Cybersecurity Budget Benchmarks for Small Businesses
Why attackers target small businesses and how to budget for defense.
Small businesses are the most-attacked and least-protected segment of the economy. That combination is not accidental. It is the direct result of how attackers make economic decisions.
Why small businesses absorb a disproportionate share of cyberattacks despite spending the least on defense
Ransomware-as-a-service platforms operate on a commission model. Affiliates choose targets by expected payout relative to effort. A 30-employee company with weak defenses produces faster, more reliable returns than a hardened enterprise. The economics reward the attacker for going downstream, not up.
The "too small to matter" belief is itself an attack surface. A 2025 study of SMB owners found that 59% of those with no security measures in place believe they are too small to be a target. Owners who hold that belief invest less, patch slower, and train no one. That is exactly what makes them attractive. The belief creates the condition the attacker is looking for.
Supply chain exposure compounds the problem. If attackers cannot breach a large company directly, they go through its smaller vendors and subcontractors. A small supplier becomes the target of an enterprise-grade campaign it was never resourced to resist. The breach success rate at micro-businesses is meaningfully higher than at mid-sized organizations, and the gap tracks directly to investment levels. The threat is sized to the victim's weakness, not the victim's size. That is why the budget question is a risk-management decision, not a compliance checkbox.
What the standard benchmarks actually say, and what they leave out
Published benchmarks come in a few standard forms. Percentage of revenue, share of IT budget, per-employee spend. Each gives a useful anchor. None of them tells a lean company where to start or what to cut when the full figure is out of reach.
IANS Research and Artico Search publish a revenue-based benchmark that puts average cybersecurity spending as a fraction of revenue. That figure is a useful starting point for businesses sizing a budget relative to their top line. The IT-budget approach allocates a portion of total IT spend to security, commonly cited as a double-digit percentage. That range is what most practitioners cite for small businesses, with regulated sectors like healthcare skewing toward the higher end.
The limitation is structural. These averages mask the fixed-cost reality of small business security. Foundational tools cost roughly the same whether a company has a handful of employees or many times that. Smaller firms spend a higher share of revenue just to cover the basics, and the benchmark does not reveal that pressure.
The awareness-spending gap is the more revealing finding. CrowdStrike's 2025 State of SMB Cybersecurity Report found that while a large majority of SMBs consider themselves knowledgeable about risk and report having a plan, only about a third are actually investing in new tools. Among the smallest businesses, more than half allocate a negligible share of their annual budget to cybersecurity. People report confidence, but the money is not there, and no benchmark can close that gap on its own. A benchmark tells you whether you are in the ballpark. It does not tell you which ball to catch first.
How annual budget translates into tiers of actual coverage
A single percentage is less useful than a tiered model that maps annual outlay to what a company can actually defend against at each level. Coverage is not continuous. There are real capability gaps between tiers, and choosing a tier is choosing what you will and will not be able to detect or recover from.
Tier 1 is the entry level. It covers essential controls: MFA, basic endpoint protection, email security, cloud backup, and cyber insurance. That is adequate for the smallest businesses with no regulated data. Tier 2 adds managed detection and response, security awareness training with phishing simulation, and vulnerability scanning. This is the practical floor for any SMB handling customer data or operating in a supply chain. Tier 3 represents higher investment: full managed SOC coverage, an incident response retainer, penetration testing, and compliance automation. If you have regulatory obligations or significant third-party risk, that is your tier.
The tier framing clarifies the real decision. It is not "how much do we spend." It is "which tier of coverage matches our actual risk exposure." A business handling health or financial data that sits at Tier 1 is underinsured regardless of what the revenue benchmark says. The tier model makes that gap visible.
The alternative to managed services is an internal security team. That requires at minimum several analysts for continuous coverage plus a security manager. The fully loaded cost is far higher than any SMB tier above describes. Managed services exist because that math does not work for small businesses.
Where to put the first dollar when the full budget is not yet in place
For a company starting from scratch, the order of investments matters as much as the total. Some controls block the most common attack paths at very low cost, and those come first. MFA on all email, cloud storage, banking, and administrative accounts is the highest-leverage single action. It is available at no incremental cost on most platforms already in use, and it blocks the overwhelming majority of credential-based attacks. Automatic OS and software updates on all devices close the vulnerability exploitation path that accounts for a significant share of ransomware entry points, at no additional cost. Endpoint detection and response (EDR) on all workstations and servers commonly costs a few dollars per endpoint per month for the software layer. It addresses ransomware, malware, and behavioral anomalies that basic antivirus misses. Use a password manager. It closes the credential reuse gap that makes a breach of one account a breach of many, typically at a small per-user monthly cost.
