Security Budget Calculator

How the calculation works

• Security spend = in-house security staff + the annual cost of each control + other security spend.
• Share of IT budget = security spend ÷ IT budget × 100.
• Per employee = security spend ÷ employees, a year and a month.
• Share of revenue = security spend ÷ revenue × 100, when you enter revenue.
• Your target = IT budget × target %, and the gap between that and your spend.

Published ratios, as dollars at your budget:

• IANS Research and Artico Search, 2025: an average security budget of 10.9% of the IT budget and 0.69% of revenue, from 587 security leaders, 88% of them in the US. It is an average (mean), and it includes security staff.
• Avasant, 2025: the IT security tower is 6.3% to 7.1% of IT operating spend across company sizes. It includes internal and external security staff, hardware, software, services and depreciation of past security purchases, but not this year’s security capital spend.

Avasant’s executive summary also gives security as 5.4% of the IT budget (the figure in the IT budget benchmark tool): that is its security spending line, which leaves security staff out, so the calculator uses the tower figures, which include them. The two sources answer different questions, and neither is a recommendation: they show where surveyed companies are, not where you should be. Both are dated below, with links.

The controls are the ones cyber insurance applications commonly ask about, condensed from the cyber insurance readiness assessment into one cost line per product. A control left blank is listed as “no cost entered”: it may be covered by another product or license, or it may be a gap.

Worked example

A company with 150 employees, $60 million in revenue and a $2.4 million IT budget enters these annual costs: MFA $9,000, EDR $27,000, separated backups $18,000, email security $7,200, awareness training $4,500, patching and vulnerability management $6,000, an incident response retainer $5,000, and $12,000 of other security spend (a firewall subscription and an annual penetration test). It has set itself a target of 8% of IT.

• Security spend: $9,000 + $27,000 + $18,000 + $7,200 + $4,500 + $6,000 + $5,000 + $12,000 = $88,700 a year.
• Share of IT: $88,700 ÷ $2,400,000 = 3.7%.
• Per employee: $88,700 ÷ 150 = $591.33 a year, $49.28 a month.
• Share of revenue: 0.15%.
• Published ratios at this budget: IANS’s 10.9% would be $261,600 (and 0.69% of revenue $414,000); Avasant’s 6.3% to 7.1% would be $151,200 to $170,400.
• Target: 8% of IT is $192,000, so the plan is $103,300 below it.
• No cost entered: privileged access management, logging and monitoring, and vendor risk management. The next step is to check whether existing tools cover them or price them; together with the staff time the company left out, they explain much of the gap to the published ratios.