A CISO should prioritise spending against business-critical services, credible attack paths and gaps in existing controls. Fund the people and operating work needed to make identity protection, patching, monitoring, response and recovery effective. Compare proposals by expected risk reduction, total cost, dependencies and evidence of improvement. Industry spending benchmarks provide context, not a universal allocation or proof that a larger budget creates a safer organisation.
In this briefing
- 01Start with services, data and obligations, rather than a shopping list of products.
- 02A licence needs operating capacity: deployment, tuning, investigation and maintenance all cost time.
- 03Survey averages describe respondents. They do not prescribe your security budget.
- 04Approve investments with measurable outcomes, named owners and an explicit review date.
Start with what the business cannot afford to lose
A cybersecurity budget is a choice about which risks to reduce, which obligations to meet and which residual risks the organisation will accept. The useful starting point is a business service: taking payments, delivering care, supporting customers or operating a production line. Identify its data, identities, technology and suppliers before deciding what to buy.
Ask the service owner what an outage or loss of trustworthy data would mean. Record important deadlines, contractual requirements and dependencies. A recovery target agreed with the business is more useful than an impressive backup dashboard whose restore process nobody has tested.
NIST CSF 2.0 provides outcomes across Govern, Identify, Protect, Detect, Respond and Recover. Its Current and Target Profiles help organisations compare existing coverage with the outcomes they need. The framework does not prescribe a universal percentage of revenue or a fixed shopping list. [1]
Make that gap analysis the link between a risk register and the budget. Each proposed investment should name the affected service, the weakness it addresses, the owner and the evidence that will show whether it worked. Our GRC analyst guide explains how evidence and risk decisions fit together.
Use budget benchmarks without turning them into rules
Industry surveys can help a CISO prepare a board discussion. They cannot establish the right spend for an individual organisation. Compare company size, sector, technology, existing capability and what each survey counts as security expenditure before treating two budgets as equivalent.
An average increase can coexist with many flat budgets. It also says nothing on its own about control effectiveness. A business can spend more because its cloud estate expanded, its suppliers raised prices or an acquisition added responsibilities, without reducing its existing exposure.
Avoid inventing precision to strengthen a proposal. If the likelihood of an incident is uncertain, show assumptions and a range rather than claiming that a product will deliver an exact return. Cost avoidance estimates are decision aids, not observed savings. Explain which operational result can actually be measured after approval.
Which security investments deserve attention first?
There is no first purchase that fits every business. An unsupported public service, unprotected administrator access or an untested recovery process may each be the urgent gap in a different organisation. Start with the exposed path and the consequence, then check whether an existing capability can address it.
| Observed gap | Potential investment | Evidence to request |
|---|---|---|
| Weak or excessive account access | Stronger authentication, access review and identity administration | Coverage of critical accounts, approved exceptions and removal of unnecessary access |
| Exposed vulnerable services | Asset discovery, remediation capacity and supported systems | Verified remediation on reachable assets, with documented exceptions |
| Important alerts go unanswered | Detection tuning, investigation capacity and escalation arrangements | A safe test alert reaches an authorised responder who can act |
| One device can reach too much | Restricted permissions and enforced network boundaries | Authorised connection tests demonstrate the intended restrictions |
| Recovery has not been demonstrated | Protected backups, restoration exercises and response preparation | A trusted service is restored and validated against business targets |
CISA's Cross-Sector Cybersecurity Performance Goals provide a prioritised set of voluntary practices intended to help organisations, particularly those with fewer resources, address important risks. They offer a starting point, not complete coverage of every environment or regulatory obligation. [3]
For a smaller organisation, see which cybersecurity control to implement first. For stronger sign-in, our passkeys and authenticator apps comparison explains why authentication methods are not interchangeable.
Budget for operation, not just acquisition
A monitoring service needs useful logs, sensible configuration and someone responsible for investigating important signals. A patching tool needs asset coverage, maintenance windows and staff who can resolve failures. Buying either service without that capacity can leave the original gap open.
Include implementation, migration, training, support, storage and recurring operating work in the total cost. Check which tasks stay with your team when buying a managed service. Agree hours of coverage, escalation responsibilities and authority to contain an incident rather than assuming that a subscription transfers every responsibility.
Review overlapping tools by outcome and dependency. Retiring a redundant product may release money, but only after confirming which logs, workflows and controls rely on it. Keeping a tool is not automatically wasteful, and consolidation is not automatically safer. Ask what would stop working if it disappeared.
