Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Cybersecurity affordability is a real pressure for many small businesses and security teams, but the available surveys do not show a universal crisis across all organizations. ISC2’s 2025 workforce study found budget and staffing constraints alongside signs that financial pressure had leveled off; a separate survey of US small businesses found cost was preventing many from upgrading security tools.
What the surveys say about cybersecurity budgets
ISC2’s annual studies ask cybersecurity practitioners and decision-makers about conditions at their organizations. In its 2024 study, 37% of respondents said their organizations had experienced cybersecurity budget cuts in 2024, up from 30% reporting cuts in 2023. In the 2025 study, 36% reported budget cuts. ISC2 characterized the pressure as leveling off, not as having disappeared.
As an Amazon Associate I earn from qualifying purchases.
Those figures describe respondents’ reports, not a census of employers or a measure of the dollar amount cut. They indicate that constrained budgets are common in the surveyed workforce, but do not establish how much a typical organization spends or what it should spend.
Why small businesses can face a sharper affordability problem
A commissioned CrowdStrike survey fielded in February and March 2025 asked 291 US small-business professionals at organizations with 1–249 employees about cybersecurity. Two-thirds said cost prevented their organization from upgrading security tools, while 7% considered their current cybersecurity budget fully sufficient. The result points to a concrete affordability barrier among those respondents; it should not be generalized to every small business or to businesses outside the United States.
#1 Best Overall
This survey measures small-business professionals’ reported experience, while ISC2’s workforce studies cover cybersecurity practitioners and decision-makers across multiple regions. Their percentages answer different questions in different populations, so they should not be combined into one estimate of how many organizations worldwide cannot afford security.
Budget is only part of the capacity problem
ISC2’s 2025 respondents also reported limits on hiring and skills. In that study, 39% said their organizations had hiring freezes and 24% reported cybersecurity layoffs. These are survey responses, not a count of employers or a measure of the number of jobs lost.
- 33% said their organization lacked the budget to staff cybersecurity teams adequately.
- 29% said it could not afford to hire people with the skills it needed.
- 95% reported at least one cybersecurity skills need, and 59% described those needs as critical or significant.
Headcount and skills are related but distinct. A team may have too few people, lack particular capabilities, or face both problems. The 2024 ISC2 study’s workforce-gap estimate is a proprietary measure of the gap, not an estimate of current job openings.
Recommended Free Tools
Can a small business manage security without a dedicated team?
Some organizations do not have a dedicated internal risk-management function. CISA’s May 23, 2023 fact sheet on small and medium-sized businesses’ ICT supply-chain risk provides that context and advises integrating cybersecurity into business decisions, budgets, and operations. It is guidance, not a current cost benchmark.
Rank #3
In the same 2025 US SMB survey, 70% of respondents said they relied on outside experts to guide security decisions. That describes reported reliance, not proof that outside help costs less or is suitable for every business. The right arrangement depends on what the organization needs, what its staff can manage, and what any proposed service actually covers.
How much should a company spend on cybersecurity?
The cited studies do not establish a universal spending target, an affordability threshold, or comparable organization-level costs. They therefore cannot support a recommended dollar amount or percentage of revenue. A useful budget decision starts with the organization’s risks, essential operations, existing safeguards, and available internal expertise—not a figure inferred from these survey results.
- Identify the systems, data, and business processes whose loss or interruption would matter most.
- Review which safeguards are already in place and where the most consequential gaps remain.
- Account for the people and skills needed to operate those safeguards, not only the cost of buying tools.
- Compare proposed internal or external approaches by their scope and fit; the surveys do not show that outsourcing reduces total cost.
So, is cybersecurity facing an affordability crisis?
The strongest conclusion supported by these surveys is that affordability is a significant, uneven pressure—not a demonstrated universal crisis. ISC2’s figures show persistent budget, staffing, and skills constraints, while its 2025 account suggests budget-cut pressure had leveled off from the prior year. The separate US SMB survey shows that many respondents could not upgrade tools because of cost. Neither source measures a representative market-wide cost of adequate protection.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
