# How much should a small business spend on cyber security?

There is no reliable universal percentage: published rules of thumb disagree widely, so start from your risks and your obligations rather than from a benchmark. Begin with what an incident would cost you: days without systems, lost orders, restoration work, notification duties and contract penalties. Then cover the basics that protect against the most common attacks, many of which cost little: multi-factor authentication, prompt updates, endpoint protection, offline or immutable backups that you test, and a written plan of who to call. Add what customers, insurers or NIS2 ask you to show, such as detection, incident records and reporting. Only then compare tools, and prefer ones that publish their prices so you can budget honestly. Keep part of the budget for people: someone's time to read alerts, and an incident-response firm you can call. NetSenX publishes its plans and has a Free plan, so the cost of network detection is known before you plan.

FAQ: [Budget, staff and alert noise](https://netsenx.com/en/faq/budget) · https://netsenx.com/en/faq/how-much-should-a-small-business-spend-on-cyber-security

## Read next

- https://netsenx.com/en/pricing
- https://netsenx.com/en/ndr-for-small-business

## Related questions

- [What security spending should a small company never cut?](https://netsenx.com/en/faq/what-security-spending-should-a-small-company-never-cut)
- [How do I calculate the cost of one day of IT downtime?](https://netsenx.com/en/faq/how-to-calculate-the-cost-of-one-day-of-it-downtime)
- [How do I justify a security tool to management?](https://netsenx.com/en/faq/how-to-justify-a-security-tool-to-management)
- [How much does network detection and response cost for a 50-person company?](https://netsenx.com/en/faq/how-much-does-ndr-cost-for-a-50-person-company)
- [How much does NDR cost for a 200-person company?](https://netsenx.com/en/faq/how-much-does-ndr-cost-for-a-200-person-company)