How Should Mid-Sized Companies Allocate Their Cybersecurity Budget?

Mid-sized companies face the same cyber threats as large ones, without the same budget. So the most effective approach is to allocate the budget wisely according to risk, with growing it a secondary question. Analyses based on incident data show that companies often organise their budgets around habit more than around the most effective controls. In this article we look at what the data suggests and at a sample budget split.

Companies spend enough, often in the wrong places

Companies do not underspend on cybersecurity. But the budget usually goes to the most talked-about products or the most familiar solutions.

In its 2025 Cybersecurity Signals report, the insurance and risk advisory group Marsh McLennan compared organisations' security controls with incident data and ranked 12 common controls by their effect on reducing breach risk. The top four:

1. Endpoint detection and response (EDR)
2. Log collection and monitoring
3. Security awareness training and phishing tests
4. An incident response plan

Multi-factor authentication (MFA) was not near the top. According to the report, MFA is now present in almost every organisation, so it no longer sets organisations apart. What does make a difference is applying phishing-resistant MFA to every account.

Has MFA become less important?

No. MFA is still a basic control, but on its own it is no longer a sufficient signal. Attackers have found ways around it: fake login pages that steal sessions, fake support calls asking users for their code, and abuse of fallback sign-in methods, among others.

In the same team's 2023 study, automated system hardening came first. The real message of these rankings: which control gets priority should follow your company's actual risk profile.

Why awareness training stays in the budget's shadow

In Marsh's 2025 data, awareness training and phishing tests, in third place, send a stronger signal than many technical controls. The report also shows that quality, meaning current content and realistic simulations, is linked to outcomes more than frequency. Even so, this line usually sits in the shadow of technical tools in budgets.

There is a reason: the effect of awareness training is hard to measure. Completion rates mean little, and it is hard to fund what you cannot measure. Simulation data and behavioural measurement are the way to make this investment visible.

A sample budget split

Mid-sized companies generally spend between 10 and 12 percent of their IT budget on cybersecurity. A balanced split of that budget could look like this:

These figures are a starting point. Your sector, the data you handle and your current maturity will change the split.

Basic hygiene before budget decisions

No budget split protects an organisation that neglects basic hygiene. Six basic habits:

1. Asset tracking: you cannot protect a device you do not know about. An inventory of hardware, software and services is the first step.
2. Identity and access management: assign permissions to roles and groups rather than to individuals.
3. Employee awareness: even the strongest firewall cannot stop an employee who breaks a process because of a fake email.
4. Process discipline: simple procedures such as calling back to verify a payment request prevent serious damage.
5. Patch prioritisation: if everything is urgent, nothing is. Prioritise internet-facing and critical systems.
6. Separation of duties: for critical transactions, the same person should not both initiate and approve.

What will change in 2026-2027?

AI-assisted attacks are expected to increase, regulatory pressure to rise and security specialists to become harder to hire. This points mid-sized companies towards a balanced model that combines strong outsourced services with regular awareness programmes.

Frequently asked questions

---
InfoLore makes your awareness investment visible with simulation data and behavioural measurement. Get in touch to review this line of your budget together.