Every Company Needs a Cybersecurity Budget, but Not Every Company Needs the Same Percentage
Every business budgets for insurance, utilities, payroll, and other essential operating expenses. Yet many organizations, particularly small businesses, continue to treat cybersecurity as optional. In today’s digital economy, that approach exposes businesses to potentially devastating financial and operational consequences.
Every company needs a dedicated cybersecurity budget, but not every company needs to spend the same percentage. Cybersecurity investments should reflect an organization’s size, industry, technology dependence, regulatory obligations, and exposure to cyber threats.
While allocating 5% to 15% of an annual IT budget may serve as an initial planning reference, it is not a universal industry standard or a guarantee of adequate protection. Some organizations may require substantially greater investments, particularly those handling sensitive information or operating in regulated industries.
Consider two hypothetical examples:
Small Manufacturing Business: A manufacturer generating $5 million annually suffers a ransomware attack that shuts down production for five days. Lost revenue, recovery expenses, and missed deliveries could cost tens of thousands of dollars. Investments in endpoint protection, 24/7 monitoring, and secure backups could significantly reduce that risk.
Small Accounting Firm: A 20-person accounting firm experiences a business email compromise resulting in a fraudulent $75,000 payment. Multifactor authentication, employee awareness training, and payment verification procedures could help prevent such a loss.
Real-world incidents reinforce these concerns. MGM Resorts reported approximately $100 million in negative financial impact from its 2023 cyberattack. The 2024 Change Healthcare attack disrupted healthcare payments nationwide, demonstrating how cybersecurity failures can affect organizations of every size.
Cybersecurity spending should be based on business risk, not an arbitrary percentage. A small business with limited resources may need to dedicate a greater share of its IT budget to establish essential protections.
Ultimately, cybersecurity is not simply an IT expense. It protects revenue, customer confidence, operational continuity, and long-term business viability.
The question is not how little a business can spend on cybersecurity, but how much financial and operational risk it can afford to accept.
The manufacturing and accounting scenarios are hypothetical. The MGM Resorts and Change Healthcare incidents are publicly documented.
Published incident references
- MGM Resorts — October 2023 SEC filing: https://www.sec.gov/edgar/browse/?CIK=789570&owner=exclude
- CMS — Change Healthcare cybersecurity incident: https://www.cms.gov/priorities/key-initiatives/cyber-security
