector percentages spanning 6% for manufacturing and retail to 14% for critical infrastructure. Security spend is benchmarked against IT budget rather than revenue because it scales with the size of the estate being defended, and published ranges run from roughly 6% in low-regulation sectors to 14% in critical infrastructure. The revenue percentage is a useful cross-check, since IT budget definitions vary wildly between organisations. The people share is the most diagnostic single number: budgets skewed hard either way underperform.

Benchmarks do not tell you the right number, but they tell you when you are an outlier — and an outlier is the position you have to be able to defend.

This calculator takes 8 inputs: Annual revenue, Annual IT budget, Current security spend, Sector benchmark, Maturity ambition, Security headcount, Fully loaded cost per security employee, Total employees. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Only to a point, and allocation matters more than total. Organisations at benchmark with poor allocation — heavy licence spend, no operators, no improvement capacity — routinely underperform ones below benchmark with focused investment.

Treat it as capability, not people, unless you are comparing staffing ratios. If a provider runs the out-of-hours SOC, count it as service spend and note the coverage it buys, otherwise the people share reads misleadingly low.