Everything in life depends, but it’s important to have an idea about broad themes when it comes to financial planning, budgeting and improvement/change costs! I also have an interesting observation. if today we summarised the global cyber security posture average as ‘poor’ we could potentially link that through to underinvestment could we not?
Well to help me look at this subject I’ve used AI/LLM (GROK) Some background, I used to do lots of TCO and broad financial analysis of technical spending in organisations. I have conducted complex TCO and ROI analysis’s for large global orgs etc. so hopefully my general views are backed up by some good experiences with a large range of orgs. Now we could go with ‘trust me bro, Daniel says…’ but I figured since we have LLMs, let’s see what they can do!
Business Spending, IT, and Cybersecurity Budget Allocation (Average)
Business Spending (% of Revenue)
IT Budget
Cybersecurity Budget
Summary of Spending Models
This report presents three pie charts detailing Business Spending as a percentage of revenue, IT Budget, and Cybersecurity Budget, based on enterprise averages from 2023–2025 industry data (Gartner, Deloitte, McKinsey, IANS Research, Statista). Each chart reflects Total Cost of Ownership (TCO) principles, covering labor, capital, services, and compliance costs. The models are tailored to align with user feedback (IT ~5%, Cybersecurity <1% of revenue) and validated against benchmarks.
Business Spending (% of Revenue)
The Business Spending chart allocates revenue across departments: Operations (25%), Sales (20%), Marketing (12%), Research & Development (R&D) (8%), Human Resources (HR) (8%), Finance (6%), IT (6%), General & Administrative (G&A) (5%), Legal (4%), and Cybersecurity (0.8%). Operations (25%) covers supply chain, logistics, and manufacturing, within Deloitte’s 20–30% for diversified enterprises. Sales (20%) and Marketing (12%) reflect customer acquisition, per Gartner (15–20%) and Statista (8–12%). R&D (8%) suits moderate innovation, per McKinsey (5–7%). HR (8%) and Finance (6%) align with Deloitte (6–8%, 4–6%). IT (6%) matches user feedback (~5%) and Gartner (5–8%), covering infrastructure and line-of-business (LOB) applications. G&A (5%) and Legal (4%) fit McKinsey (4–6%) and Statista (2–5%). Cybersecurity (0.8%) aligns with IANS (0.69%) and user feedback (<1%). The chart sums to 100%, normalized for visualization, though actual percentages vary by industry (e.g., manufacturing prioritizes Operations, tech emphasizes R&D).
IT Budget
The IT Budget chart breaks down internal IT spending (excluding cybersecurity): Personnel and Training (40%), Cloud-Based Solutions (25%), On-Premises Software and Hardware (20%), and Managed IT Services (15%). Personnel dominates due to high labor costs for IT staff (e.g., system administrators, developers), supported by Gartner (40%) and Deloitte (35–45%). Cloud-Based Solutions (25%) include cloud infrastructure (e.g., AWS, Azure) and Software-as-a-Service (SaaS) applications, such as LOB systems like HR (e.g., Workday), Finance (e.g., SAP), ERP (e.g., NetSuite), and CRM (e.g., Salesforce), per Statista (25–30% of IT budgets). On-Premises Software and Hardware (20%) cover servers, networking equipment, and on-premises LOB applications (e.g., legacy ERP systems), aligning with Gartner (20%). Managed IT Services (15%) include outsourced support for IT infrastructure and LOB applications, slightly above Gartner’s 10% but within Statista’s 10–15%. This distribution emphasizes operational efficiency and digital transformation, summing to 100%.
Cybersecurity Budget
The Cybersecurity Budget chart details internal security spending: Cybersecurity Personnel and Training (35%), Cloud Security Solutions (20%), On-Premises Security Software and Hardware (15%), Managed Security Services (15%), Compliance and Governance (10%), and Testing and Validation (5%). Personnel (35%) reflects the demand for security analysts, per IANS Research (30–40%) and Gartner (35%). Cloud Security Solutions (20%) address growing cloud adoption, protecting SaaS and infrastructure, per Deloitte (15–25%). On-Premises Security (15%) includes firewalls and SIEM systems, per IANS (20–25% software). Managed Security Services (15%) and Compliance and Governance (10%) align with Gartner, covering outsourced monitoring and regulatory audits. Testing and Validation (5%) matches IANS (5–10%) for penetration testing. The chart sums to 100%, balancing prevention, detection, and compliance.
Rationale and Considerations
These models use enterprise averages to provide a generalized view. The Business Spending chart reflects revenue distribution, normalized to 100% for clarity, while IT and Cybersecurity charts focus on internal budget allocations, each summing to 100%. Percentages are grounded in TCO, capturing direct (e.g., hardware, software licenses) and indirect (e.g., training, support) costs, including LOB applications in IT spending (e.g., HR, Finance, ERP, CRM via cloud and on-premises categories). User feedback shaped IT (6%) and Cybersecurity (0.8%) to align with typical non-tech enterprises. Variations exist by industry (e.g., tech may have IT at 10–15%, Cybersecurity at 1–1.5%) and size (small businesses may have IT at 3–5%, Cybersecurity at 0.3–0.5%). The small Cybersecurity share (0.8%) appears minor but is critical, reflecting its low revenue proportion but high impact.
have a look, what do you think? how doe your organisation compare to this broad generalisation? are you getting the right security outcomes for the investment? are you not investing enough?
All sensible questions to ask! Money is not the only ingredient by far, you need a skilled team, with the right tools, working on the right areas to manage risk and defend your organisation from digital threats.