The benchmarks say ~13% of IT budget. The honest answer is that benchmarks describe your peers’ accounting, not your risk — and the right number is a point on a curve only your own loss data can draw.
Industry benchmarks put cybersecurity at roughly 13% of IT budget and 0.7% of revenue on average, with 8–12% of IT budget typical for most enterprises and 10–15% for regulated or high-threat industries. But benchmarks answer "what do others spend," not "what should we spend." The right number for your organization is the point where an additional dollar of security spend stops reducing your modeled annual loss by more than a dollar — and finding that point requires quantifying your risk in dollars first. Method below.
Every CISO eventually faces some version of this question from a CFO or board, and the standard answer — a peer benchmark — survives because it's defensible, not because it's right. This guide gives you the benchmarks, because they're useful context and you came for them. Then it shows why they can't actually answer the question, and what does.
| Benchmark | Typical figure (2026) | Notes |
|---|---|---|
| % of IT budget | ~13% average; 8–12% typical | The most-cited yardstick (IANS puts the average at 13.2%). Sensitive to how "IT budget" is defined — cloud, OT, and shadow IT often sit outside it. |
| % of IT budget, regulated/high-threat | 10–15%+ | Financial services, healthcare, defense. Regulatory floors push the range up. |
| % of revenue | ~0.7% average | Useful for board context because the denominator is harder to game. |
| Per employee | ~$1,200–$2,700/yr | Wide range across surveys; scales poorly between a software firm and a manufacturer with the same headcount. |
| Global market context | ~$240B in 2026, +12.5% YoY | Spending is growing faster than IT budgets overall — the average is a moving target. |
Four structural problems make peer spending a weak guide to your own:
None of this makes benchmarks useless — they're a sanity check and a board-communication device, and we'll come back to that. It makes them an answer to a different question.
"How much should we spend on cybersecurity?" is rarely a budgeting question. Unpacked, it's: "Are we spending the right amount — too little and exposed, or too much and wasteful?" That's a risk question, and it has a structure benchmarks can't see: it's asking where your organization sits on a curve.
Security investment has steeply diminishing returns, and that shape creates three distinct regions:
The optimal point isn't where risk reaches zero — it never does. It's where the marginal dollar of spend stops returning more than a dollar of reduced expected loss. Spend left of it and you're carrying risk that's cheaper to eliminate than to hold; spend right of it and you're buying comfort, not protection.
Here's the limit of the curve — and of every benchmark conversation: it treats security spend as one number. In practice, two organizations at an identical 13% of IT budget can carry completely different risk, because the money lands differently. One has five vendors stacked on identity while detection starves. The other is mirror-imaged. Same percentage, same "benchmark-aligned" posture, different exposures entirely.
When you quantify at the portfolio level — mapping every dollar of spend to the controls it funds, and every control to the loss scenarios it mitigates — three patterns surface that aggregate numbers structurally cannot show:
This is where benchmarks and CRQ platforms both stop. Benchmarks compare your total to a peer average. CRQ platforms — the good ones — quantify your exposure and stop there. Mapping your actual spend against that exposure, vendor by vendor and domain by domain, with reclaim dollars attached to each verdict: that analysis doesn’t come out of a benchmark report or a risk score. It’s what Foundations was built to produce. Here’s what it looks like when it lands — illustrative findings, in the form the platform delivers them:
5 overlapping vendors (~$2.65M) providing what 3-vendor coverage delivers. Consolidate; reclaim $1.1–1.4M without measurable change in modeled loss.
98% mitigated in a domain where adversaries aren't pushing. Rebalance toward detection, where threat pressure is concentrated and coverage is thin.
Highest modeled threat pressure, lowest funded coverage — the gap no benchmark percentage will ever surface. Redirect reclaimed identity spend here: risk reduction without a budget increase.
Notice what happened across those three findings: the organization's total didn't change. The over-armored domain funded the blind spot. That's the answer benchmark logic can never produce — "you're spending roughly the right amount, in measurably wrong places" — and it's frequently worth more than the how-much answer, because reallocation doesn't require new budget approval.
| The question | Benchmarks | Typical CRQ tools | Foundations |
|---|---|---|---|
| What do peers spend? | Yes | Sometimes | Yes, as context |
| What's our exposure in dollars? | No | Yes | Yes — ALE and Revenue at Risk |
| How much should we spend? | No — only what others do | Implied, rarely derived | Yes — the optimal investment point |
| Where does our spend overlap? | No | No | Yes — vendor-level, dollars attached |
| Where are we armored against attacks that aren't coming? | No | No | Yes — mitigation vs. threat pressure, by domain |
| Which dollars do we reclaim, and where do they go? | No | No | Yes — the reallocation plan itself |
The first three rows are increasingly table stakes — exposure quantification is what the CRQ category sells. The last three are the rows that change budget meetings, and they require something the category doesn't build: a live map from every spend line to every control to every loss scenario, so that overlap, misalignment, and blind spots fall out as findings instead of hunches. That map is the platform.
Locating your position on the curve takes four steps. They're work, but they're tractable work — and far more tractable with modern tooling than the spreadsheet-and-workshop era that gave quantification its reputation for difficulty.
A $50M services firm models its annual loss expectancy at $2.1M across its top scenarios. A proposed control portfolio costing $400K/year reduces modeled ALE to $900K — $1.2M of risk reduction for $400K, comfortably worth funding. The next $300K of candidate spend models out at only $80K of additional reduction: past the optimal point. The firm's defensible answer to "how much should we spend?" is ~$400K — which happens to be 0.8% of revenue, near the benchmark. The difference is that now they know why, and they know what the next dollar buys.
Used correctly, benchmarks are a calibration device, not an answer. If your quantified optimal lands at triple the peer percentage, interrogate the model — your loss estimates may be inflated, or your industry may genuinely under-spend (it happens; ask anyone who watched ransomware reprice manufacturing risk). If it lands far below, check what scenarios you've omitted. And in board materials, presenting your derived number alongside the peer range answers the inevitable "how do we compare?" without letting the comparison drive the decision.
That's the inversion that matters: benchmarks as a check on your number, not a substitute for having one.
Foundations quantifies your risk in dollars, locates your Goldilocks Zone, and shows where your spend overlaps, where it’s misaligned, and where your blind spots are—board-ready in a week.