How to Budget for Security Testing: A CFO-Friendly Guide to ROI

Security budgets are one of the hardest line items to justify. The ROI is invisible when things go right. Nobody celebrates the breach that did not happen. And when leadership asks "what did we get for that $50,000?" the honest answer, "nothing bad happened," rarely satisfies a CFO who tracks returns on every dollar.

But here is the reality: security testing is not a cost center. It is risk reduction with a measurable financial return. The math is straightforward once you frame it correctly. This guide gives you the numbers, the benchmarks, and the language to build a security budget that your CFO will actually approve.

The Cost of Doing Nothing

Before we talk about what security testing costs, let us talk about what it prevents. IBM's 2024 Cost of a Data Breach Report puts the global average cost of a data breach at $4.88 million. That is a 10% increase over 2023 and the highest figure ever recorded. For U.S. companies specifically, the average climbs to $9.36 million.

These are not theoretical numbers. They include direct costs like forensic investigation, legal fees, regulatory fines, customer notification, and credit monitoring. They also include indirect costs that compound over years: customer churn, brand damage, increased insurance premiums, and the operational disruption that follows every major incident.

Now compare that to the cost of prevention. A comprehensive penetration test for a mid-size application runs between $7,500 and $30,000. An annual security testing program including penetration testing, vulnerability management, and code reviews might cost $50,000 to $150,000 per year. Even at the high end, that is roughly 3% of the average breach cost. The math does not require an MBA to understand.

Security Budget Benchmarks: What Companies Actually Spend

One of the most common questions from CFOs and CTOs is "how much should we be spending?" The answer depends on your company size, stage, industry, and risk profile, but there are useful benchmarks to anchor the conversation.

Percentage of IT Budget

Gartner consistently finds that organizations spend between 5% and 15% of their IT budget on security, with the average hovering around 9-10%. Companies in regulated industries like financial services, healthcare, and government tend to sit at the higher end. SaaS companies and startups often start at the lower end but increase rapidly as they pursue enterprise customers and compliance certifications.

Per-Employee Benchmarks

Another useful lens is spend per employee. Industry benchmarks suggest:

• Small companies (under 100 employees): $1,500 - $3,500 per employee annually on security overall, with $500 - $1,500 allocated specifically to security testing and assessments
• Mid-market (100-1,000 employees): $2,500 - $5,000 per employee, with $800 - $2,000 for testing
• Enterprise (1,000+ employees): $3,000 - $8,000 per employee, with $1,000 - $3,000 for testing

By Company Stage

These are guidelines, not mandates. A 20-person fintech handling payment card data needs more security investment than a 200-person marketing SaaS. The right number for your organization depends on what you are protecting, who you are selling to, and what compliance obligations you carry. If you are navigating fundraising, our guide on security due diligence for fundraising covers how investors evaluate your security posture at each stage.

What Security Testing Actually Costs

One of the biggest obstacles to budgeting is not knowing what things cost. Most vendors hide pricing behind "request a quote" forms, making it impossible to plan. Here are realistic market ranges for the most common security testing services.

Penetration Testing

• Web application pentest: $7,500 - $30,000 depending on application complexity, number of roles, and API surface area
• API penetration testing: $7,500 - $25,000 depending on number of endpoints, authentication complexity, and business logic depth
• Network penetration testing (external): $5,000 - $20,000 based on IP range size and service exposure
• Network penetration testing (internal): $10,000 - $30,000 depending on network size and Active Directory complexity
• Cloud security assessment (AWS/Azure/GCP): $10,000 - $35,000 based on account complexity and service count
• Mobile application testing: $8,000 - $25,000 per platform (iOS/Android)

Code Reviews and Static Analysis

• Manual security code review: $5,000 - $25,000 depending on codebase size, language, and depth of review
• AI-assisted code review (for vibe-coded applications): $2,500 - $10,000 for lighter-weight reviews focused on common patterns in AI-generated code
• SAST/DAST tooling (annual license): $5,000 - $50,000+ depending on the platform and number of applications

Red Team and Advanced Assessments

• Red team engagement: $30,000 - $150,000+ for multi-week, objective-based adversary simulation
• Physical penetration testing: $10,000 - $40,000 depending on locations and scope
• Social engineering assessment: $5,000 - $20,000 for phishing, vishing, and pretexting campaigns