Security awareness training with phishing simulation comes next. According to Verizon DBIR, the human element is involved in a majority of breaches, and employees at small businesses see social engineering attempts far more often than those at larger enterprises. Training platforms are available at a modest per-user monthly cost. Cyber insurance covers breach response costs that could otherwise be existential. Policies with meaningful coverage limits are available, and the premium is modest relative to the exposure it offsets. If you run an annual security risk assessment, you find the specific gaps in your current environment before an attacker does. One-time assessments for smaller businesses are available from managed service providers, many of whom include one as part of onboarding.
The sequencing logic is simple. The first four items cost very little and address the three dominant attack entry points: exploited vulnerabilities, compromised credentials, and phishing. The remaining items layer coverage and recovery on top of that foundation.
How to split a security budget across categories once the foundation is in place
A total security budget without a category breakdown is just a number. Coverage is balanced or full of gaps depending on how you allocate across tools, services, training, and risk management. The practitioner-recommended internal split puts roughly 40% toward security software and tools: endpoint protection, email security, password management, MFA. A substantial share goes to managed security services or IT security support. A portion funds employee training and security awareness. Risk assessments, compliance, and vulnerability scanning get smaller allocations, with incident response planning and cyber insurance also covered.
This split reflects a structural reality. Tools without monitoring leave alerts unreviewed. Monitoring without trained users leaves the phishing path wide open. The categories are interdependent, not interchangeable. Hardware allocations are declining because the market is moving from on-premise appliances to cloud-native and software-defined security. SMBs starting fresh benefit from this shift because they are not carrying legacy hardware debt.
The integrated platform argument is worth weighing. If you buy five separate point tools across these categories, you typically pay more in total, carry more management overhead per tool, and create gaps at the seams. A single platform covering device management, identity, endpoint security, and compliance eliminates that overhead. It is the architecture most managed service benchmarks now assume.
What industry and data type do to the baseline numbers
The cross-industry average benchmark is a starting point, not a ceiling. Regulated industries and businesses handling sensitive data face higher breach costs and stricter compliance requirements that push spending well above the average. Healthcare has the highest average breach cost of any industry but spends among the lowest shares of revenue on security. The gap between what healthcare organizations invest and what a breach costs them represents the most severe underinvestment paradox across any major sector. Financial services faces the opposite dynamic. Compliance requirements like PCI-DSS create effective spending floors, and because of that the sector leads in spending intensity. Technology companies spend the most per employee of any sector, but they still absorb significant average breach costs. More tooling does not close the gap if the architecture is wrong.
For SMBs, the distinction is concrete. A 10-person accounting firm handling client tax records faces different risk and compliance exposure than a 10-person landscaping company. The benchmarks are the same. The consequence of underinvestment is not. The practical implication: use the revenue or IT-budget percentage as a floor, then ask what compliance obligations and data sensitivity require on top of it. That answer determines whether a company belongs at Tier 2 or Tier 3, regardless of what the average SMB spends.
Why the cost of not spending is the figure that actually drives the budget decision
The real budget benchmark is not what peers are spending. It is what a breach would cost. For most small businesses, a single serious incident costs multiples of what a year of adequate protection would have.
Downtime costs alone are substantial. IBM's report found that lost business from a breach, including revenue from system downtime, lost customers, and reputation damage, averaged in the millions of dollars. Recovery is also slower than most owners expect. A meaningful share of breach costs materialize more than a year after the incident, so the financial impact extends well beyond the immediate response.
For ransomware specifically, paying the ransom does not reliably resolve the incident. Among SMBs that paid, only a portion got their data back, and many received follow-up demands. The recovery cost excluding the ransom payment is itself significant. The businesses that survive are the ones that budgeted for protection before they needed it. About 60% of small businesses that suffer a significant cyberattack close within six months, and most that did not plan do not recover.
That produces a clear decision framing. A modest annual security program is not a cost center. It is insurance against an event that would cost many times that and that the business might not survive. The question is not "can we afford to spend on security." It is "can we afford the specific gaps in our current coverage." That framing brings you back to the prioritization sequence: close the cheapest, highest-leverage gaps first, then build upward from there.
