There’s no universal figure, but a reasonable approach scales security spend to what a breach or extended outage would actually cost the business — both directly and in lost trust.
A practical starting baseline
- Automated monitoring (uptime, SSL, blacklist, vulnerability scanning): often available affordably as an all-in-one service
- A password manager and enforced MFA for all admin accounts: low cost, high impact
- Regular, tested backups: usually a modest storage cost plus setup time
- A web application firewall: frequently bundled with CDN/hosting providers at low or no extra cost
When to invest more
Businesses handling payment data, health information, or other regulated data should budget for a proper security audit and compliance review — the cost of non-compliance or a serious breach in these categories is typically far higher than the audit itself.
FAQ
Is basic monitoring enough, or do I need a dedicated security person?
For most small businesses, automated monitoring plus the fundamentals (MFA, patching, backups) covers the majority of real-world risk; a dedicated security hire typically becomes justified once handling sensitive regulated data at scale.