# Security Budget Planning
Security budget planning is the discipline of allocating financial resources to cybersecurity programs based on risk assessment, organizational priorities, and measurable outcomes. The security budget determines what the organization can protect, how deeply it can protect it, and how fast the security program matures. Every unfunded control is a risk the organization has implicitly accepted, whether leadership made that decision deliberately or not.
Security budgets are chronically misaligned with risk. Organizations that have not experienced a breach underinvest because the threat feels abstract. Organizations that have experienced a breach overinvest in the specific area that was breached while leaving other domains underfunded. Both patterns produce imbalanced programs. Effective budget planning distributes investment across all six PDM domains based on quantified risk, not emotion, recency bias, or vendor marketing.
The CISO's budget conversation with the CFO and board is not a request for money. It is a business case that translates security investment into risk reduction measured in financial terms. "We need $500,000 for security" is not a business case. "A $500,000 investment in backup architecture and MFA deployment reduces our expected annual loss from ransomware from $2.1 million to $340,000" is a business case the CFO can evaluate against other organizational priorities.
Industry benchmarks provide a starting point, not a target:
Percentage of revenue. Cybersecurity spending as a percentage of annual revenue varies by industry: financial services (0.3% to 0.6%), healthcare (0.4% to 0.8%), technology (0.5% to 1.0%), retail (0.2% to 0.4%), and manufacturing (0.2% to 0.5%). These ranges reflect Gartner and IANS research and represent total cybersecurity spending including personnel, technology, services, and training.
Percentage of IT budget. Security spending as a percentage of the total IT budget typically ranges from 10% to 15% for mature programs. Organizations below 5% are underinvesting. Organizations above 20% may have security consuming IT resources that should be allocated to infrastructure, application, or operational needs.
Per-employee. Average security spending per employee: $1,500 to $3,500 for mid-market organizations, $3,000 to $6,000 for regulated industries (financial services, healthcare, defense). Per-employee metrics normalize for organizational size and provide a comparison point for organizations of similar headcount.
Benchmarks are reference points, not targets. An organization with a strong security posture and low risk profile may rationally spend below the benchmark. An organization in a high-risk industry with significant compliance obligations and a weak security posture should spend above the benchmark until the posture improves. The benchmark indicates where peers are spending. The risk assessment determines where the organization should be spending.
The most effective budget allocation methodology links spending to risk reduction. The process:
Quantify the risks. Using FAIR or equivalent quantitative risk methodology, calculate the annualized loss expectancy (ALE) for the organization's top risks. A ransomware scenario with 15% annual probability and $4.2 million expected loss has an ALE of $630,000. A data breach scenario with 10% annual probability and $3.8 million expected loss has an ALE of $380,000.
Map controls to risks. For each risk, identify the controls that reduce its frequency or magnitude. MFA reduces credential-based initial access frequency. Immutable backups reduce ransomware loss magnitude (recovery without payment). Network segmentation reduces breach blast radius. DLP reduces data exfiltration probability.
Estimate risk reduction per investment. For each proposed control investment, estimate the post-investment ALE. The $200,000 MFA deployment reduces ransomware probability from 15% to 5% (by eliminating the most common initial access vector). The new ALE is $210,000. The risk reduction is $420,000 annually on a $200,000 investment. The return on security investment (ROSI) is quantifiable and communicable to the board.
Prioritize by ROSI. Rank proposed investments by return on security investment. The controls that produce the greatest risk reduction per dollar invested are funded first. This is not the same as funding the most expensive controls first (a $500,000 SIEM deployment may produce less risk reduction than a $50,000 MFA deployment). Risk-based prioritization ensures that limited budget produces maximum risk reduction.
Security budgets are typically organized into four categories:
Personnel (40% to 60% of total budget). Salaries, benefits, and training for the security team. Personnel is the largest budget category because security operations require human judgment (alert triage, incident investigation, threat hunting, architecture review) that technology cannot fully automate. Understaffing the security team makes every technology investment less effective: the SIEM produces alerts nobody investigates, the vulnerability scanner produces findings nobody remediates.
For organizations that cannot fund a full internal security team, managed services (MDR, MSSP, vCISO) convert the personnel cost from fixed (full-time salaries) to variable (service fees scaled to the organization's needs). CDA's B2B engagement model provides this: operational cybersecurity capability at a fraction of the cost of building an internal team, scaled to the organization's risk profile and budget.
Technology (20% to 30%). Software licenses, hardware, cloud security services, and tool subscriptions. Major technology categories: SIEM/SOAR, EDR, identity platform (IAM, PAM, MFA), vulnerability management, DLP, email security, and GRC platform. Technology spending should align with the PDM domain model: each domain needs appropriate tooling, and no domain should be unfunded.
The technology budget trap: purchasing tools without the personnel to operate them. A $300,000 annual SIEM license that nobody monitors is a $300,000 annual waste. Technology spending should be proportional to the personnel capacity to use the technology effectively.
Services (15% to 25%). External services: penetration testing, compliance audits, incident response retainer, forensic investigation, security consulting, and managed security services. Services provide specialized expertise that the internal team may not have and burst capacity for events (incident response, audit preparation) that do not justify full-time headcount.
