Cybersecurity Budget Statistics: Spending Benchmarks by Size, Sector and Share of IT

Most security leaders asked "what should we spend?" reach for a single benchmark, usually security as a percentage of the IT budget, without knowing who was surveyed, which year it measures or whether it is a mean or a median. This page gathers the current budget figures from the publishers' own pages: the IANS Research and Artico Search 2025 Security Budget Benchmark Report, the Gartner worldwide and MENA information security spending forecasts, the ENISA NIS Investments reports, the 2025 ISC2 Cybersecurity Workforce Study and the UK Cyber Security Breaches Survey 2025. Each figure carries its source, publisher and year in the same sentence or table row, and the limits of each survey are stated. It is for CISOs, CFOs and boards who need defensible reference points for a budget conversation. How to build the budget itself is covered in the Security Budget and Investment Planning Guide. Last reviewed: November 2026.

Key takeaways

• Around a tenth of IT spend goes to security. The IANS 2025 Security Budget Benchmark Report puts security at 10.9% of the IT budget across 587 mostly large-company CISOs, and ENISA's NIS Investments 2024 report puts the EU median at 9.0% across 1,350 organisations (2023 data).
• Budget growth slowed sharply in 2025. IANS reports average security budget growth of 4% in 2025, down from 8% in 2024 and the lowest in five years, with only 47% of CISOs receiving an increase.
• The market still grows by double digits. Gartner forecast worldwide end-user spending on information security at $213 billion in 2025 and about $240 billion in 2026, a 12.5% rise, with security software the largest segment.
• People are the biggest line item, and the most squeezed. Staff and compensation take 39% of security budgets in the IANS 2025 data, while the 2025 ISC2 Workforce Study finds 36% of respondents faced budget cuts and 33% say their budget cannot adequately staff their teams.
• Size and sector move the ratio more than any trend. ENISA finds SMEs spend a higher share of IT on security than large enterprises, and banking spends the most in absolute terms, with a median of EUR 4.0 million on information security in 2023.

Headline statistics

Security budget as a share of IT and revenue

This is the most searched benchmark and the most misused one. Two independent sources now give broadly consistent answers, measured in different ways.

• IANS 2025 (mean, CISO-reported): security accounts for 10.9% of IT spend in the 2025 IANS and Artico Search report, the first fall in five years after 11.9% in 2024. The ratio has risen from 8.6% in 2020. Security as a share of company revenue held flat at 0.69%. The survey covered 587 CISOs between April and August 2025 and is the sixth edition of the IANS and Artico Search CISO Compensation and Budget Research Study.
• ENISA NIS Investments 2024 (median, EU operators): the fifth edition surveyed 1,350 organisations, 50 in each of the 27 Member States, from sectors in scope of NIS 2. The median organisation spent 9.0% of its IT budget on information security in 2023 (average 9.6%), up 1.9 points from the 2022 median.
• Newest ENISA edition: NIS Investments 2025 was published on 8 December 2025 from 1,080 respondents (83% large enterprises, 17% SMEs). Its share-of-IT results are published as charts rather than text, so this page quotes the 2024 edition's stated figures.

Reading the gap: the IANS ratio is a mean reported by CISOs, many at large North American companies; the ENISA ratio is a median across a stratified EU sample that includes mid-sized operators. A mean is pulled upwards by a few heavy spenders, which is one reason ENISA's own average (9.6%) sits above its median (9.0%). Use the median when you want a "typical organisation" comparison and the mean only when your peer set is similar to the survey sample.

Budget growth and the 2025 slowdown

The two surveys measure different things: IANS asks CISOs about their own budget line, while ISC2 asks 16,029 cybersecurity professionals (July and August 2025) whether their organisation experienced cuts. Both point the same way: budgets still grow on average, but more slowly, and a large minority of teams are flat or cutting. ISC2 found 31% of respondents expect further cutbacks in the next 12 months and 26% expect more layoffs, up from 22% a year earlier.

The UK Cyber Security Breaches Survey 2025 adds qualitative support: its interviewees described cyber security budgets as flat or tightening, particularly in charities. The survey does not publish a budget figure.

Where the money goes: allocation and staffing share

• Allocation inside the security budget: IANS and Artico Search report that staff and compensation take 39% of security budgets in 2025, software 29% and outsourcing 12%. The remainder covers hardware, services and other lines that the summary page does not break out.
• Security staff relative to IT staff: ENISA's 2024 edition puts the EU median at 11.1% of IT full-time equivalents working on information security (average 12.8%), down from 11.9% the previous year, even as the spending ratio rose. Spending growth went to products and services faster than to headcount.
• Staffing adequacy: in the 2025 ISC2 study, 33% say their budget cannot adequately staff their teams and 29% cannot afford staff with the skills they need. 34% report the right level of staffing, up from 30% in 2023 and 2024.
• Skills, not just heads: ISC2 reports 59% of respondents with critical or significant skills needs in 2025, up from 44% in 2024. AI is the top skills need at 41%, followed by cloud security at 36%. For workforce detail see the Security Workforce and Skills Gap Statistics Guide.
• Layoffs by organisation size: ISC2 found layoffs at 32% of organisations with 10,000 or more staff, against 18% at 100 to 499 staff and 17% at 1 to 99 staff.

