How much should a small business spend on cybersecurity?
Short answer
There is no reliable universal percentage. Base the budget on what you need to protect and what an outage would cost you: start with free or already-paid controls (MFA, updates, built-in security features of your email and devices), then spend on backups, endpoint protection and training.
The details
Many security features are already included in business email and productivity subscriptions but left switched off. A short review of these settings is often the highest-value first step. When comparing paid services, ask what specific risk each one reduces.
Terms explained
- Risk assessment
- A cybersecurity risk assessment identifies assets, threats and weaknesses, estimates likelihood and impact, and prioritizes how to treat each risk.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
Sources
Related questions
- Where should a small business start with cybersecurity?
- Are small businesses really targeted by hackers?
- How do I train employees on cybersecurity without boring them?
- What security policies does a small business need?
- What is cyber insurance and does a small business need it?
- How do I secure Microsoft 365 or Google Workspace for a small business?
Related Guides
GuideSmall Business Security
10 Small Business Cybersecurity Tips to Reduce Risk Fast
Protect your company with ten practical small business cybersecurity tips. Implement MFA, patch software, secure Wi-Fi, and build backups that work.
Read more GuideSmall Business Security
Small Business Cybersecurity Checklist: The Core Controls
A practical small business cybersecurity checklist covering access controls, patching, backups, encryption, and network defense to secure your business.
Read more GuideSmall Business Security
Business Email Compromise: How It Works and How to Stop It
Learn how business email compromise attacks target finance teams and discover concrete controls, verification rules, and policies to protect your company.
Read more GuideSmall Business Security
How to Implement Ransomware Prevention in a Small Business
Learn practical ransomware prevention for small businesses. Protect devices, configure offline backups, secure access, and build an effective defense plan.
Read more