Cyber Security Budget Planning: Where Should You Invest Next?

Cybersecurity budgets rarely fail because an organisation spends too little everywhere. More often, money is being spent without enough evidence that it’s reducing the risks the business is most exposed to.

That’s why we don’t think cyber security budget planning should begin with a percentage of your IT budget. A benchmark can provide context, but it can’t tell you whether your next £20,000 should go towards another security platform, fixing an exposed application, improving incident response or testing whether the controls you already pay for actually work.

The starting point should be much simpler: what could materially disrupt the organisation, and where do you currently have the least confidence in your ability to prevent or contain it?

It’s a relevant question for organisations of every size. The latest UK Government Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses had identified a cyber breach or attack during the previous 12 months. This rose to 65% of medium-sized businesses and 69% of large businesses.

A stronger cybersecurity spending strategy starts by connecting budget directly to that exposure.

Don’t start with a percentage. Start with the risk

It’s tempting to ask how much other organisations spend on cybersecurity and work backwards from there.

We’d use those figures carefully.

Two businesses with the same turnover and headcount can have completely different attack surfaces. One could operate a largely standard Microsoft environment with limited public-facing infrastructure. Another could run customer applications, APIs and complex cloud environments while processing sensitive information and relying on several critical suppliers.

Giving both organisations the same security budget allocation because they’re roughly the same size doesn’t make much sense.

The NCSC’s cyber security risk management guidance recommends establishing the organisation’s business context before deciding how cyber risk should be managed. That includes identifying what the business needs to protect, which outcomes would be unacceptable and what legal or contractual obligations need to be met.

We’d turn that principle into a practical budgeting exercise.

For every significant investment, ask:

-Which business risk is this expenditure intended to reduce?

-What evidence tells us the risk currently exists?

-What would happen if we left it untreated for another year?

-How will we know the investment has improved security?

-Is there already a control in place that should address the problem but isn’t working effectively?

That last question is particularly important.

Before buying another control, find out whether the existing ones work

One of the biggest opportunities in cyber security budget planning is also one of the easiest to overlook: validation.

An organisation may already pay for endpoint protection, identity controls, monitoring platforms and vulnerability management. The presence of those controls doesn’t automatically tell you whether they would stop or detect the attack scenarios you’re concerned about.

Testing gives you that evidence.

The Government’s 2025/26 survey found that only 30% of businesses had conducted a cyber risk assessment during the previous year. Just 18% had carried out a cybersecurity vulnerability audit, while 13% reported using penetration testing.

For us, this creates an important distinction between owning security controls and having assurance over them.

If you’re introducing a new customer-facing application, for example, buying another defensive product may be less useful than testing whether weaknesses in the application can actually be exploited. If you already have a mature SOC and detection stack, the better cybersecurity investment might be an objective-led or Red Team exercise that shows whether realistic attacker behaviour is detected and contained.

We’ve explained the differences between vulnerability scanning, penetration testing and Red Teaming in more detail elsewhere. Each answers a different security question, so testing should be selected according to what you’re trying to prove rather than whichever assessment has traditionally appeared in the annual budget.

This is where security investment starts becoming measurable. Instead of saying, “we spent more on security this year”, you can say, “we tested this risk, found these weaknesses, fixed them and confirmed the remediation.”

Put remediation capacity next to vulnerability management

Finding weaknesses is only valuable when the organisation can do something about them.

The NCSC’s current vulnerability management guidance specifically recommends prioritising activity around critical systems rather than becoming overwhelmed by the total number of vulnerabilities discovered. It also says vulnerability management should involve security, IT, risk teams and senior leadership where required, with the associated time and budget reflected in organisational risk management.

So, if you’re increasing investment in vulnerability scanning or security testing, budget for the work that follows it.

That could mean reserving engineering time for remediation, replacing unsupported technology or giving development teams enough capacity to fix application security issues without continually pushing them into the next sprint.

A common mistake is to fund the identification of vulnerabilities but treat remediation as somebody else’s operational problem. The result can be an impressive dashboard accompanied by an ageing backlog of weaknesses.

Our preferred measure isn’t simply “how many vulnerabilities did we find?” It’s whether the organisation can identify the weaknesses presenting the greatest business risk, fix them at an appropriate pace and verify that the fix has worked.