The NCSC Board Toolkit connects cyber security with leadership, organisational responsibility and preparedness. Use that perspective to present staffing and exercises as part of the capability being funded, rather than optional extras beside the technology. [4]
Separate using AI in security from securing AI
These are different budget questions. An AI-assisted triage tool might help analysts process work. A business deploying an AI assistant may need new access controls, supplier review, data handling and evaluation. Funding one does not automatically cover the other.
For an AI pilot, name the task, permitted data and decisions it may influence. Compare it with the existing workflow using representative cases, including errors. Measure analyst time alongside missed issues, incorrect recommendations, human review and operating cost. An apparent speed improvement is not useful if it creates unacceptable risk elsewhere.
NIST's AI Risk Management Framework and its generative AI profile provide risk-management guidance across design, use and evaluation. They are not a certification that a particular product is safe. The appropriate checks depend on the use case and its consequences. [5]
Do not treat an association between AI-labelled budget lines and funding growth as proof that renaming a proposal causes approval. A clearer proposal still needs a credible business outcome, ownership and evidence. Keep room to stop a pilot that does not meet those conditions.
Build a proposal the board can challenge
Present choices rather than an undifferentiated request for more money. Separate work needed to meet obligations, reduce a serious exposure and improve an already functioning capability. Explain the consequences of delaying each item and identify who can accept the remaining risk.
- Name the outcomeState the service and risk in business terms. For example, reduce the chance that compromised staff access can administer recovery systems.
- Show the present evidenceUse tested access, coverage and restore results. Label estimates and unknowns instead of presenting a maturity score as proof that a control works.
- Compare practical optionsInclude changes to existing systems, staffing or a managed service where relevant. Show total cost and dependencies, not only the licence price.
- Agree acceptance testsDefine what completion means, who owns it and when it will be checked. Balance technical measures with whether the business service can operate and recover.
- Review the resultCheck the agreed evidence after implementation. Adjust, stop or expand the investment according to what it demonstrates and what changed in the business.
This approach leaves a traceable decision: a risk, a choice, an owner and a result to verify. It also makes the next budget discussion more useful, because the team can show which previous assumptions held up.
Practise the defensive decisions
Explore the themes through DirtyPhish's games. These are learning games, not security tools or substitutes for testing a real environment.
SPENDING AND TRADE-OFFS
RISK AND EVIDENCE
LIMITED BUDGETQuestions people ask
What should a CISO spend the cybersecurity budget on first?
Start with the most important business services and the gaps that expose them. Weak account protection, reachable vulnerable systems, unanswered alerts or untested recovery may each be urgent. Use evidence from your environment rather than assuming one product must always come first.
What percentage of revenue should go to cybersecurity?
There is no universal percentage that establishes adequate security. Scope, sector, obligations, existing capability and business risk matter. Benchmarks help compare similar organisations, but do not replace a risk-based proposal and tests of whether the funded controls work.
Does increasing the budget guarantee better security?
No. A larger budget can pay for higher prices or a larger technology estate without closing an important gap. Evaluate the outcomes funded, the operating capacity behind them and evidence from testing. Spending is an input, not proof of reduced risk.
Should a CISO buy another tool or hire more staff?
Identify the constraint first. Missing technical coverage may justify a tool; unanswered alerts or failed deployments may require operating capacity. Compare the full cost and responsibilities of staff, process changes and managed services rather than treating headcount and software as interchangeable.
Should AI have a separate cybersecurity budget?
Use a separate line when it makes ownership and decisions clearer, not because the label promises approval. Distinguish AI-assisted security work from protecting AI systems used by the business. Both need defined use cases, risk checks, costs and measures of effectiveness.
Is The Trillion Dollar CISO a realistic procurement simulator?
No. It is a humorous spending game with a fictional trillion-dollar budget, estimated prices and a cyber board score. Use it as a conversation starter about choices, not as a purchasing recommendation, security assessment or model of your organisation's funding needs.
Sources and further reading
- NIST: Cybersecurity Framework FAQs. CSF 2.0, organisational profiles and risk-based prioritisation. Fact-checked 16 October 2026.
- IANS and Artico Search: 2026 security-budget research announcement. Published 15 September 2026. Survey findings describe respondents, not a universal budget requirement.
- CISA: Cross-Sector Cybersecurity Performance Goals. Voluntary, prioritised practices. Not complete coverage of every threat or obligation.
- UK NCSC: Cyber Security Board Toolkit. Leadership, business risk, people and preparedness.
- NIST: AI Risk Management Framework. Framework and generative AI profile for managing AI-related risks. Not a product certification.
General educational guidance. Production security changes should follow your organisation's authorised change and incident-response processes. Illustrations are conceptual, not proof of a secure design.