Security Budget Calculator

Benchmark security spend against IT budget and revenue, then split it across people, tooling, services and improvement work.

About Security Budget Calculator

Security spend is benchmarked against IT budget rather than revenue because it scales with the size of the estate being defended, and published ranges run from roughly 6% in low-regulation sectors to 14% in critical infrastructure. The revenue percentage is a useful cross-check, since IT budget definitions vary wildly between organisations. The people share is the most diagnostic single number: budgets skewed hard either way underperform. Benchmarks do not tell you the right number, but they tell you when you are an outlier — and an outlier is the position you have to be able to defend.

Formulas

Security Budget

benchmarkBudget = ITBudget × sectorPercentage × maturityMultiplier, with sector percentages spanning 6% for manufacturing and retail to 14% for critical infrastructure.

sectorPercentage: Security spend as a share of IT budget for the sector
maturityMultiplier: 0.85 catching up, 1.0 at benchmark, 1.25 leading
peopleShare: Fully loaded staff cost as a share of total security spend

Sanity checks

Sanity checks: security spend usually lands between 0.3% and 1.5% of revenue, and a healthy split keeps people at 40–60% of the security budget.

% of revenue: Cross-check independent of IT budget accounting
peopleShare: Balance between staff and everything else

Worked example

With the default values below, Security Budget Calculator returns Benchmark-Aligned Budget of $2,400,000. Change any input above and every figure here is recalculated in your browser.

Inputs used

Annual revenueaccepts 0–1,000,000,000,000 currency: 400,000,000 currency
Annual IT budgetaccepts 0–100,000,000,000 currency: 24,000,000 currency
Current security spendaccepts 0–100,000,000,000 currency: 1,900,000 currency
Sector benchmarkone of Manufacturing and retail — 6% of IT, Technology and professional services — 9% of IT, Healthcare and utilities — 10% of IT, Financial services — 12% of IT, Critical national infrastructure — 14% of IT: Healthcare and utilities — 10% of IT
Maturity ambitionone of Catch up to baseline — 0.85×, Match the sector benchmark — 1.0×, Lead the sector — 1.25×: Match the sector benchmark — 1.0×
Security headcountaccepts 0–10,000 people: 9 people
Fully loaded cost per security employeeaccepts 0–2,000,000 currency: 115,000 currency
Total employeesaccepts 1–5,000,000 people: 2,500 people

Results

Benchmark-Aligned Budget: $2,400,000
Current Spend as Share of IT: 7.92%
Current Spend as Share of Revenue: 0.48%
Budget Gap: $500,000
Spend Committed to People: 54.5%
Spend per Employee: $760
Allocation Advice: Below benchmark — target the gap at the weakest capability rather than spreading it evenly

Step by step

1Values used
2Security Budget
3Sanity checks
4Benchmark-Aligned Budget= 2,400,000
5Current Spend as Share of IT= 7.92
6Current Spend as Share of Revenue= 0.48
7Budget Gap= 500,000
8Spend Committed to People= 54.5
9Spend per Employee= 760

Assumptions and limits

The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation or tax into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Security Budget calculated?

benchmarkBudget = ITBudget × sectorPercentage × maturityMultiplier, with sector percentages spanning 6% for manufacturing and retail to 14% for critical infrastructure. Security spend is benchmarked against IT budget rather than revenue because it scales with the size of the estate being defended, and published ranges run from roughly 6% in low-regulation sectors to 14% in critical infrastructure. The revenue percentage is a useful cross-check, since IT budget definitions vary wildly between organisations. The people share is the most diagnostic single number: budgets skewed hard either way underperform.

Why does Security Budget matter?

Benchmarks do not tell you the right number, but they tell you when you are an outlier — and an outlier is the position you have to be able to defend.

What values do I need to enter?

This calculator takes 8 inputs: Annual revenue, Annual IT budget, Current security spend, Sector benchmark, Maturity ambition, Security headcount, Fully loaded cost per security employee, Total employees. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is a bigger security budget better?

Only to a point, and allocation matters more than total. Organisations at benchmark with poor allocation — heavy licence spend, no operators, no improvement capacity — routinely underperform ones below benchmark with focused investment.

Where does managed service spend sit?

Treat it as capability, not people, unless you are comparing staffing ratios. If a provider runs the out-of-hours SOC, count it as service spend and note the coverage it buys, otherwise the people share reads misleadingly low.