Building the 2027 Security Budget: What to Fund, What to Cut and How to Defend It to the Board
A 2027 security budget that survives the board is built on the risks the board has agreed to care about, not on fear or on last year plus ten percent. What the benchmarks say, where the money should go, what to cut, and how to present a budget that is argued in tolerances rather than threats.
Cybersecurity Strategy
Security budgets have stopped growing on their own. The latest benchmark of more than 500 chief information security officers puts the median budget change at zero for the second year running, even as the attacks those budgets are meant to stop get faster and cheaper to run. A budget built on "last year plus ten percent" will not survive that conversation, and neither will one built on fear. What survives is a budget tied to the risks the board has already agreed to care about, with a clear account of what each line changes. Here is how to build one for 2027: what the benchmarks say, where the money should go, what to cut, and how to present it.
In short. Start from the risks and tolerances the board has agreed, not from the current tool list. Fund identity, detection and response, recovery, and testing, because those are where incidents are won or lost. Hold core platforms, awareness and compliance evidence steady. Cut overlapping tools, unused licences and controls nobody has tested. Use benchmarks to show you are in a sensible range, incident cost data to show what an event would cost, and regulators' own words to show that adequate budget is a board duty. Then present one page that ends with decisions, so the discussion is about how much risk the board accepts rather than how scary the threat is.
What the benchmarks say about 2026 and 2027
| Source | Finding | What it means for your case |
|---|---|---|
| IANS Research and Artico Search, 2026 Security Budget Benchmark (September 2026, 500+ CISOs) | Average budget growth 5%, median 0% for the second straight year; 55% of budgets flat or declining; security at 9.9% of IT spend, down from 10.9% in 2025; software and AI now 35% of the budget; 64% expect growth in 2027; 69% name AI for security as the top new-spend priority | Flat is the default. A request for growth needs a reason the board can see |
| IANS and Artico, 2025 report | Security budgets averaged 0.69% of revenue; only 11% of CISOs said they were adequately staffed | Revenue share is the ratio boards recognise; staffing gaps are a risk, not a wish |
| Forrester, 2027 budget planning guides (July 2026, 2,600+ decision-makers) | More than 80% expect budget increases, about one in four by 10% or more; among security leaders, trade press reports 60% expecting at least a 5% increase. Forrester's advice is to divest from technical debt and "AI pilots that lack governance, clear ownership, success criteria, or a defined path to scale" | Growth is available, but it goes to leaders who can show governance and outcomes |
| Gartner, India forecast (March 2026) | Indian end-user spending on information security of $3.4 billion in 2026, up 11.7%; security software the largest and fastest-growing segment at 12.4%; managed security services up 15.1% | Your peers are spending more; the question is whether they are spending well |
| Gartner, securing AI (August 2026) | The market for securing AI to reach almost $4.8 billion in 2027, up 68.7% on 2026 | If the business is deploying AI, securing it is a new line, not a reallocation |
| Gartner, prediction (August 2024) | "By 2027, 17% of total cyberattacks/data leaks will involve generative AI" | The 2027 budget is the first one that has to assume AI-assisted attackers as routine |
Benchmarks establish a range, not a target. A company at 6% of IT spend is not necessarily under-protected and one at 14% is not necessarily safe. What they do is answer the first question a finance director asks, which is whether the number is reasonable, so the conversation can move on to the second question, which is what it buys.
What an incident costs, in India and elsewhere
IBM's 2026 Cost of a Data Breach report puts the global average at $4.99 million, a 12% rise and a record, with organisations making extensive use of security AI and automation saving an average of $1.93 million per breach. The India edition, published in August 2026, puts the average Indian breach at ₹25.5 crore, up 15.9%, and at ₹40.9 crore in financial services. Organisations with no AI or automation took 236 days to identify and 75 to contain a breach, against 175 and 81 with extensive use, and paid ₹31.6 crore against ₹21.3 crore. Offensive security testing was the top cost reducer in the Indian data, saving an average of ₹2.47 crore, and 67% of Indian respondents planned to invest more in incident response planning and testing.
The threat side of the ledger has moved too. Verizon's 2026 Data Breach Investigations Report found 31% of breaches now start with vulnerability exploitation, ahead of stolen credentials for the first time, and ransomware present in 48%. CERT-In's incident counts, reported to Parliament in March 2026, rose from 20,41,360 in 2024 to 29,44,248 in 2025, with the banking sector alone recording 5,70,108 incidents in 2025. And in November 2026 CERT-In published a critical advisory on AI-assisted attackers calling financial firms' own payment APIs, which we cover in our analysis of the Crafty Falcon advisory.
