# Is the next big cyber threat mis-placed security spending?
Author:  Pal Sinha, Barnali 
Author URL: https://financedigest.com/author/pal-sinha-barnali
Published: 2022-03-22
Category: TECHNOLOGY
Category URL: https://financedigest.com/category/technology
Meta Title: How to Allocate Your Cyber Security Budget Wisely
Meta Description: Discover how to allocate your IT budget effectively for cyber security, based on industry benchmarks and category breakdowns. Get insights now!
URL: https://financedigest.com/is-the-next-big-cyber-threat-mis-placed-security-spendinghtml

![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/istock-1065824694-1736815946225-compressed.jpg)

_By_ **_Brian Martin,_** _Head of Product, Strategy and Innovation,_ [_Integrity360_](https://www.integrity360.com/)

As cyberattacks continue to ramp up across all industry sectors, determining how much of the IT budget to allocate to cyber security is a calculation no finance organisation can afford to get wrong. Many businesses are upping their spend on security tools, technologies and services: research [firm Gartner forecasts that global spending on](https://www.financedigest.com/sp-global-acquires-firm-to-bolster-capability-to-track-commodity-shipments.html "S&P Global acquires firm to bolster capability to track commodity shipments") information security will jump to $170.4 billion this year, an increase from $150.4bn in 2021. According to PwC’s [2022 Global Digital Trust Insights](https://www.pwc.com/us/en/services/consulting/cybersecurity-privacy-forensics/library/global-digital-trust-insights.html) report, a quarter (26%) of executives foresee spending rises of 10% or more, three times the percentage from last year.

Increasing the [cyber security](https://www.financedigest.com/how-to-handle-cyber-security-during-mergers-and-acquisitions.html "How to Handle Cyber Security during Mergers and Acquisitions") budget is absolutely no guarantee that a business will be any better protected against threats to corporate systems and critical data, however. Allocating too little money or too much money, or spending it in the wrong areas, can all lead to the security budget becoming a cyber-threat in itself. This is because insufficient funding, wasted spend and off-target [investment will ultimately undermine the security strategy](https://www.financedigest.com/2018-it-security-predictions-methods-for-attacks-investment-areas-cybersecurity-strategies.html "2018 IT Security Predictions-Methods For Attacks, Investment Areas & Cybersecurity Strategies"), and the company’s ability to keep pace with threat actors’ tactics and regulators’ demands.

Of course, the ‘right’ amount to spend will depend on a number of variables – including the risk appetite of the organisation, the industry the company is in, the specific [threats and risks it faces](https://www.financedigest.com/3-top-digital-asset-threats-facing-your-brand-in-2017.html "3 top digital asset threats facing your brand in 2017"), how much sensitive data it processes, and the regulatory scrutiny it comes under. However, benchmarking can be a very useful approach to gauging whether enough money is being spent, and in the correct areas.

**Benchmark 1: What your peers are spending on** [cyber security.](https://www.financedigest.com/the-future-of-cyber-security.html "THE FUTURE OF CYBER SECURITY")

[Deloitte’s most recent data](https://www2.deloitte.com/us/en/insights/industry/financial-services/cybersecurity-maturity-financial-institutions-cyber-risk.html) on cyber security investment in financial services institutions shows that firms spent on average 10.9% of their overall IT budget on cyber security in 2020, up from 10.1% the previous year. Looking at organisations of a similar size to yours can also provide helpful context.

These numbers are averages, of course – and [spending can vary enormously between organisations](https://www.financedigest.com/how-giving-insights-into-card-spend-can-help-organisations-to-manage-their-business.html "How giving insights into card spend can help organisations to manage their business"). Some may well be spending considerably more, while those who spend less could simply be super-efficient and targeted in their spending, or have a perfectly legitimate higher [risk appetite](https://www.financedigest.com/u-s-dollar-climbs-to-two-year-peak-as-risk-appetite-tumbles-yuan-drops.html "U.S. dollar climbs to two-year peak as risk appetite tumbles; yuan drops"). These are all considerations that should be taken into account.

**Benchmark 2: How budget is broken down across categories.**

Examining how you allocate your budget will determine whether you get the most from your investment, and are able to effectively [protect your organisation](https://www.financedigest.com/protect-your-organisation-from-fraud.html "Protect your organisation from fraud"). Looking at the distribution of spend across categories can help a business better understand where they should assign it. According to Gartner’s data, the average company’s breakdown of a [cyber security](https://www.financedigest.com/why-preparation-for-new-swift-cyber-security-standards-needs-to-start-now.html "‘Why preparation for new SWIFT cyber security standards needs to start now’") budget is:

- **Operational infrastructure security** **(50%)**: this covers general [network security](https://www.financedigest.com/new-demands-on-network-security.html "NEW DEMANDS ON NETWORK SECURITY"), Identity and Access Management (IAM), Privilege Access Management (PAM), endpoint security and all the activities involved in data security.

