How much should you budget for IT security in 2025
To budget for IT security in 2025, list the protections your business needs, price each one the way it is actually billed, and then set aside a reserve for the problems you cannot predict. That gives you a number you can defend to an owner, a bank, or your accountant. A percentage of revenue or a figure copied from a competitor tells you very little about your own risk.
Start with a list of what needs protecting
Before you can price anything, write down what the business runs on. Most small and mid-sized companies have a short list: email, file storage, laptops and phones, a few line-of-business apps, and the accounts that move money. Each of these needs protection, and each protection has a cost.
Go through the list and ask three questions about each item. Who can get into it? What happens if it goes down for a day? What would it cost to rebuild it from scratch? The answers show you where to spend first. Email and the bank login usually come first, because a lot of attacks start there.
Keep the list short. Five things you have actually decided to protect are more useful than twelve things you could theoretically protect.
Price each item the way it is billed
Security costs come in a few shapes, and it helps to sort them before you add anything up.
- Per-user subscriptions. Multi-factor sign-in, email filtering, and device management are usually billed per person or per device each month. Multiply the monthly price by headcount, then by twelve.
- Fixed-price services. A one-off review, a policy write-up, or a configuration project is a single quote. Get it in writing before you commit.
- Ongoing support. Some providers charge a monthly retainer that covers monitoring, patching, and help desk. Compare that against what you would pay someone to do the same work when something breaks.
- Hardware and licences. Laptops that cannot run current security software and licences that expire are easy to forget. Put them on the list with their renewal dates.
When you get quotes, ask every provider to price the same scope. One may include monitoring and another may not, and the cheaper quote is often the one that leaves out the part you will end up needing.
Add a reserve for incidents
Even well-run businesses have security incidents. A phishing email captures a password, a laptop goes missing, or a supplier's account is used to send a fake invoice. The cost of one of these is rarely the tool you did not buy. It is the hours spent working out what happened, the outside help, and the time staff spend unable to work.
Set aside a reserve for this. Keep a fixed sum in the budget that you can spend without asking for approval, and size it so that one bad week would not blow the whole year's figure. If you cannot estimate that yet, start with the cost of two or three days of outside help at the rate a provider quotes you, then raise it once you know how often things go wrong.
Also check whether you already have cover. Some business insurance policies include cyber cover, and some payment arrangements require specific protections to be in place. Read the wording before you assume either way.
Put the number together
Once the list is priced and the reserve is set, total the subscriptions and services for twelve months, add the hardware and licence renewals, and then add the reserve. That is your 2025 security budget. Write it down with a line for each item so anyone reading it can see what the money is for.
Then test it against two things. First, is every line something you decided to protect, and does the spend match that decision? Second, does the total fit inside what the business can absorb in a bad year? If it does not, trim the less important items rather than the reserve, because the reserve is what keeps one incident from becoming a crisis.
Review the figure every quarter. Headcount changes, new software gets added, and prices go up. A budget set in January and never revisited will be wrong by summer.
What to do next
This week, write your list of what needs protecting, then collect two or three written quotes against the same scope. If you want help pricing the list or checking that nothing important is missing, contact Tech Parachute and describe your setup in a few lines. A short conversation at this stage usually shows where the money should go.