Use these numbers carefully. The purpose is not to frighten the board into spending but to give the expected loss side of the equation some grounding, so that a control costing ₹50 lakh can be compared with the losses it reduces. The FAIR model formalises that comparison as frequency multiplied by magnitude, and NIST's SP 800-55, reissued in December 2024, is the reference for measuring whether controls work. For most boards, a simpler version suffices: for each major risk, what would it cost us, how likely is it this year, and what does this spend change about either number.
Regulators say budget is a board responsibility
In regulated sectors in India, the budget argument has an ally in the regulator's own text.
- IRDAI. The Information and Cyber Security Guidelines, version 2.0 of April 2026, list among the board's responsibilities: "Provide sufficient budget for Information and Cyber security keeping in view the current/emerging threat landscape and ensure that the budget is proportional to the organization's risk appetite."
- RBI. The 2026 cybersecurity directions require the IT strategy committee to ensure that budgetary allocations for IT, including IT security and cybersecurity, are commensurate with the institution's maturity and threat environment, and that the information security budget is determined with the current and emerging threat landscape in view. The board approves the strategies and policies.
- SEBI. The CSCRF requires that regulated entities "allocate adequate percentage of total IT budget to cybersecurity", shown "under separate budgetary head for monitoring by the Board of directors/ top-level management", with resources "defined in terms of budgetary allocation, people, and material."
- NIST CSF 2.0. Outcome GV.RR-03: "Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies." The Govern function also requires risk appetite and tolerance statements to be "established, communicated, and maintained."
- US-listed companies. The SEC's 2023 rules require a description of "the board of directors' oversight of risks from cybersecurity threats" and of management's role in assessing and managing them.
The practical use of these clauses is not to threaten the board with non-compliance. It is to frame the budget as the board's decision about its own risk appetite, which is what the regulators intend and what boards respond to.
Where the money should go
Priorities differ by organisation, but the evidence on where incidents are decided is consistent enough to give a default order.
| Fund | Why | What to ask for |
|---|---|---|
| Identity and privileged access | Identity weaknesses feature in almost 90% of Palo Alto Networks' 2026 incident investigations; most large outages start with one over-privileged account | Phishing-resistant MFA for administrators and remote access, tiered administration, removal of standing privileges, agent and service identities with scopes |
| Detection and response | The difference between an incident and a disaster is how long the attacker has; IBM's time-to-identify figures are measured in months for organisations without automation | Coverage of the logs that matter, detections validated against real attacks, out-of-hours monitoring, a response team under contract before you need it |
| Backup and recovery | Ransomware is present in 48% of breaches; the way back has to survive stolen administrator credentials | An immutable or offline copy, separate backup credentials, timed restore tests, a rebuild capability |
| Testing and validation | The top cost reducer in IBM's Indian data; 31% of breaches start with an exploitable vulnerability somebody could have found first | Penetration testing on the cadence your regulators set, with cloud and APIs in scope; exercises that test people and decisions, not only systems |
| Securing AI | A new attack surface the business is creating faster than security is reviewing it | Governance of what agents may do, testing of AI features and the tools behind them, monitoring of AI usage |
Keep steady: the core platforms you already run well, awareness training that is measured, and the compliance evidence that keeps regulators and customers satisfied. These rarely need growth, and cutting them creates problems that cost more than they save.
What to cut
A budget that only asks for more is easy to refuse. One that shows what it has already stopped spending is harder.
- Overlapping tools. An IBM Institute for Business Value and Palo Alto Networks study of 1,000 executives in January 2025 found organisations running an average of 83 security solutions from 29 vendors, with 52% saying complexity was their biggest impediment. Gartner's 2022 survey found 75% of organisations pursuing vendor consolidation, up from 29% in 2020, though only 29% expected lower licensing costs; the gain is mostly operational. List every tool, what it detects or prevents, and what else does the same thing.
- Shelfware. Licences bought for a project that ended, modules enabled but never configured, seats for people who left.
- Untested controls. A control that has never been tested is a cost without a known benefit. Test it, and either keep it with evidence or remove it.
- Pilots without owners. Forrester's advice applies to security as much as anywhere: AI pilots with no governance, ownership or success criteria are spend, not investment.
