How to Budget for Cyber: A Return-on-Security-Investment Method
This is for CFOs, CEOs, and founders who have to set a security budget and defend it. The method is simple: estimate what your most likely security incidents would cost, estimate how much each proposed control reduces that cost, and fund the controls that remove the most risk per dollar. The inputs are estimates, so use the result to rank choices and expect to revisit the numbers.
Why not just copy a benchmark?
Benchmarks such as security spending as a percentage of IT budget or revenue are easy to find, and they vary widely by industry and by survey. In 2025, IANS Research and Artico Search reported that security budgets averaged 10.9 percent of IT spend, down from 11.9 percent the year before, with smaller companies generally devoting a larger share than large ones. Benchmarks tell you what other companies spend. They say nothing about your risks, your customers' requirements, or what you already have in place. Use them as a sanity check at the end, if at all.
What is return on security investment?
Return on security investment, or ROSI, adapts the standard ROI formula to loss prevention. ENISA, the EU's cybersecurity agency, lays it out in its paper Introduction to Return on Security Investment.
The core idea is annual loss expectancy: what a type of incident costs each time it happens, multiplied by how often you expect it in a year. ROSI is the reduction in annual loss expectancy a control delivers, minus the control's cost, divided by the control's cost. A positive result means the control is expected to prevent more loss than it costs. ENISA itself warns that these estimates are easy to bias, which is why the assumptions matter as much as the answer.
How do you run the method?
- List your top five to ten loss scenarios in business terms, such as ransomware halting operations, a breach of customer data, or payment fraud through a compromised email account.
- For each scenario, estimate a range for the cost of one event (downtime, recovery, legal, lost customers) and how often it might happen in a year. Use your own history, input from your insurer, and expert judgment.
- List the controls that would reduce each scenario, with their full annual cost, including staff time and ongoing licenses.
- Estimate how much each control reduces frequency, impact, or both.
- Calculate ROSI for each control and rank them.
- Fund from the top of the list until the returns flatten or the budget runs out.
What does that look like with numbers?
Here is a hypothetical example, for illustration only. Suppose you estimate a ransomware event would cost $2 million and has roughly a 20 percent chance of happening in a given year. Annual loss expectancy is $400,000. A package of immutable backups (copies that cannot be altered or deleted) and endpoint detection costs $80,000 a year and, you estimate, cuts that expected loss to $120,000. The reduction is $280,000. ROSI is ($280,000 minus $80,000) divided by $80,000, or 2.5. Put simply, you expect $2.50 of avoided loss for every dollar spent, after covering the cost.
Change the assumptions and the answer moves. That is useful. The conversation about assumptions is where the real budgeting happens.
Is there a ceiling on how much to spend?
A useful reference comes from economists Lawrence Gordon and Martin Loeb. Their 2002 paper, The Economics of Information Security Investment, found that under their model's assumptions, the best investment to protect a given set of information generally does not exceed about 37 percent (1/e) of the expected loss. Treat it as a rough check against overspending on any single risk. It is a model with assumptions, and it applies scenario by scenario.
What does the model miss?
Some spending is not optional. If your largest customers require SOC 2, or a regulator requires specific controls, fund those as a cost of doing business. The same goes for basic hygiene such as multi-factor authentication and patching, which is cheap enough that a detailed calculation wastes time. Put these in a baseline budget, then use ROSI to decide how to spend what remains.
Damage to reputation is also hard to price. Include it as a range if you can, and say plainly where you are guessing.
How do you present the budget?
Show the CFO and the board the scenarios, the assumptions, and the ranked list, with a clear line between what you recommend funding now and what you recommend deferring. The same approach works in a board cyber briefing: risk in dollars, one recommendation, and honest ranges.
Takeaway: fund security the way you fund anything else, by estimating what each dollar prevents and spending on the best value first.
If you are building next year's security budget, request a call with AZEN and we will help you build the model.