While companies continue to spend more each year on cybersecurity, the rate of increase slowed considerably in 2025.
The average cybersecurity budget grew 4% this year, only half of last year’s 8% growth rate and the lowest rate in five years, according to a new study report from IANS Research and Artico Search.
Between 2020 and 2024, security budgets as a percentage of IT spending grew steadily, from 8.6% to 11.9%, the report noted. Conversely, this year the metric showed a one-percentage-point retreat to 10.9%, according to the study of 587 corporate security executives.
Just 47% of those surveyed said their companies increased their security budgets this year, down from 62% in 2024, 63% in 2023 and 78% in 2022.
Explaining the spending pullback trend, the report noted that in many organizations, especially those in highly regulated industries, “security programs have reached a high level of maturity where foundational investments … are in place.”
As a result, “the focus has shifted from large-scale capital expenditures on big projects to ongoing operational expenses, with an emphasis on optimization of existing systems rather than further expansion.”
Additionally, the report suggests, spending levels were bound to slow down following the post-pandemic recovery period in 2021 and 2022, which featured government stimulus money, supply chain recovery, and accelerated business growth and digital transformation.
Security budgets as a percentage of revenue also retrenched this year, remaining flat at a growth rate of 0.69% after three years of increasing percentages.
About half (47%) of the survey respondents said their company’s revenue grew faster this year than the security budget, while only 21% said security spending outpaced revenue.
Unsurprisingly, the size of companies’ security teams followed the same pattern, with the growth rate down to 7% this year, the lowest in five years. Companies now tend to have a more bountiful budget for tooling than for staff increases, noted Artico Search partner Steve Martano. The situation may lead to teams not being staffed adequately to take advantage of a tool’s full capabilities, he said.
Indeed, only 11% of the surveyed security executives characterized their organization as being adequately staffed.
Cost certainly plays a key role there. According to the report, 39% of the average company’s security budget goes to staff and compensation, with an additional 12% for outsourcing. By comparison, 29% is for software and 5% for hardware.
The report offered three key recommendations for security executives that should appeal to CFOs.
First, align security objectives with business goals. Second, strategically prioritize the most critical assets and risks, while deferring less-urgent items. Third, submit budget requests realistically and show how existing investments can be optimized for greater effectiveness.