CDA's engagement model falls in this category. B2B clients invest in operational cybersecurity services (Confidential: $5,000/month, Secret: $15,000/month, Top Secret: $45,000/month) that provide the security operations, compliance management, and strategic leadership that would cost significantly more to build internally.
Training and awareness (3% to 5%). Security awareness training for the general workforce, technical training for the security team, certification preparation, and conference attendance. Training is the most underfunded category and the highest-leverage per dollar: $50,000 in security awareness training that reduces phishing click rates from 15% to 5% eliminates the most common initial access vector more cost-effectively than any technology investment.
Board members evaluate security budgets using the same financial framework they apply to every other investment. The CISO must translate security spending into terms the board uses:
Risk reduction. "This investment reduces our expected annual loss from $X to $Y." The board evaluates the investment against the risk reduction it produces.
Revenue enablement. "This SOC 2 certification investment enables us to compete for enterprise contracts worth $Z in annual revenue." Compliance spending that enables revenue is not a cost center. It is a revenue enabler.
Regulatory requirement. "This investment is required to comply with [regulation]. Non-compliance carries penalties of up to $X and potential loss of our ability to operate in [market/jurisdiction]." Regulatory spending is mandatory, not discretionary.
Peer comparison. "Our security spending is X% of revenue. Industry peers spend Y% to Z%." Benchmarks provide context that helps the board evaluate whether the organization is under- or over-investing relative to peers.
Incident cost avoidance. "The average cost of a breach in our industry is $X. Our proposed investment reduces the probability by Y% and the expected impact by Z%." Incident cost avoidance frames the budget as insurance against a quantifiable risk, not as an abstract expense.
Security budget planning should follow the organization's fiscal planning cycle:
Q3 (3 to 4 months before fiscal year). Conduct the risk assessment update. Identify the top risks and the controls that address them. Estimate the risk reduction for each proposed investment. Develop the budget proposal with ROSI calculations.
Q4 (1 to 2 months before fiscal year). Present the budget proposal to the CFO and executive leadership. Negotiate priorities. Finalize the budget allocation. Secure board approval.
Q1. Execute the budget: procure technology, hire or contract personnel, engage services, and begin program initiatives. The security roadmap for the year should be funded and executable on day one of the fiscal year.
Ongoing. Track budget execution against plan. Report variance quarterly. Adjust for unplanned needs (emergency incident response, new regulatory requirements, organizational changes). Maintain a contingency reserve (5% to 10% of the security budget) for unplanned expenses.
Every dollar not spent on security is a risk accepted. The organization that does not fund MFA has accepted the risk of credential-based attacks. The organization that does not fund backup testing has accepted the risk that backups may not be recoverable. These are legitimate risk decisions if they are made deliberately based on risk assessment. They are governance failures if they are made by default because nobody asked for the budget.
The CISO's responsibility is to ensure that leadership makes informed risk decisions. The CISO presents the risk, the proposed investment, and the risk reduction. Leadership decides whether to fund it. If leadership declines, the CISO documents the decision. The documentation is both a governance record and a personal protection (the CISO who recommended a control that was denied by the board is in a different legal position than the CISO who never raised the issue).
Security program maturity is constrained by budget. An organization with a $200,000 annual security budget cannot operate a 24/7 SOC, deploy enterprise PAM, and conduct quarterly penetration testing. The budget determines the maturity ceiling. Budget planning determines how quickly the organization moves toward that ceiling and which capabilities are prioritized along the way.
CDA's engagement model addresses the maturity-budget constraint for mid-market organizations. A Confidential engagement ($5,000/month, $60,000/year) provides operational security capability that would cost $300,000+ to build internally (personnel, technology, management). The managed service model converts fixed costs to variable costs and provides enterprise-grade capability at mid-market prices.
Security budget planning sits in the RGA (Risk Governance and Assurance) domain of the Planetary Defense Model. RGA is the strategic envelope: the governance layer that allocates resources across the five inner domains. The budget is the financial expression of the security strategy: what the organization has decided to defend, to what level, with what resources.
CDA's Perpetual Compliance Assurance (PCA) methodology integrates budget planning into the continuous governance cycle. "Compliance is not an event. It is a state." Budget is not a once-a-year negotiation. It is a continuous alignment between risk, capability, and resources that adjusts as the threat landscape, organizational priorities, and posture scores change.
RGA-B01 (Risk Management Framework, 32 estimated hours) includes security budget planning as a component: risk quantification that produces the data for ROSI calculations, domain-level investment allocation based on posture scores, and board reporting that communicates the investment-to-risk-reduction relationship.
CDA approaches budget planning with one principle: allocate by domain posture score, not by vendor category. An organization that spends 80% of its technology budget on TID tools (SIEM, EDR, threat intelligence) while IAT has no PAM and DPS has no immutable backups has an imbalanced portfolio. CDA's Posture Score identifies the weakest domains. Budget planning prioritizes investment in the weakest domains until they reach a minimum threshold, then shifts to balanced investment across all six. The weakest domain determines the security ceiling. Funding the weakest domain raises the ceiling.
Word count: 1,972