How Much Should You Spend On Cybersecurity?
By: Emma White
Tags: Cybersecurity, Investment, Business Expenses

How Much Should You Spend On Cybersecurity?

How much should you invest in cybersecurity? How can you estimate that number, anyway?

In today’s business landscape, all companies are exposed to damaging cyberattacks that could disrupt their entire operations. Regardless of industry or size, virtually anyone doing business is vulnerable to an attack by malicious agents that could translate into monetary, informational, intellectual, and reputational losses.

What’s more — the likelihood of a cyberattack happening to a particular business is very high, to the point where a recent World Economic Forum survey put cyberattacks as the second most concerning risk for doing business globally over the next decade. With such a scenario, it’s hard to argue with the idea that startups, medium-sized businesses, and enterprises all need to invest in cybersecurity practices.

Of course, that raises the question: how much should you invest in cybersecurity? How can you estimate that number, anyway? Those are very valid questions that don’t have straightforward answers. The best way to know how much you should be spending is by learning a little more about the current cybersecurity landscape and the potential costs of an attack. Only after understanding those things will you be prepared to budget for cybersecurity.

Cybersecurity Today

Recent research by Accenture highlights that cyber resilience is on the rise, which means that most organizations are getting better at defending themselves from cyberattacks. While that is a vast improvement from previous years, it doesn’t mean that cyberattacks are gone but that attackers have now shifted their focus to indirect targets, mainly third parties in your supply chain. That means that there are more vulnerability points to look out for, even if they aren’t yours.

And though the overall situation is better today than some time ago, that also doesn’t mean that all organizations are equally protected against cyberattacks. In fact, aside from an elite group of resilient companies that make up 17% of the total, the rest are average performers when it comes to cybersecurity (they are performing better, mind you, but they still have room for improvement in their efforts).

That majority has to deal with rising costs in security solutions that many times offer low detection rates. Thus, when an attack actually occurs, they end up catching up with the innovation displayed by the attackers themselves. The elite group, on the other hand, shows a better understanding of protecting themselves, which is rooted in their investments in three key technologies: artificial intelligence, machine learning, and robotic automation.

The executives that participated in Accenture’s research now see those investments in cutting edge technologies as the key to becoming resilient enough to face direct cyberattacks, a must to build solid foundations that allow them to keep up the pace with the new developments in cyberattacks. The take is also great insight for you, as it provides you with a window on where you should be focusing your cybersecurity efforts: developing innovative technologies and hiring trustworthy partners.

How Much Does a Data Breach Cost?

This is another crucial factor to define how much you’ll spend on cybersecurity. The reason is fairly evident — by learning how much does a data breach cost, you’ll understand the need for investments that, without a context, might end up seeming steep or too high-priced. And while you might argue that the costs can significantly vary from a cyberattack to the next one, there’s something that can’t be contested: all breaches are costly.

How costly? Well, according to IBM’s 2020 Cost of a Data Breach Report, the average cyberattack costs a whopping USD 3.86 million. Naturally, that number stems from a series of factors and might be more applicable to big companies and enterprises. However, that doesn’t mean that smaller businesses don’t suffer as much because costs are lower (in absolute terms). In fact, breaches cost far more to smaller businesses because the final cost represents a bigger portion of their revenue (when compared to large businesses).

Another thing to keep in mind when considering the costs of a data breach is the time you need to recover from it. The same IBM report found out that it takes an average of 280 days to identify and contain a breach. That’s more than 9 months’ worth of breach-related issues that continue disrupting your daily operations and undermining your business.

As if that wasn’t enough, there are also other costs that might not be immediately apparent but that will pop up after a data breach. Some of the most important direct ones include:

Money theft

Remediation efforts

Compliance fines

Legal fees

Public relation fees

Compensation for affected parties

Increase in insurance premium

And that’s without considering the indirect costs you might end up paying and that are harder to quantify, such as downtime, loss of customers, loss of intellectual property, and branding and reputation damage.

You should take all of those things into account to fully calculate the cost of any breach you might suffer but the immediate takeaway is clear: a breach is never cheap.

How Much Should You Spend on Cybersecurity?

The sections above should already paint a clearer picture as to where we are heading here — you’ll have to invest a considerable part of your budget in cybersecurity efforts to face modern threats. Though it’s impossible to say how large a portion, you can get a rough estimate by considering key factors, including:

Your particular industry

Your company’s size

Regulatory framework and compliance mandates impacting your company

Your data collection practices (how much information you gather and how sensitive that information actually is)

Partnerships and your position within a supply chain

If you have already budgeted for cybersecurity, you should take into account your past performance and identify vulnerabilities (both known and perceived) to create a strategic plan to patch them up. That will surely provide you a bridge to a more realistic budget.

If you, on the contrary, have never created a cybersecurity budget before, then you’ll have to do some extra work. You should start by taking a deep look into the factors above to calculate the risk you’re exposed to. Adding up the potential fees, fines, and compensations you would have to pay if breached can take you closer to a definitive number.

That doesn’t mean you need to pay all your cybersecurity strategy upfront. You can come up with a plan that gradually increases your investment in security over a period of time. It doesn’t make much sense to invest in the latest AI-driven algorithms to thwart attacks if your staff isn’t trained in the best cybersecurity practices. It will take some analysis from you to identify your highest priorities and balance them with your current budget. Cybersecurity, after all, is an ongoing effort, not a one-off.

There’s a couple of other things you should take into account. First, that cybersecurity isn’t just about the money you spend but rather about the general commitment to security by your entire company, from executives to employees. All within your organization have to be on the same page about the importance of cybersecurity, as the entire company’s staff has to be vigilant about it on a daily basis.

Second, there’s no amount of money that can guarantee 100% protection against attacks. Even if you have the most sophisticated systems in the world and the most trained staff, you can suffer an attack through a third party vendor that hasn’t been as careful. That should highlight the importance of instituting a vetting process when looking for partners like outsourced accounting teams, nearshore development companies, and marketing agencies, to name a few. “You’re as strong as your weakest link” is a tired saying but that doesn’t make it less true.

By keeping all of those things you might reach a clearer understanding of how much money you should be spending on cybersecurity.