Boards approve cyber security budgets every year, yet few can say whether the money is buying down the risks that matter most or simply funding more tools. Benchmarks are quoted without context, business cases rest on fear rather than evidence, and the link between spend and reduced loss is rarely shown. This briefing gives directors and senior executives what they need to oversee cyber security investment: what the benchmarks really say, how to prioritise, how to judge return, the questions to ask and the warning signs in management answers. It is written for boards, audit and risk committees, CEOs and CFOs. The practitioner detail of building a budget is in the Security Budget Template and Cost Model and the Security Budget and Investment Planning Guide.
The risk in one paragraph
Cyber security spending can fail in two directions. Too little, or the right amount spent in the wrong places, leaves basic controls missing on the systems that keep the business running, and a single gap can cost far more than years of budget: the Change Healthcare breach began with a remote access portal that lacked multi-factor authentication. Too much, spent without a link to risk, buys overlapping tools, unused licences and a false sense of safety. The board's job is not to set the number but to confirm that resources match the agreed risk appetite, that priorities follow the most critical services and threats, and that management can show what each major investment changed.
Why this is a board-level issue now
- Explicit governance expectations: the UK Cyber Governance Code of Practice, published on 8 April 2025, asks boards to confirm that resources are allocated effectively to manage the agreed cyber risks (action B3) and to require formal reporting at least quarterly with metrics and agreed tolerances (action E2).
- Disclosure and liability: US listed companies must describe board oversight of cybersecurity risk and management's role and expertise in their annual report under Regulation S-K Item 106, and disclose material incidents on Form 8-K Item 1.05, generally within four business days of determining materiality. In the EU, NIS2 (Directive (EU) 2022/2555, recital 137) expects the management bodies of essential and important entities to approve cybersecurity risk-management measures and oversee their implementation; see the NIS2 Management Liability Executive Briefing.
- Tighter budgets: the IANS Research and Artico Search 2025 Security Budget Benchmark Report found average security budget growth slowed to 4% in 2025, from 8% in 2024, with 47% of CISOs receiving an increase, down from 62%. Prioritisation now matters more than growth.
- Losses that reach the income statement: Marks and Spencer estimated a reduction of about £300 million in profit before recoveries after its 2025 attack, which began with the impersonation of a third-party user. See the Marks and Spencer cyberattack.
Budget benchmarks: what the numbers say and do not say
Benchmarks are useful as a sense check, not a target. The most quoted figures come from different populations and measure different things:
| Benchmark | Figure | Source and year | How to read it |
|---|---|---|---|
| Security as a share of IT budget | 10.9% (11.9% in 2024) | IANS Research and Artico Search, 2025 Security Budget Benchmark Report (587 CISOs, April to August 2025) | A mean reported by CISOs, many at large companies |
| Security as a share of revenue | 0.69%, flat | IANS Research and Artico Search, 2025 | Varies widely by sector and digital intensity |
| Largest budget line | Staff and compensation 39%, software 29%, outsourcing 12% | IANS Research and Artico Search, 2025 | People, not tools, are the main cost |
| Security share of IT spending, EU median | 9.0% (2023 data) | ENISA, NIS Investments 2024 (1,350 organisations in all 27 Member States) | A median across NIS2 sectors, including mid-sized operators |
| Worldwide security spending | About $213 billion in 2025, about $240 billion forecast for 2026 (12.5% rise) | Gartner forecast, July 2025 | Market size, not a guide to any one organisation |
For more figures and their limits, see Cybersecurity Budget Statistics. Three cautions for directors:
- Percentage of IT is a weak anchor: an organisation that moves to cloud and SaaS may cut IT spend while its security needs rise, which pushes the ratio up without any change in risk.
- Sector and size matter more than averages: a regulated bank, a hospital and a small professional firm face different threats and duties. Ask for a peer set that looks like you.
- Spend is an input, not an outcome: being at the benchmark says nothing about whether the critical services are protected. The board should ask what the money achieved.
Prioritising: where the money should go
Good prioritisation starts from the business, not the technology. The Cyber Governance Code asks boards to confirm that the critical technology, information and services are identified and agreed (A1) and that a cyber risk appetite is set (A3). Investment should then flow in a clear order:
- Protect the crown jewels: the systems whose loss would stop revenue, harm customers or breach regulation.