Don’t leave incident response until an incident

Prevention will always deserve investment, but expecting every preventative control to work every time isn’t a realistic security strategy.

Your budget needs to cover what happens after an attacker gets through as well.

There is still a significant gap here across UK organisations. The 2025/26 Cyber Security Breaches Survey found that only 25% of businesses had a formal incident response plan. Although this rose to 57% among medium-sized businesses and 76% among large businesses, the Government’s qualitative research also found examples of organisations whose plans had never been properly tested.

A document alone isn’t preparedness.

The NCSC’s Cyber Incident Exercising guidance recommends using controlled scenarios to practise and evaluate incident response plans. Its Board Toolkit goes further, recommending that exercises are used to identify improvements and that lessons are reported back to leadership.

That makes incident response exercising a particularly useful investment where an organisation already has a plan but little evidence of how it would perform.

Rather than discovering during a ransomware incident that nobody knows who can authorise isolation of a critical system, those decisions can be rehearsed beforehand.

Fund the people operating the technology

Security technology investment also needs an operational reality check.

Before renewing or adding a platform, look at who will configure it, monitor it and act on its output. A technically capable product can still offer poor value if an overstretched team only uses a fraction of its functionality.

You’ll see the same issue discussed repeatedly among practitioners. In one r/sysadmin discussion about annual IT and security budgets, administrators repeatedly raised headcount alongside technology, with one contributor describing the problem of having budget for tools but nobody available to implement them properly.

That’s anecdotal rather than benchmark data, but it’s a useful budgeting test.

When reviewing an existing tool, we’d ask whether it is:

-deployed across the systems it was purchased to protect;

-configured for the organisation’s current environment;

-producing information somebody actually reviews;

-integrated into a defined response process;

-still solving a risk the organisation considers important.

If the answer is repeatedly “no”, buying another platform may simply add another licence to the same problem.

Security budget allocation should account for the people and processes needed to make existing controls effective.

Keep training tied to actual risk

Staff security training deserves investment too, but simply purchasing another annual awareness package shouldn’t automatically count as progress.

Only 19% of UK businesses reported providing cyber security training or awareness activity during the previous 12 months, according to the Government’s latest survey. The figure reached 84% among large businesses, showing how widely practice differs according to organisational size.

Training should reflect what people can actually do inside your organisation.

Someone with privileged access to production infrastructure doesn’t need exactly the same security education as a member of the finance team. Developers working on internet-facing applications have different responsibilities again.

Look at incidents, phishing exercises, penetration test findings and access reviews to identify where behaviour is contributing to risk. Training can then address specific weaknesses rather than existing solely because “security awareness” has a line in the information security budget.

Use an evidence column in every budget request

One change we’d make to most security budgets is adding an evidence column.

Instead of presenting finance or the board with a list of technologies and services, connect every proposed investment to a demonstrated problem.

For example:

This makes cybersecurity ROI easier to discuss because you’re no longer trying to prove that an incident which didn’t happen was prevented by one particular product.

You’re showing measurable changes in exposure, control effectiveness and organisational readiness.

So, where should your cybersecurity budget go next?

There isn’t one cybersecurity investment priority that applies to every business.

The Government’s Cyber Governance Code of Practice reflects the same principle. It asks boards to identify critical technology and services, define their cyber risk appetite, regularly assess risk and gain assurance that appropriate controls are working.

That’s how we’d approach cyber security budget planning too.

Start with what the business cannot afford to lose. Identify the attack paths and weaknesses creating meaningful exposure. Check whether existing controls address them. Then validate those controls before automatically adding more technology.

If the evidence shows a gap, invest.

If the evidence shows a control isn’t working, improve it.

If you don’t have enough evidence to know either way, the next investment may need to be the assessment that gives you the answer.

At Secarma, we help organisations turn security uncertainty into something measurable. From cyber security maturity assessments and vulnerability management through to penetration testing and Red Teaming, our focus is on understanding the risk you’re trying to manage first, then selecting the level of assurance that gives you genuinely useful information.

Because a bigger cybersecurity budget isn’t automatically a better one. A strong budget is one where every meaningful investment has a reason for being there.