How much should a small business spend on cyber security?

There is no reliable universal percentage: published rules of thumb disagree widely, so start from your risks and your obligations rather than from a benchmark. Begin with what an incident would cost you: days without systems, lost orders, restoration work, notification duties and contract penalties. Then cover the basics that protect against the most common attacks, many of which cost little: multi-factor authentication, prompt updates, endpoint protection, offline or immutable backups that you test, and a written plan of who to call. Add what customers, insurers or NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. ask you to show, such as detection, incident records and reporting. Only then compare tools, and prefer ones that publish their prices so you can budget honestly. Keep part of the budget for people: someone's time to read alerts, and an incident-response firm you can call. NetSenX publishes its plans and has a Free plan, so the cost of network detection is known before you plan.

This answer also appears, with more context, here: Budget, staff and alert noise

← All 25 questions on Budget, staff and alert noiseAll topics