Vulnerability management and security monitoring **(20%)**: costs relating to vulnerability assessments and scanning, active discovery and remediation of vulnerabilities via ticketing, Security Operations Centre (SOC) performance and Security Information and Event Management (SIEM).- **Governance, Risk and Compliance (GR&C)** **(16%)**: this relates to the active role involved in [securing the company’s data](https://www.financedigest.com/the-challenge-of-keeping-data-secure-why-in-house-security-isnt-enough.html "The challenge of keeping data secure: why in-house security isn’t enough") via an approved and certified framework, as well as complying with industry-specific regulations.
- [**Application security** style=”font-weight: 400;”> **(14%)**: a combination of penetration testing practices geared towards improving hardware, software and employees from a running list of evolving threats.](https://www.financedigest.com/application-security-in-the-finance-industry-what-you-should-know.html "Application Security in the Finance Industry: What You Should Know")
 [Application Security in the Finance Industry: What You Should Know](https://www.financedigest.com/application-security-in-the-finance-industry-what-you-should-know.html "Application Security in the Finance Industry: What You Should Know")

[These categories form the core of most cyber security strategies because they](https://www.financedigest.com/application-security-in-the-finance-industry-what-you-should-know.html "Application Security in the Finance Industry: What You Should Know") [enable a business to analyse vulnerabilities and threats](https://www.financedigest.com/forescout-and-fireeye-expand-partnership-enabling-faster-response-to-cybersecurity-threats.html "FORESCOUT AND FIREEYE EXPAND PARTNERSHIP, ENABLING FASTER RESPONSE TO CYBERSECURITY THREATS"), protect themselves from attacks, and then detect, respond to and recover from any data breach or loss. While benchmarking provides a useful guide, the proportion of spend will vary from one business or another. Conducting a gap analysis, to assess your organisation’s [cyber security maturity and identify specific potential threats](https://www.financedigest.com/using-threat-intelligence-to-minimise-cyber-insurance-risks.html "Using Threat Intelligence to Minimise Cyber Insurance Risks"), will help to identify the specific areas that will produce the maximum impact for data security.

**Benchmark 3: The amount of spend allocated per employee.**

Another indicator of how much your business should be [spending on security](https://www.financedigest.com/infosecurity-europe-agenda-spotlights-innovation-as-security-leaders-address-cybersecurity-spend-in-the-face-of-economic-headwinds.html "Infosecurity Europe agenda spotlights innovation as security leaders address cybersecurity spend in the face of economic headwinds") can come from how much it allocates per employee. This [accounts for the specific size of the business](https://www.financedigest.com/making-your-accountant-an-invaluable-asset-to-your-business.html "MAKING YOUR ACCOUNTANT AN INVALUABLE ASSET TO YOUR BUSINESS"), providing a good baseline from which to derive what the overall budget should be.

According to [Deloitte](https://www2.deloitte.com/us/en/insights/industry/financial-services/cybersecurity-maturity-financial-institutions-cyber-risk.html)’s research, the average annual security spending per employee across all categories increased from $2,337 in 2019 to $2,691 in 2020.

**Benchmark 4: How much is spent as a percentage of revenue**

Another [way that companies can use benchmarks to set security](https://www.financedigest.com/5-ways-to-protect-your-company-from-cyber-security-threats.html "5 Ways to Protect Your Company From Cyber Security Threats") spending best practices is through the lens of revenue. Deloitte’s study found that on average financial services companies spent 0.48% of their total revenue on [cyber security](https://www.financedigest.com/uks-morgan-advanced-materials-reports-cyber-security-incident-on-its-network.html "UK’s Morgan Advanced Materials reports cyber security incident on its network") in 2020, compared with 0.34% the previous year.

While looking at average benchmarks provides valuable insight this will, of course, not give the full picture. A business can overspend and still have gaps, or it could spend well below the industry average and have solid protection against the latest threats. Ultimately, expanding or downsizing budgets while figuring out where they’re most effectively spent is a [balancing act](https://www.financedigest.com/fintech-and-compliance-managing-the-eternal-balancing-act.html "Fintech and compliance: Managing the eternal balancing act") – and one which is unique to each individual company. Each organisation must carry out its own assessment to determine how much it ought to be spending, and shift investment around to target the priority areas identified.

This assessment should take into account the up-and-coming threats and [major emerging trends that are expected to impact](https://www.financedigest.com/4-trends-that-will-have-a-major-impact-on-private-equity-in-2021.html "4 Trends that will have a major impact on private equity in 2021") the business and the sector. You also need to [understand your risk](https://www.financedigest.com/how-data-visualisation-is-helping-the-insurance-sector-understand-environmental-risks.html "How data visualisation is helping the insurance sector understand environmental risks") profile and appetite, and factor that into the thought process.

To focus [spend in the optimal areas and eliminate waste](https://www.financedigest.com/paid-search-advertising-how-to-identify-wasted-spending.html "Paid search advertising: how to identify wasted spending"), it’s well worth carrying out an audit of existing security technologies and capabilities, to establish what you already have that may be under-utilised. Perhaps an existing tool can satisfy a new requirement without needing to lay out on an entirely new solution. Check how much of your current spend is in support of manual processes, too, and investigate whether introducing automation – for example, Security Orchestration, Automation and Response (SOAR) – could [reduce costs](https://www.financedigest.com/finnair-to-cut-costs-reduce-fleet-to-return-profitable.html "Finnair to cut costs, reduce fleet to return profitable") while improving overall security.

Tracking your spend against the average benchmarks for your industry – and beyond – will provide valuable indicators as to whether or not your current cyber security [budget and strategy will provide sufficient return on investment](https://www.financedigest.com/uk-budget-fashion-chain-primark-to-invest-140-million-stg-in-stores.html "UK budget fashion chain Primark to invest 140 million stg in stores"). Looking at your peers’ spend in terms of IT budget, employee headcount, [company revenue](https://www.financedigest.com/generic-oncology-drugs-market-2021-global-leading-companies-analysis-revenue-trends-and-forecasts-2027.html "Generic Oncology Drugs Market 2021 Global Leading Companies Analysis, Revenue, Trends and Forecasts 2027") and categories won’t give you an exhaustive understanding of the best direction to take, but it may well tell a story that warrants further analysis.


---
This blog is powered by Superblog. Visit https://superblog.ai to know more.
---