Cybersecurity Budgeting: Risk vs Cost

Every security budget faces the same question from leadership: prove it's worth it. This guide gives you the real-world breach data from the IBM Cost of a Data Breach Report 2024 and a concrete ROI framework to make the case. So the next time someone asks "How much should we spend on security?", you answer with numbers, not guesses.

Most organizations set their security budget using one of two flawed methods: a flat percentage of IT spend (typically 5-15%) or peer benchmarking ("Company X spends $2M, so we should too"). Neither accounts for your actual risk exposure. The result is a spending gap, either dangerously underfunded or wastefully over-allocated in the wrong areas.

The IBM 2024 data makes this gap visible. Consider a mid-market company with 1,000 employees:

The flat-percentage approach leaves this company $400K short of what the data says they need. That gap translates directly into unmitigated risk: slower incident response, unpatched systems, and no budget for the breach that IBM puts at $4.88M on average.

The $400K difference isn't overspending. It's the gap between guessing and knowing.

A risk-based budget starts with your actual threat exposure, then works backward to determine what controls are worth funding. The sections below give you the benchmark data to build that case. (New to ALE and the formula behind it? See our Annual Loss Expectancy resource page for the fundamentals.)

IBM's annual report studied 604 organizations breached between March 2023 and February 2024, across 16 countries and regions and 17 industries. Ponemon Institute interviewed 3,556 people with firsthand knowledge of those breaches and costed each one activity by activity, so the figures are modeled from real incidents rather than projected. The 2024 report does not break costs out by company size.

For scale: Equifax's 2017 breach exposed the personal information of 147 million people, and its settlement set aside up to $425 million for them. Target's 2013 breach reached as many as 110 million customers. Breaches that size sit outside the averages above: IBM's 2024 figures cover breaches of 2,100 to 113,000 records and study mega breaches separately, so the typical case is what the table shows.

Here's where most CISOs go wrong: they present security budgets as a cost center instead of a risk reduction function. ALE reframes the conversation into a cost-benefit analysis with teeth. The FAIR framework provides a structured methodology for exactly this kind of quantitative analysis.

Using the IBM data:

• ALE baseline: $4.88M (IBM's 2024 global average as the SLE, assuming one breach a year, ARO = 1)
• Current security budget: $1.2M (15% of the $8M IT budget in the table above)
• Security controls reduce ALE by an estimated 60%: $2.93M reduction
• Net ROI: $2.93M - $1.2M = $1.73M in avoided losses

That's not a cost. That's a 144% return on investment, and it rests on the ARO. At a 25% chance of a breach a year the ALE is $1.22M, a 60% cut saves $0.73M, and the same $1.2M budget does not pay for itself on breach losses alone. Defend the ARO before you present the ROI.

• ALE baseline: $1.22M (the same $4.88M SLE at a 25% chance a year)
• Security budget: $250K
• Controls reduce ALE by 40%: $488K reduction
• Net ROI: $488K - $250K = $238K in avoided losses

Even modest security programs deliver significant returns when measured against real breach costs. CISA's free resources can help small organizations get started without a large budget.

The ROI moves with the ARO and the reduction you claim far more than with company size, so those are the two numbers a CFO will question first.

A cybersecurity risk assessment costs $0 if you run a free government tool yourself, and a quoted price if you hire someone, because the firms that do this work for small businesses almost never publish one. Four different jobs get sold under the same name, so the IT risk assessment pricing below is split by what you are buying, with prices checked on 2026-10-15.

A vulnerability scan lists known weaknesses. A risk assessment ranks them by what they would cost you, which is the ALE number from the section above. A penetration test proves whether one of them can be used. Buying one does not get you the other two.

Run CSET first; it costs an afternoon. If someone on staff will read and act on scan results, a Nessus Professional licence adds $4,790. Ask for an outside assessment once a customer, insurer, or regulator wants an independent review, and ask every quote for its hours and scope so you can compare them line by line. Put the result next to your ALE: an assessment is worth buying when it changes which control you fund first.

How we priced this: on 2026-10-15 we read each price from the page linked in its row. The two consultant rows say "quote required" because we found no published small-business price to put there.

Holding a quote and unsure what it covers? Send it to us and we will tell you what is in it and what is missing.

When presenting to the board, use this playbook and structure the argument in three parts:

1. Baseline risk: "Our ALE, based on industry benchmarks for our size and sector, is approximately $X million per year."
2. Control effectiveness: "Our current security program, aligned with the CIS Controls and the NIST Cybersecurity Framework, reduces this by Y%, saving $Z million annually."
3. Proposed investment: "This additional $W investment targets [specific threat category] and is projected to reduce ALE by a further $V, delivering a [percentage] ROI."

Every line item maps to a threat, an ARO, an SLE, and a measurable ALE reduction, accountability your CFO can verify. No hand-waving. No fear-based selling. Just math. The NIST SP 800-30 risk assessment guide provides the formal methodology for documenting this analysis.

The IBM report measured 28 factors one at a time against the $4.88M average. Most move it by about $250K; the exception is AI and automation, compared across whole programs:

Organizations that used security AI and automation extensively paid $2.22M less per breach than those that used none, the widest gap in the study. Incident response planning on its own took $248,072 off the average. Stolen credentials took the longest to identify and contain, at 292 days, the detection gap anomaly detection tooling is built to close. Understanding where attacks originate, mapped to frameworks like MITRE ATT&CK, helps prioritize which controls deliver the greatest ALE reduction.

Understanding ALE in a spreadsheet is one thing. Making budget decisions under pressure, with a boss second-guessing you, a board demanding ROI, and threats escalating through all 18 phases of the Unified Kill Chain, is something else entirely.

Corporate Cyber Defense is an interactive simulation where you manage a security budget against real-world tactics, techniques, and procedures. Every decision has a measurable ALE impact, every dollar spent must be justified, and the CFO is always watching. It's built on the same IBM benchmarks discussed in this article.

Choose your role. Choose your difficulty. See if your budget strategy survives 18 phases of a coordinated attack.

Play Corporate Cyber Defense →

Data sourced from the IBM Cost of a Data Breach Report 2024. IBM figures are averages from 604 breached organizations studied between March 2023 and February 2024; the worked examples are our own arithmetic on them. Individual organizational risk varies based on industry, geography, security maturity, and attack surface.