How Much Should a Small Business Spend on Cybersecurity?

May 6, 2026 · Kapa Canada

There’s no magic percentage that answers “how much should we spend on cybersecurity?” — and anyone who gives you one without knowing your business is guessing. But that doesn’t mean you’re stuck. Here’s a practical way to set a security budget you can actually defend.

Why “a percentage of IT spend” isn’t enough

A common rule of thumb is to spend some portion of your IT budget on security. It’s a useful starting reference, but it has a flaw: it ties your security budget to your IT budget rather than to your actual risk. A business handling sensitive customer data needs more protection than its IT spend alone would suggest.

Start with risk, not a number

Instead of starting with a percentage, start with two questions:

What would it cost us to be down? Estimate a day — or a week — without your core systems: lost revenue, idle staff, missed commitments.
What are we protecting? Customer records, payment data, intellectual property, regulated personal information. The more sensitive the data, the higher the stakes.

Those answers turn an abstract question into a concrete one: how much is it worth to avoid that outcome?

Spend on the fundamentals first

The good news for smaller businesses: most of the protection comes from a relatively small set of essentials. Fund these before anything fancy:

Identity and access — multi-factor authentication everywhere, and strong password practices.
Backups — tested, recent, and kept offline or immutable so ransomware can’t reach them.
Endpoint protection — modern detection on every laptop and server.
Monitoring — someone or something actually watching for trouble, around the clock.
People — regular, realistic security awareness training.

These give the highest return per dollar. Advanced tooling matters later — but it’s wasted money if the basics aren’t solid.

The cost of underspending

Underspending rarely shows up as a line item — it shows up as an incident. A single ransomware attack or serious breach can cost a small business more than several years of a sensible security budget, between downtime, recovery, lost customers, and regulatory fallout. Security spending is best understood as risk reduction, not overhead.

A simple approach

For most small and mid-sized businesses, the practical path is:

Cover the fundamentals above — treat them as non-negotiable.
Decide whether to build that in-house or partner with a managed provider. For most SMBs, partnering is more cost-effective — see our breakdown of managed security costs.
Revisit the budget yearly, or whenever the business changes meaningfully.