Security Basics 04｜How much should a security budget be: start by asking what one bad day costs

When someone suggests you should be applying regular updates, adding off-site backups, or retaining someone to look after the system, your first question is a practical one: how much is a reasonable amount to spend?

If you go and ask what your peers spend, or look up what percentage of revenue enterprises allocate to security, the figure you get may not help you. A wholesaler taking orders on paper and by phone loses a few enquiry emails when the website is down for a day. An online retailer running on digital ads and online checkout loses a full day of ad spend and a set of orders that never come back when the site is down for one afternoon. Two companies of the same size can have completely different tolerances for downtime. The UK's National Cyber Security Centre (NCSC) states it at the outset of its 10 Steps to Cyber Security: Risk management guidance: security risk management starts with being clear about what your organisation does and what it cares about most, so resources concentrate on what genuinely matters to the business.

This is the fourth piece in our security basics series. Having covered how to ask about versions in Security Basics 01｜An advisory just landed: how do you know whether it affects you, this one is not technical at all. It works one sum with you: not inferring from what others spend, but deriving from what one bad day costs you.

Why what your peers spend cannot produce your number

When you buy insurance, the sum insured follows what your building is worth and what rebuilding would cost after a fire — not which policy your neighbour bought. System security and maintenance work the same way.

In How Much Does a System Cost to Maintain Every Month: Three Pricing Structures Explained we unpacked why asking "how much per month" rarely yields a standard answer — three of the variables behind it are known only to you:

• Whether your business stops when this system is down for a day: a corporate brochure page down for a day costs nothing much; a system customers order through, a shop checks out through, or a factory schedules with, down for a day is a loss you can count.
• How long you can wait for someone to deal with it: "fix it next week when there is time" and "someone has to pick it up within one working day" correspond to entirely different staffing arrangements.
• Whether the data inside can be recreated if lost: code can be rewritten. If what it holds is years of accumulated customer records and transaction history, losing it leaves no option to start again.

Convert those three into money and your budget ceiling surfaces on its own.

First, the left-hand sum: the three costs of one bad day

The Hidden Cost of No Maintenance: One Outage, One Breach, One System You Can't Change made the point that saving the maintenance fee is not a real saving — it trades a predictable small outlay for an unpredictable large one. Take a sheet of paper and break the cost of one day of downtime or one incident into these three sums you can calculate yourself:

• Sum one: the visible loss of trade and ad spend. Write down the company's normal online revenue for one day; if digital ads were running that day, add the day's ad budget burned for nothing. This is the most conservative floor — it does not yet count the prospective customers who hit a site that would not open and never came back.
• Sum two: the staff cost of colleagues idling and re-entering data afterwards. If internal operations, ordering, reconciliation or customer service run on this system, how many colleagues are forced to stop during that day, fall back to paper, and then spend twice as long the next day entering it all back in one record at a time? Multiply the number of people affected by their daily wage, and that is salary you paid for nothing.
• Sum three: the premium for emergency help and the time to clean up. With nobody normally responsible, finding an outside engineer on the day means they must first spend time getting to know a system they have never seen, and an emergency quote is always higher than routine work. If customer data leaked, add the time you personally spend explaining to customers one call at a time, handling complaints and establishing the cause.

Add those three and you have your cost per day of incident. And do not forget: with nobody looking after it regularly and no backup to hand, the time from noticing the problem to finding someone, establishing the cause and fixing it completely may run well past one day.

Then the right-hand sum: four steps to derive a reasonable monthly budget

With a cost per day of incident, you no longer have to guess the budget by feel. Four steps produce your company's reasonable range:

The logic is simple: as The Hidden Cost of No Maintenance: One Outage, One Breach, One System You Can't Change put it, take the total loss from one incident, divide it by the number of months you intend to "save" for, and compare that figure with the monthly maintenance fee. If the monthly fee is far smaller than that figure, the budget is not an expense — it is a good trade that keeps the disaster outside the door.

When the budget is limited, what order to spend in

If the sum leaves you with a limited budget that cannot cover every protection at once, do not cut everything evenly. Spend in the order of what saves you most on the day:

• First priority: off-site backups and a restore rehearsal. The cheapest thing on the list and the one that saves your life. Does Your AI Product Have Backups: The Minimum Standard for Database and Files is explicit: with a daily automatic backup kept on a different host or provider, even the worst ransomware or destruction does not put you back at zero.
• Second priority: regular security updates and closing the spare doors. Patch the known vulnerabilities, shut down the unused old sites and the accounts of people who have left, so automated scanning attacks cannot get in.
• Third priority: basic liveness and anomaly monitoring. As Who Knows First When Your Site Goes Down says, make sure that when the site goes down or the disk is nearly full, whoever looks after the system hears about it before your customers do.

In How Much Does a System Cost to Maintain Every Month: Three Pricing Structures Explained and What's Included in Your Maintenance Fee, and What Isn't, we put these three alongside day-to-day debugging in the same maintenance package, precisely because missing any one of them means nobody is genuinely looking after the system.

Once the sum is done

A security and maintenance budget is not a bottomless technical cost. It is an owner's arithmetic problem. Three things to take away:

• Do not ask what others spend. Ask what your own system costs you in revenue lost for a day, staff idling, and emergency help.
• Spread the one-incident loss you calculated across the months, compare it with the fixed basic maintenance fee, and you will know whether saving that money now is a good deal.
• Every unit of budget should buy a clear responsibility: how fast the response, how often the security updates, where the backups live — all written down in black and white.

NT IT builds custom systems and now maintains AI systems long term. If you have finished the left-hand table and want to know how much attention your system actually needs each month, and which pieces are missing now, a system health check is a place to start: it covers code, database, deployment and security, and What a System Health Check Actually Looks At: Code, Database, Deployment, Security describes the whole of it. Book a system health check