- Fix the basics that attackers use most: strong authentication on remote access and privileged accounts, patching of internet-facing systems, secure configuration, tested backups and control of third-party access. In our analysis of published breaches, missing basics like these recur far more often than advanced techniques.
- Be able to detect and recover: monitoring that covers the critical services, a rehearsed incident plan and recovery that has been tested end to end.
- Then optimise: automation, consolidation and advanced capabilities, once the basics are measurably in place.
Each proposal should state the risk it reduces, the service it protects, the cost over its full life (including people and running costs) and how success will be measured. Proposals that cannot do this should wait.
What changes with size
Board engagement varies sharply with size. The UK Cyber Security Breaches Survey 2025 (DSIT, fieldwork August to December 2024) found 27% of businesses had a board member or trustee with cyber security responsibility, rising from 24% of micro businesses to 66% of large ones. Smaller organisations get the best return from managed services, built-in platform security and a short list of basics done well, and should name one director as owner. Larger organisations need a formal multi-year plan, independent assurance and a committee, usually audit or risk, that reviews cyber investment in depth each year. Groups with several subsidiaries should check that investment reaches acquired and overseas businesses, which often run on older systems with fewer controls.
Measuring return on security investment
Security rarely produces revenue, so return is shown as reduced risk, avoided loss or lower cost of operation. Directors should expect a mix of the approaches below rather than a single return-on-investment figure:
| Approach | What it shows | Strength | Limit |
|---|---|---|---|
| Cyber risk quantification | Expected annual loss before and after an investment, in money | Speaks the board's language and allows comparison with other risks | Depends on assumptions; ranges, not precise figures |
| Control coverage | Share of critical systems with a control in place (for example MFA, backup, monitoring) | Objective and easy to audit | Coverage is not the same as effectiveness |
| Outcome metrics | Time to detect and contain, patch speed, recovery time in tests | Shows the programme working in practice | Needs trend data over several quarters |
| Cost efficiency | Licences retired, tools consolidated, insurance terms | Concrete savings | Can reward cutting rather than protecting |
| Maturity assessment | Position against a framework such as NIST CSF 2.0 | Structured, repeatable view of progress | Can become box-ticking without outcome evidence |
See the Cyber Risk Quantification Executive Briefing for how to read quantified risk figures.
Where identity fits
Identity is one of the highest-return areas of security investment because so many incidents start with a stolen or misused credential. Both incidents cited above involved account access: a login without MFA and an impersonated third-party user. Directors should also ask about non-human identities, the service accounts, API keys and tokens that connect systems and now outnumber people in most estates. They are often unowned and long-lived, and they are rarely visible in budget lines. See the Board Briefing: NHI Risk.
Where it sits in the frameworks
| Board concern | UK Cyber Governance Code | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|---|
| Resources match risk | B3 | GV.RR-03 | PM-3 |
| Risk appetite and objectives | A3 | GV.RM-01 | PM-9 |
| Cyber in enterprise risk management | A2 | GV.RM-03 | RA-3 |
| Strategy outcomes reviewed | B4, E2 | GV.OV-01 | PM-6 |
| Prioritised by threat and impact | A5 | ID.RA-05 | RA-3 |
Five questions for the board to ask
- What are our most critical services, and how does this budget protect them? Expect a short list agreed with the business and a clear line from each major spend to one of them.
- Which risks are outside our appetite today, and what will this investment change? Expect named risks, a current and target position, and a date.
- Are the basics in place everywhere that matters? Expect coverage figures for MFA on remote and privileged access, patching of internet-facing systems, tested backups and third-party access control, with gaps owned and dated.
- What did last year's investment achieve? Expect outcome evidence: improved detection or recovery times, risks closed, tools retired, not just projects completed.
- What are we choosing not to fund, and who has accepted that risk? Expect an explicit list of deferred items with a named risk owner at the right level.
Red flags in management answers
- "We spend the industry average": a benchmark offered as the justification, with no link to the organisation's own risks.
- Tool lists instead of outcomes: progress described as products bought rather than risks reduced.
- No retirement plan: every year adds tools and none are removed, so running costs grow quietly.
- People costs left out: new platforms approved without the staff or services to run them, when staff is the largest budget line in the IANS data.
- Metrics that are always green: reports that never show a breached tolerance, which usually means the tolerances or the metrics are wrong.
- Basics described as "in progress" for years: MFA, patching or backup projects that keep slipping while new initiatives are funded.
