Budget planning: determining your security spend

This article offers practical guidance for right-sizing cybersecurity budgets by identifying an organization’s posture (e.g., Security as an enabler, Risk-based, Security as a requirement, Yet another piece of IT, Reactionary), considering typical spend ranges (1% to 13% of IT budget), focusing on outcome-driven priorities, and avoiding post-breach panic spending; it advocates scenario-based planning, reviewing past results, and aligning expectations, maturity, capabilities, and threat models to determine the investment that delivers desired outcomes.