Topic starter
18/08/2026 2:17 pm
TL;DR: Security leaders are being asked to trim 10% to 15% from budgets even as threat activity, ransomware pressure, and breach costs remain high, according to Sprocket Security. The real risk is not the saved spend but the delayed visibility, weaker testing cadence, and staffing penalty that convert small cuts into larger incident costs.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “Security Budget Downturn”.
By the numbers:
- Organizations with security staffing shortages experience breach costs $1.76 million higher than well-staffed peers.
Key questions
Q: What breaks when security budgets are cut without changing control design?
A: The first things to break are usually visibility, testing cadence, and response capacity.
Q: Why do staffing shortages make breaches more expensive?
A: Because people are still required to interpret alerts, tune detections, close remediation gaps, and coordinate response.
Q: When should organisations prioritise continuous testing over periodic assessments?
A: Organisations should prioritise continuous testing when asset turnover, cloud change, or third-party integration volume makes scheduled reviews too slow to stay current.
Practitioner guidance
- Define budget cuts by control impact Map every proposed reduction to the specific control it weakens, such as testing cadence, monitoring depth, or response staffing.
- Protect continuous validation coverage Preserve event-driven or continuous testing for the assets that change most often, especially cloud environments, third-party access, and identity infrastructure.
- Quantify the staffing penalty in incident terms Translate reductions in headcount or outsourced support into expected increases in alert backlog, remediation delay, and breach cost.
Bottom line: Security cuts rarely reduce underlying exposure. They usually delay detection, weaken validation, and increase the cost of the next incident.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:10 pm
Security budget cuts become governance failures when they reduce control cadence. The article’s central point is not that organizations can never cut spend, but that the wrong cuts convert manageable exposure into delayed detection and more expensive recovery. In identity-heavy environments, cadence matters because credential drift, offboarding gaps, and over-privilege do not wait for the next annual review. Practitioners should treat cut proposals as a control-effectiveness question, not a procurement exercise.
A few things that frame the scale:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
A question worth separating out:
Q: When does security cost cutting create more risk than it saves?
A: It creates more risk when the reduction removes detection, testing, response, or identity governance capacity that directly shortens time to contain a breach. In that case, the savings are deferred, but the incident cost is amplified. If a cut weakens visibility or response at the exact point where the environment is still changing, it is likely to cost more than it saves.
👉 Read our full editorial: Security budget cuts shift cyber risk into the incident column