What good looks like
- A cyber strategy aligned with business strategy, with an agreed risk appetite and a list of critical services.
- A multi-year investment plan that ties each major item to a risk and a measurable outcome, including full running costs.
- Quarterly reporting to the board with a small set of metrics, agreed tolerances and honest exceptions.
- Independent assurance of key controls, through internal audit or an external review, at least every year or two.
- An annual review of what was achieved, what was retired and what was deferred, with the deferred risks formally accepted.
Where to invest first
- Identity and access: phishing-resistant MFA for remote, privileged and third-party access, and ownership of service accounts and API keys.
- Exposure reduction: patching and secure configuration of internet-facing systems, driven by an accurate asset inventory.
- Recovery: isolated, tested backups and a rehearsed recovery plan for the critical services.
- Detection: monitoring that covers the critical services and identity systems, with clear response ownership.
- People: enough skilled staff or managed services to run what has been bought.
Metrics to track
| Metric | Why the board should care |
|---|---|
| Share of critical services meeting the security baseline | Shows whether spend reaches what matters |
| MFA coverage on remote, privileged and third-party access | Measures the most common entry route |
| Time to patch critical internet-facing vulnerabilities | Tracks exposure to fast-moving threats |
| Recovery time achieved in the last test against target | Shows whether the business can survive an attack |
| Risks outside appetite, and trend | Shows whether investment is changing the risk position |
| Security spend per critical service and tools retired | Shows efficiency and discipline |
A 90-day plan
- Days 1 to 30: confirm the list of critical services and the cyber risk appetite; ask management for the current budget mapped to those services and to the top risks.
- Days 31 to 60: receive coverage figures for the basics, a list of tools with cost and usage, and the risks currently outside appetite; commission an independent check of the most important figures.
- Days 61 to 90: agree a prioritised multi-year plan, a set of five to eight board metrics with tolerances, and a list of deferred items with named risk owners; set the quarterly reporting rhythm.
Common failure patterns
- Budget set by last year plus inflation: no link to how the threat, the business or the risk appetite has changed.
- Capital without operating cost: platforms funded but not the people or services needed to run them, so they stay half deployed.
- Compliance-led spend: money flows to whatever the next audit checks, while critical services outside its scope stay weak.
- Single-number return claims: precise return-on-investment figures accepted without asking for the assumptions behind them.
- Third parties left out: supplier and contractor access treated as someone else's budget, even though attacks often arrive that way.
Lessons from incidents
- Basics before advanced capability: the Change Healthcare breach started with a stolen credential on a portal without MFA. UnitedHealth projected 2024 cyberattack costs of $2.87 billion, far beyond what MFA on every remote access route would have cost.
- Third-party access is part of your budget: the Marks and Spencer cyberattack began with the impersonation of a third-party user. Help desk verification and supplier access controls deserve funding alongside internal controls. See the Third-Party and Supply Chain Risk Executive Briefing.
Practitioner checklist
- Map the security budget to critical services and to the top risks before it reaches the board.
- Present benchmarks with their source, sample and year, and with a peer set that fits the organisation.
- Show full life cost, including people and running costs, for every major proposal.
- Pair every investment with a measurable outcome and report it the following year.
- Report coverage of the basics on critical services every quarter.
- Keep a register of deferred items with named risk owners.
- Retire overlapping tools and report the savings.
- Include non-human identities and third-party access in the investment plan.
Standards and references
- UK Government: Cyber Governance Code of Practice
- NCSC: Cyber Security Toolkit for Boards
- NIST: Cybersecurity Framework 2.0
- EUR-Lex: Directive (EU) 2022/2555 (NIS2)
- US SEC: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure Rules
- IANS Research: 2025 Security Budget Benchmark Report
- ENISA: NIS Investments 2024
- Gartner: Worldwide Information Security Spending Forecast, July 2025
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
How NHI Mgmt Group can help
We provide independent identity and non-human identity assessments and board briefings, helping boards see whether investment reaches the service accounts, API keys and third-party access that attackers target. Our NHI Foundation Level Training Course builds the skills to govern machine identities. Contact us to arrange a briefing.
Related NHI Mgmt Group resources: Security Budget Template and Cost Model · Security Budget and Investment Planning Guide · Cybersecurity Budget Statistics · Board Cyber Risk Reporting Guide · Cyber Risk Quantification Executive Briefing