- Reports nobody reads. Monthly decks, dashboards and metrics that do not lead to a decision. Our guide to security metrics for the board covers which ones do.
A security budget optimisation review typically finds the savings to fund most of the growth the board would otherwise refuse.
Building the budget in five steps
1. Start from the risk register, not the tool list
Take the five to eight risks leadership has agreed matter most, with the tolerance the board set for each. If those do not exist, that is the first thing to fund: a business impact analysis and a risk assessment the board signs off.
2. Map every current line to a risk
Each tool, contract and role goes against the risk it reduces. Lines that map to nothing are candidates to cut. Risks with nothing against them are the gaps.
3. Price the gaps in options
For each gap, three options: do nothing and accept the risk, a minimum control, a full control. Each with a cost and what it changes about likelihood or impact. The board chooses; that is the point.
4. Check the range
Compare the total with the benchmarks as a share of IT spend and of revenue, and with what your regulator expects. Explain any deviation in a sentence.
5. Write the one page
The risks, the current position against tolerance, what the budget changes, what it cuts, the benchmark range, and the decisions needed. Everything else is an appendix.
Presenting it to the board
A Gartner survey of 330 board members published in November 2025 found that 90% of non-executive directors lacked a measure of confidence in cybersecurity value. A joint IANS, Artico and CAP Group report in March 2026 found that 95% of CISOs brief their boards regularly but only 10% influence financial decisions. The gap between presence and influence is usually the way the case is made.
- Talk about tolerance, not threats. "We are outside the tolerance you set for payment downtime, and this closes the gap" is a decision; "attackers are getting more sophisticated" is weather.
- Show what you stopped spending. Consolidation and removed shelfware demonstrate stewardship before you ask for growth.
- Give options with consequences. Boards are used to choosing between priced alternatives. A single number invites a single answer.
- Use the regulator's words once. One sentence on what IRDAI, RBI, SEBI or your sector's rule says about budget is enough; more sounds like a threat.
- Report back. Next quarter, show what the money changed, in the same measures. That is what builds the influence the surveys say is missing.
If the organisation does not have a security leader who can carry this conversation, a virtual CISO engagement is often the most cost-effective line in the whole budget; our guide to virtual CISOs explains when it fits. For the reporting structure itself, see board reporting and metrics design.
A note on India's market
DSCI's Indian Cybersecurity Product Landscape report of December 2025 counted more than 400 Indian product companies with $4.46 billion of revenue in 2025, projected to reach about $6 billion in 2026. The practical consequence for buyers is more choice, more overlap, and more sales pressure. A budget process that starts from risks rather than from vendor demonstrations is the best defence against buying a tenth tool that does what the ninth already did.
Frequently Asked Questions
Click any question to expand the answer.
QHow much should a company spend on cybersecurity?
There is no single right number. The IANS and Artico Search benchmarks put security at 9.9% of IT spend in 2026 and 10.9% in 2025, and at about 0.69% of revenue in 2025, with wide variation by sector and size. Use benchmarks to show the number is in a reasonable range, then justify it by the risks it reduces.
QAre security budgets growing in 2026 and 2027?
Slowly, if at all. The 2026 IANS and Artico Search benchmark of more than 500 CISOs found average growth of 5% but a median of zero for the second year running, with 55% of budgets flat or declining. Forrester's 2027 planning research found most technology leaders expect increases, but the money goes to leaders who can show governance and outcomes.
QWhat should a 2027 security budget prioritise?
Identity and privileged access, detection and response, backup and recovery, testing and validation, and securing the AI the business is deploying. These are where incidents are decided, and where the incident-cost data shows the largest effect.
QWhat should be cut from a security budget?
Overlapping tools, unused licences, controls that have never been tested, pilots with no owner or success criteria, and reports that lead to no decision. An IBM and Palo Alto Networks study found organisations running an average of 83 security solutions from 29 vendors, with complexity the biggest impediment.
QHow do I justify a cybersecurity budget to the board?
Tie each line to a risk the board has agreed to care about and the tolerance it set, show what the spend changes about likelihood or impact, give priced options rather than one number, show what you have already stopped spending, and report back on what the money changed. Argue in tolerances, not threats.
QWhat does a data breach cost in India?
