A security budget is not set by asking "how much can I spare". It is set by asking "how much can I afford to lose" — because that second question also tells you where the money should go.
Short answer: how much should I budget for cybersecurity?
Use a risk-based calculation rather than a fixed ratio: for each risk, compute "likelihood × loss if it happens", then allocate budget starting from the items producing the highest expected loss. The practical consequence: the first spending usually goes not to products but to measures that shorten downtime and close the most common entry route. Revenue-percentage formulas can guide, but should not be used alone because they do not know what a particular business stands to lose.
Risk × impact matrix
| Risk | Likelihood | Impact | Priority |
|---|---|---|---|
| Account compromise via phishing | High | High | 1 — now |
| Ransomware / data made inaccessible | Medium | Very high | 1 — now |
| Intrusion through an unpatched component | High | Medium-high | 2 — this quarter |
| Misuse of a departed employee's access | Low-medium | High | 2 — this quarter |
| Service outage (infrastructure failure) | Medium | Medium | 3 — planned |
| Targeted, advanced attack | Low | Very high | 4 — after fundamentals |
Read it carefully: budget goes to the highest expected loss, not the most frightening scenario. A targeted advanced attack is the scariest but least likely; phishing is both highly likely and high-impact, and far less costly to close.
Turning loss into a number
- Downtime cost. Hourly revenue × estimated outage duration. For most businesses this is the largest item, and it is usually never calculated.
- Recovery cost. Technical response, external support, out-of-hours work, forensic examination where needed.
- Compliance and legal cost. Notification processes, advice, possible administrative consequences — we covered how that process runs in our breach notification article.
- Reputation and customer loss. The hardest to measure, yet often the largest for businesses serving corporate clients.
The sum gives the loss that risk would produce. Multiplied by likelihood, the result shows the upper limit you can reasonably spend to reduce it. Spending above that limit means the measure has become more expensive than the risk.
The order spending should follow
| Order | Item | Why here |
|---|---|---|
| 1 | Authentication (2FA, password manager) | Closes the most common entry route at the lowest cost |
| 2 | Backup and restore capability | Shortens downtime — limits the largest loss |
| 3 | Updates and component maintenance | Removes you from automated target lists |
| 4 | Access management and inventory | Enables fast scope determination during an incident |
| 5 | Awareness work | Covers what technical measures cannot |
| 6 | Monitoring and alerting | Early detection lowers response cost |
| 7 | Advanced protection layers (WAF etc.) | Does not pay off before the fundamentals |
The most surprising element is advanced products sitting last. The reason is simple: they target the risk remaining after the fundamentals, not the gaps the fundamentals close. Bought first, they function as an expensive alarm on a door still standing open.
Highest impact on a small budget
- Two-factor authentication on critical accounts. The largest risk reduction from a single setting.
- A separated backup copy and a restore test. Shortens downtime directly.
- Component cleanup. Removing unused plugins and services narrows the attack surface at no cost.
- Access inventory. A table and a quarterly review; the cost is time alone.
- A payment verification rule. One written rule closes the most expensive fraud scenario — covered in our phishing article.
Netişlem expert view: the largest item is always downtime
Businesses usually think of security cost in terms of "data loss". Yet in the incidents we examine, most of the bill accrues during the days the business stands still: orders cannot be taken, the team cannot work, customer communication stops. Backup and recovery capability therefore belong before classic security products. What decides an incident's cost is usually not what you lost but how quickly you came back.
Our second observation is product-led budgeting. The debate "should we buy this software" starts before the question "which risk are we reducing". A choice made without writing down the risk follows a catalogue rather than a need. With a risk list in hand, product selection usually simplifies itself.
Third, security spending is assumed to be one-off. Most items require continuity: updates, reviews, drills, training. A small annual line reduces more risk than a large investment made every three years.
Planning checklist
- Risk list written with likelihood and impact rated for each.
- Hourly downtime cost calculated.
- Expected loss quantified per risk.
- Budget prioritised by expected loss (not by fear).
- No advanced product bought before fundamentals are complete.
- Recurring items placed in the annual budget (maintenance, training, drills).
- Risk list reviewed annually.
- Every spend records which risk it reduces.
Frequently asked questions
What percentage of revenue should I allocate?
Sector ratios can guide but should not be used alone. Two businesses with identical revenue can have entirely different risk profiles; one processing personal data and selling online does not need the same budget as one running a brochure site. The risk list should decide, not the ratio.
I have never had an incident — how do I justify a budget?
Having had no incident does not mean there is no risk. Framing the case through downtime cost is the clearest route: "if the system stopped for a day we would lose this much" lands better than technical argument. That calculation also shows which measure comes first.
How is return on security investment measured?
Classic ROI is hard because it generates no direct revenue; measurement runs on expected loss avoided. Practical indicators exist too: downtime duration, restore time, detection time and incident count. Improvement in those is the return.
Who should be responsible in a small team?
No full-time role is needed, but one person must own it. Shared responsibility belongs to nobody. That person's job is not to do all the work but to keep the checklist in the calendar.
Should insurance be part of the budget?
Worth considering above a certain scale, but after the fundamentals. Policies generally require minimum measures to be in place; insurance bought while gaps remain may not deliver the protection expected.
Conclusion
A cybersecurity budget is set by calculation, not fear. Once the risk list is written, both the amount and the order of spending emerge by themselves — and that order almost always starts in the same place: authentication and the ability to recover.
If you would like help producing your risk list, get in touch. You can review our secure hosting, corporate backup and SLA guarantee pages.