Benchmarks by sector

Few public sources publish sector budget ratios as text. ENISA's NIS Investments 2024 gives absolute sector figures for 2023 that are useful for scale.

Source: ENISA NIS Investments 2024. ENISA also reports that three of the five highest security-to-IT ratios belonged to sectors newly added by NIS 2 (ICT service management, space and waste water), because their IT budgets are small and baseline security costs weigh more heavily. Banking's median IT spend of EUR 53 million explains why its ratio is not the highest despite the largest absolute security budget.

IANS publishes separate 2025 compensation and budget reports for financial services, healthcare, retail, technology and manufacturing CISOs. Their figures sit behind a download form, so they are not quoted here.

Benchmarks by organisation size

• SMEs spend a higher share of IT on security: ENISA's 2024 report states that SMEs devote a larger share of IT spending to security than large enterprises, because fixed baseline costs take a bigger slice of a small budget and large firms gain economies of scale. It does not state the ratio as text.
• SMEs struggle more to fund and hire: in the same report, 34% of SMEs said they would not be able to request the additional budget needed to meet NIS 2, against 14% overall. SMEs reporting hiring difficulty in all domains rose from 32% to 59%.
• Small firms buy in capability: the UK Cyber Security Breaches Survey 2025 found 62% of small businesses using an external cyber security provider, up from 56% in 2024.
• Board ownership grows with size: the same UK survey found a board member responsible for cyber security at 24% of micro, 42% of small, 51% of medium and 66% of large businesses (27% of all businesses). Board ownership matters because it is usually where the budget decision sits.

Market size and spending forecasts

Source: Gartner press release, 29 July 2025. Gartner attributes growth to the move from on-premises to cloud (with cloud security posture management and cloud access security brokers driving software), the use of AI and generative AI by both users and attackers, regulation and higher awareness among small and medium-sized businesses. By our arithmetic, software is about 51% of the 2026 total and 2025 growth is about 10%; the release itself states 12.5% for 2026. Gartner's October 2025 MENA forecast puts that region at $3.7 billion in 2025 and $4.07 billion in 2026 (up 10.1%), with software 48% of 2026 spend. Gartner updates these forecasts quarterly for clients; the figures above are the latest stated in a public press release we could read.

Note the scale mismatch: the market grows at 10% or more while the median CISO budget grew 4% in 2025. Market totals include new buyers, price rises and consolidation onto platforms, so they are not a target for an individual budget.

What the numbers mean for defenders

• Use ratios as a sanity check, not a target: 9% to 11% of IT is a reasonable "are we an outlier?" test for a large organisation. A smaller firm or a new NIS 2 sector can legitimately sit above it. The planning method in the Security Budget and Investment Planning Guide should drive the number; benchmarks only test it.
• Quote the measure correctly: say "median" or "mean", give the survey, year and sample. A board member who checks will find that IANS and ENISA disagree by almost two points, and both are right for their population.
• Protect the people line: staff are about two fifths of spend and the first target in a squeeze. ENISA's falling FTE ratio and ISC2's 33% "cannot adequately staff" figure show the pattern. Tie headcount requests to risk reduction and coverage hours, not tool counts.
• Expect flat years: with 39% of CISOs on flat budgets, plan for funding through consolidation and retiring overlapping tools, not only new money. Identity consolidation is a common place to find it; see the Identity Security Metrics Guide for measures that show the result.
• Regulation still unlocks budget: ENISA found 34% of organisations expect a permanent budget increase to meet NIS 2 and 14% a one-off investment, while 14% said they would not be able to request the extra budget. Map spend requests to named obligations.
• Report outcomes, not percentages: a board will remember "we spend 10%" but act on "these three risks drop by this much". The Board Cyber Risk Reporting Guide covers the reporting format.

Framework mapping

Practitioner checklist

• Calculate your own security-to-IT ratio, security-to-revenue ratio and security FTE share using the same definitions as the benchmark you quote.
• Pick a peer benchmark that matches your size, region and sector (IANS for large, mostly US companies; ENISA for EU NIS 2 entities) and record the edition and year.
• State whether each benchmark is a median or a mean in every board paper.
• Break your budget into staff, software, outsourcing and other, and compare against the IANS 39/29/12 split.
• Model a flat-budget scenario and identify tools to consolidate or retire before asking for growth.
• List each regulatory obligation (NIS 2, DORA, sector rules) that drives a permanent cost, and separate one-off from recurring spend.
• Track staffing adequacy (coverage hours, open roles, skills gaps in AI and cloud) as a budget input, not an afterthought.
• Refresh this comparison each year when IANS (summer), ISC2 (December) and ENISA (late in the year) publish new editions.

Standards and references

• ENISA: NIS Investments 2025
• ENISA: NIS Investments 2024 report
• UK Department for Science, Innovation and Technology: Cyber Security Breaches Survey 2025
• IANS Research and Artico Search: 2025 Security Budget Benchmark Report
• Gartner: Worldwide End-User Spending on Information Security to Total $213 Billion in 2025
• Gartner: MENA End-User Spending on Information Security to Total $4 Billion in 2026
• ISC2: 2025 Cybersecurity Workforce Study

Related NHI Mgmt Group resources: Security Budget and Investment Planning Guide · Security Budget Template and Cost Model · Security Workforce and Skills Gap Statistics Guide · Cyber Insurance Statistics Guide · Cybersecurity Statistics Guide