Cyber budgets fail to meet expectations despite 3% increase on previous year

• In 2023, the average cyber budget for large organisations grew by 3.1% YOY to USD 27.10 million
• The increase falls below the 5% rise anticipated by Senior IT professionals and their C-suites cited in S-RM’s Cyber Security Insights Report 2023
• Nearly a third (31%) of organisations say lack of budget is a key cyber security challenge

16 November 2023 – LONDON – S-RM, a leading global intelligence and cyber security consultancy, has today published its Cyber Security Insights Report 2023, which reveals that this year’s cyber budgets for large organisations are falling short of expectations.

In 2023, the average cyber budgets grew to USD 27.1 million, up 3.1% from USD 26.30 million in 2022. S-RM’s research shows that senior IT professionals and their c-suites had anticipated a more substantial increase of 5%, which would have seen budgets reach USD 27.6 million.

The appetite for more budget comes after a year of rising operational costs – as a result of wider economic turbulence – and a growing cyber threat following rapid advancements in generative AI. Cyber security departments want more budget to upskill employees (42%) and recruit additional skilled personnel (41%) to accommodate this rising threat.

On average, cyber budgets make up a quarter (25%) of an organisation's overall IT budget, marking a 1% decrease in share from 2022. This allocation varies across sectors, with Retail being the most generous (28%) and Energy & Utilities allocating the least (18%) towards tackling cyber threats.

Navigating tightened purse strings

Lack of budget was cited as a key challenge by nearly one third (31%) of organisations. To navigate this, cyber security teams have been prioritising spend in the most ‘value for money’ areas. For the third consecutive year, investment in cyber technology topped the list, though fewer organisations highlighted technology as good value for money in 2023 (49%) than in 2022 (58%).

This dip can be attributed to a growing awareness that alongside cyber security technology, organisations need to invest in governance and personnel to effectively enable and manage new tech. This is a view more prevalent among IT professionals charged with implementing cyber tech solutions, with only 43% citing technology as ‘high value for money’ compared to 56% of C-suite executives. The findings reflect a misalignment of expectations between the operators of cyber technologies, and those a step removed from their day-to-day applications.

Organisations are adopting several other strategies to manage cyber security with restricted budgets:

• IT and security optimisation - Identifying cost reduction opportunities by making existing processes more efficient to allocate budget for more critical initiatives.
• Future-focused investment - Investing now in security initiatives for long-term cost savings.
• Outsourcing - Contracting out IT and security functions to Managed Service Security Providers (MSSPs) or virtual Chief Information Security Officers (vCISOs).

Jamie Smith, Head of Cyber Security at S-RM, said:

It’s reassuring that cyber security budgets are still rising in these challenging times, but this level of increase is simply not enough to tackle the growing cyber threat. This year’s increase has failed to meet the expectations of cyber teams and reveals that cyber security may be taking a back seat as its share of the overall IT budget declines.” 

Navigating ongoing skill shortages and investing in training and development of teams comes at a cost, but cyber professionals are not receiving the budget they need to deliver on these critical initiatives. Organisations will have to continue being cautious with cyber security spend, identifying those ‘value for money’ areas that will enable them to manage emerging cyber threats with tightened purse strings.”