How Much Should an SMB Spend on Cybersecurity? Every Benchmark Answers in Percentages. You Need a Number.

Somewhere between the insurance renewal and the third customer security questionnaire, every SMB board arrives at the same question: what should we actually be spending on this? Ask five advisers and you will get five percentages — of IT budget, of revenue, of “digital spend”. All of them sourced from credible research. None of them built for a company your size. Percentage benchmarks are how large enterprises plan; they are close to useless as a target for a 50-person company. The percentages are not wrong — they are answers to a different company’s question. This article gives you the numbers behind them, why they mislead, and the euro ranges we actually use.

What the benchmarks actually say

Four widely cited surveys dominate the conversation, and they disagree — because they measure different populations.

Source (edition)	Headline figure	Who was surveyed
IANS / Artico Security Budget Benchmark (2025)	10.9% of IT budget, down from 11.9%; 0.69% of revenue on average	587 CISOs, 87% at companies with $100M+ revenue, 88% US-based
ENISA NIS Investments (2025)	9% of IT budget; median spend €1.5M	1,080 EU organisations in NIS2 high-criticality sectors
CESIN / OpinionWay barometer (2026, 11th ed.)	42% of companies devote 5%+ of IT budget to security, down from 48%	397 French organisations, mostly large and mid-sized firms
CrowdStrike State of SMB Cybersecurity (2025)	More than half of sub-50-employee firms allocate under 1% of annual budget; 6.5% call their budget sufficient	291 US small-business professionals, 1–249 employees

Read the third column before the second. If your company has a security team, a SOC contract, and a median security spend of €1.5M, the ENISA figure describes you. If it has 40 employees and an outsourced IT provider, the survey closest to you is CrowdStrike’s — US-based, but it found that more than half of firms under 50 staff spend under one percent of their annual budget on security.

One detail in the first row deserves more weight than it usually gets. The enterprise benchmark did not hold steady at 10.9% — it fell there, from 11.9%, breaking a five-year climb, on budget growth of 4%, the slowest in five years. A benchmark that is itself receding is a poor thing to anchor a floor to.

Four credible surveys, four different answers — because four different samples. The smaller the company, the higher the revenue share security demands.

Why percentages mislead small companies

Three reasons, each mechanical rather than controversial.

Security has a fixed-cost floor. MFA, managed detection, tested backups, and someone competent to run them cost roughly the same whether you have 60 employees or 600. Spread over a small revenue base, that floor is a big percentage; over a large base, a rounding error. IANS and Artico’s separate 2025 read on small and midmarket CISOs — a different publication from the 587-CISO benchmark above — shows exactly this: smaller companies spend upwards of 2% of revenue on security, while larger firms sit closer to 0.6%. Same controls, different denominator.

Your IT budget is a fuzzy denominator. “10% of IT budget” assumes a clean IT budget line. Most SMBs run IT as a mix of an outsourced provider, SaaS subscriptions scattered across departments, and one overloaded internal person. Ten percent of a number nobody can state is not a target — it is an alibi.

Percentages scale down to absurdity. A €3M-revenue firm applying the enterprise average of 0.69% of revenue would budget €20,700 a year for everything — licences, services, training, and whatever outside help it needs the day something goes wrong. The arithmetic is correct and the conclusion is wrong.

What the money buys, in order

Before asking how much, fix the order of what. Security spend comes in three rungs, and the ladder only works climbed from the bottom.

Rung 1 — Foundations. MFA everywhere, patching on a schedule, endpoint protection, tested offline backups, a password manager, and awareness training. This is the layer that defeats the attacks that actually hit SMBs — phishing and stolen credentials, not zero-days.

Rung 2 — Detection and response. Someone watching: a managed detection and response (MDR) contract, priced per user: the one public list price we could find works out at about $20 per user per month, so roughly $1,000 a month for 50 seats and $3,000 for 150 before servers and volume discounts — plus an incident-response arrangement you have rehearsed at least once.

Rung 3 — Leadership and assurance. Someone accountable: a security leader who owns risk decisions and reports to the board, plus periodic independent internal audits to verify the first two rungs are real. A full-time CISO costs roughly €130–200K a year all-in in France, and in Switzerland the salary alone ranges from CHF 170K to 280K; a Virtual CISO service delivers the same accountability at €2,500–8,500 per month.

Skipping rungs is the classic failure: an EDR platform (rung 2) that nobody configured, bought by a company with untested backups (rung 1) and no owner (rung 3).

The euro ranges, by company size

These are our planning ranges, built bottom-up from published unit prices — MDR list prices, CISO salary guides, freelance day rates for fractional security leaders. They are not survey data: we found no EU or French survey that publishes security spend in euros by company size between 50 and 500 employees, which is precisely the gap they fill. The nearest French reading points the same way: in Cybermalveillance.gouv.fr’s 2025 barometer, 77% of small businesses spent under €2,000 a year on IT security — a sample dominated by firms under ten staff. All-in annual figures: licences, services, training, and external expertise. They exclude the salaries of in-house IT or security staff, which a company that already employs a security team carries on top.

Company size	Floor (foundations, run well)	Defensible (+ detection & response)	Regulated (+ leadership & audit)
~50 employees	€15–30K / year	€40–80K / year	€70–130K / year
~150 employees	€35–70K / year	€90–180K / year	€150–300K / year
~500 employees	€100–200K / year	€250–450K / year	€400–700K / year

Two sanity checks. Against revenue: a €20M-revenue, 150-person firm at the “defensible” level lands at 0.45–0.9% of revenue — bracketing the IANS average of 0.69%, but arrived at from the bottom up. Against the threat: the last time IBM published a breakdown by headcount, the average breach at an organisation under 500 employees cost $3.31M (2023). Its 2026 edition no longer splits by size, and puts the global average across all organisations at $4.99M. Either way, at 50 and 150 employees the entire “defensible” budget costs less over a decade than one average breach.

The three-rung spend ladder: fund each rung fully before climbing to the next.

Regulation has turned the floor into law

If you are in scope of NIS2 — and with 18 sectors covered, more SMBs are than think they are — the budget question is no longer entirely yours to answer. The European Commission’s own impact assessment projected that entities newly in scope would need to raise ICT security spending by up to 22% in the years immediately following implementation (12% for those already under NIS1). ENISA’s 2025 investment survey confirms the pull: 70% of EU organisations name regulatory compliance as the main driver of their security investment. Our NIS2 compliance services exist for exactly this conversation — and the “regulated” column above is, in effect, what Article 21’s baseline measures cost at SMB scale. Budgeting below it is not a savings decision; it is a non-compliance decision, made implicitly.

The five-question budget test

Percentages answer to spreadsheets; these questions answer to your board. What did we spend on security last year — one all-in number, licences and people-time included? Which risk does each major line reduce — can anyone name it? Are the foundations fully funded before anything clever is? Would the number survive a regulator’s or a key customer’s audit question? And who owns it — one accountable person, or a renewals calendar? As we showed in What a vCISO Actually Does in Month 1, Month 3, and Month 12, producing that defensible, board-ready number is precisely a month-one deliverable — it does not take a year, and it does not start with a purchase.