How to Build a Cybersecurity Budget Without a CISO

Building a cybersecurity budget without a CISO is the reality at most SMB and mid-market businesses. Without a dedicated security leader making the case, security budget often gets approved reactively after an incident rather than proactively as part of normal planning. Here's a framework for building security budget rationally — without needing a full-time CISO to lead the conversation.

The Decision Framework

Security budget questions break into four categories:

• Compliance-driven — controls required by regulation, contract, or insurance. These aren't really discretionary; the cost of non-compliance exceeds the cost of the control
• Risk-driven — controls that address specific risks the business faces, with cost proportionate to risk magnitude
• Insurance-optimization — controls that improve cyber insurance terms or reduce premium
• Operational efficiency — security investments that reduce other costs (downtime, manual processes, support volume)

Most security budget conversations focus on the first two categories. The other two matter too and often justify additional investment when explicitly considered.

The Spend Benchmarks

For businesses without internal security expertise, useful benchmarks:

• Security spend as percentage of overall IT budget: typically 10-25% depending on industry risk profile
• Healthcare and financial services skew higher (20-30%); lower-risk industries skew lower (8-15%)
• Per-user security spend: $200-600 per user per year for SMB businesses, higher for compliance-heavy environments

These ranges are starting points, not rules. Specific business risks may require investment above the typical range.

The Priority Order

For a business building security budget from a low baseline, the priority sequence:

Tier 1 — Non-negotiables (any decent security program has these):

• Multi-factor authentication across all business accounts
• Modern endpoint protection (EDR/MDR) on every endpoint
• Email security with anti-phishing capabilities
• Backup with immutability and tested restoration
• Cyber insurance with reasonable coverage
• Security awareness training program

Tier 2 — Strong baseline (the next round of investments):

• Identity platform with conditional access
• Password management deployed across the workforce
• DNS-layer security
• Network segmentation
• Patch management automation
• Incident response plan with annual tabletop
• Vendor risk management practice

Tier 3 — Mature program (additional investments for higher-risk or compliance-driven environments):

• SIEM with managed monitoring
• Privileged access management
• Data loss prevention
• Dark web monitoring
• Vulnerability management program
• Formal framework adoption (CIS, NIST, ISO)
• Penetration testing

Most SMBs should focus on getting Tier 1 fully covered before moving to Tier 2. Getting Tier 2 done before Tier 3.

The Cost-Benefit Conversation

Without a CISO making the case, security budget conversations need to anchor in business terms. Useful framings:

• "What does this prevent" — not just "this is a security best practice" but "this control specifically addresses [named risk] that would cost [estimated impact] if it happened"
• "What does this enable" — security investments that enable customer wins, regulatory compliance, or insurance coverage have business value beyond risk reduction
• "What does this cost not to do" — incident cost estimates, insurance premium impact, lost deals due to security gaps
• "What's the alternative" — every avoided security investment is a bet that the risk it addresses won't materialize

The CISO conversation that doesn't happen without a CISO is the one that translates security concepts into business impact. Building that translation explicitly into how security investments get proposed produces better outcomes.

The Outside Help Question

For businesses without a CISO, options exist for getting strategic security guidance without full-time hire: fractional CISO services (a few hours per month of strategic input), MSP relationships that include security advisory, board-level security advisor engagements, and project-based security consulting for specific decisions.

For most SMBs, the right model is layering security guidance into the existing MSP relationship rather than buying a separate fractional CISO. The MSP already understands the environment; adding security strategy is incremental rather than a separate engagement. At Leonidas, security advisory is part of our managed services practice. A conversation with our team can scope what realistic security budget building looks like for your business.