IBM's 2026 Cost of a Data Breach study puts the average Indian breach at ₹25.5 crore, up 15.9%, and at ₹40.9 crore in financial services. Organisations making extensive use of security AI and automation paid ₹21.3 crore against ₹31.6 crore for those with none, and offensive security testing was the top cost reducer, saving ₹2.47 crore on average.
QDo regulators require a cybersecurity budget?
Several do, in their own words. IRDAI's 2026 guidelines require the board to provide sufficient budget proportional to risk appetite; RBI's 2026 directions require budgetary allocations commensurate with the threat environment; SEBI's CSCRF requires an adequate percentage of the IT budget under a separate head for board monitoring; and NIST CSF 2.0 requires resources commensurate with the risk strategy.
QHow should AI affect the 2027 security budget?
In two ways. Securing the AI the business deploys is a new line, with Gartner forecasting that market at almost $4.8 billion in 2027. And AI for security is where CISOs are directing new spend, with 69% naming it their top priority in the 2026 IANS benchmark, though Forrester warns against pilots without governance, ownership or success criteria.
QWhat is the FAIR model?
Factor Analysis of Information Risk, an Open Group standard that expresses risk as the probable frequency of a loss event multiplied by its probable magnitude. It gives a structured way to compare the cost of a control with the losses it reduces, which is the comparison a budget case needs to make.
QHow do benchmarks help if every organisation is different?
They answer the first question a finance director asks, which is whether the number is reasonable, so the discussion can move to what the money buys. A figure well outside the benchmark range needs an explanation; one inside it does not need a defence.
QShould security spend be a percentage of IT spend?
It is a useful ratio for comparison, not a target. The benchmark ratio has fallen from 10.9% to 9.9% between 2025 and 2026, partly because IT budgets grew faster. What matters is whether the risks the board cares about are inside tolerance.
QHow often should the security budget be reviewed?
Annually in the planning cycle, with a quarterly report to the board on what the money changed, in the same measures used to justify it. Regulators such as IRDAI expect the board to receive information security inputs quarterly.
Related reading
For the measures to report once the money is spent, see security metrics for the board. For setting the tolerances the budget is built on, business impact analysis and cyber resilience engineering. For the SOC line specifically, managed SOC versus in-house SOC: cost and ROI.
Sources
- IANS Research and Artico Search, 2026 Security Budget Benchmark Report.
- IANS Research and Artico Search, 2025 Security Budget Benchmark Report.
- Forrester, Forrester's 2027 budget planning guides.
- Gartner, Gartner forecasts information security spending in India to total $3.4 billion in 2026.
- Gartner, Gartner forecasts the market for securing AI will reach almost $5 billion in 2027.
- Gartner, Gartner forecasts global information security spending to grow 15% in 2025 (includes the 2027 generative AI prediction).
- Gartner, Gartner survey finds 90% of non-executive directors lack a measure of confidence in cybersecurity value.
- IBM, Cost of a Data Breach Report 2026.
- IBM India, India records its highest average cost of a data breach, 2026.
- Verizon, 2026 Data Breach Investigations Report.
- Palo Alto Networks Unit 42, 2026 Global Incident Response Report.
- IBM Institute for Business Value and Palo Alto Networks, Capturing the cybersecurity dividend.
- CSO Online, Most enterprises looking to consolidate security vendors (Gartner survey, 2022).
- IANS Research, New report reveals key gaps in board-CISO strategic dialogue on cyber risks.
- Cyril Amarchand Mangaldas, Amended cyber security guidelines for the insurance sector: key amendments (IRDAI 2026).
- Reserve Bank of India, Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026.
- NIST, Cybersecurity Framework 2.0 (CSWP 29).
- NIST, SP 800-55 Volumes 1 and 2: measurement guide for information security.
- ThePrint / PTI, Cybersecurity incidents reported to CERT-In, Lok Sabha reply (March 2026).
- DSCI, Indian Cybersecurity Product Landscape 3.0 (December 2025).
Adayptus Consulting
Executive Advisory, Adayptus
Adayptus Consulting Private Limited is a cybersecurity consultancy based in Noida, India, helping security leaders turn risk into budgets their boards approve and their auditors recognise.
On This Page
- What the benchmarks say about 2026 and 2027
- What an incident costs, in India and elsewhere
- Regulators say budget is a board responsibility
- Where the money should go
- What to cut
- Building the budget in five steps
- Presenting it to the board
- A note on India's market
- Frequently Asked Questions
- Related reading
- Sources