Continuous and Managed Services

• Vulnerability management (managed): $500 - $5,000/month depending on asset count
• Attack surface management: $476 - $2,000/month for continuous external monitoring and discovery
• Bug bounty programs: $12,000 - $50,000/year platform fees plus per-vulnerability payouts

Aligning Security Spend with Business Milestones

The most effective security budgets are not arbitrary percentages. They are tied to business events that create security obligations or expose security gaps. Here is how to map security investment to the milestones your CFO already tracks.

Fundraising Rounds

Investors increasingly conduct security due diligence before writing checks. At Series A, they want to see basic hygiene: vulnerability scanning, at least one penetration test, and a security policy. By Series B and beyond, they expect a security program: regular testing cadence, compliance certifications, incident response plans, and evidence of remediation follow-through. Budget for a penetration test and any compliance gaps 60 to 90 days before you plan to start fundraising conversations.

Enterprise Sales

Enterprise customers send security questionnaires. They ask for your SOC 2 report. They want to see recent pentest results. Deals stall for weeks or die entirely when you cannot produce this evidence. If you are moving upmarket, budget for compliance testing and certifications at least 6 months before your first enterprise pipeline target closes.

Compliance Deadlines

SOC 2 Type II audits, ISO 27001 surveillance audits, PCI-DSS annual assessments, HIPAA risk assessments: these all have fixed timelines. Penetration testing is a required or expected control in most of these frameworks. Map your compliance calendar and budget testing engagements to complete 4 to 6 weeks before audit periods, leaving time for remediation.

Product Launches and Major Releases

New products and significant feature releases introduce new attack surface. Budget a focused security assessment before any launch that handles new data types, introduces new authentication flows, integrates with new third parties, or exposes new API endpoints. The cost of finding a critical vulnerability post-launch is orders of magnitude higher than finding it pre-launch.

M&A Activity

If you are acquiring a company, budget for a security assessment of the target. If you are being acquired, budget for cleaning up your security posture to maximize valuation. Acquirers routinely adjust purchase prices based on security findings, and material vulnerabilities discovered post-close create legal liability.

Calculating ROI: The Numbers Your CFO Wants

Security ROI is not about proving a negative. It is about quantifying risk reduction in terms the finance team already uses. Here are the five ROI categories that resonate most with CFOs and boards.

1. Avoided Breach Costs

This is the most intuitive calculation. Take the average breach cost for your industry and company size, multiply by the probability of a breach (roughly 1 in 4 companies will experience one over a two-year period), and compare that expected loss to your testing investment.

Example: If your estimated breach cost is $3 million and your two-year probability is 25%, your expected loss is $750,000. An annual testing program costing $75,000 reduces that probability significantly, say to 5%, bringing expected loss to $150,000. The net risk reduction is $600,000 against a $150,000 investment over two years. That is a 4:1 return.

2. Deal Acceleration

Enterprise deals that stall on security questionnaires have a measurable cost: extended sales cycles burn sales team time, delay revenue recognition, and risk deals going cold entirely. If your average enterprise deal is worth $200,000 ARR and having a pentest report and SOC 2 on hand shortens the security review from 8 weeks to 2 weeks, you have accelerated $200,000 in revenue by 6 weeks. Across 10 enterprise deals per year, the revenue acceleration alone can exceed the cost of your entire security program.

3. Insurance Premium Reduction

Cyber insurance premiums have been rising sharply, but insurers offer meaningful discounts for organizations that can demonstrate proactive security testing. Companies with regular penetration testing, vulnerability management programs, and incident response plans typically see 10% to 30% lower premiums compared to companies without these controls. On a $100,000 annual cyber insurance policy, that is $10,000 to $30,000 in savings, every year.

4. Compliance Efficiency

Every compliance framework requires evidence of security controls. When you have a structured testing program, audit evidence is already collected, findings are documented, and remediation is tracked. This reduces audit preparation time by 40% to 60% compared to organizations that scramble to produce evidence for each audit cycle. Translate that time savings into FTE cost and you often find that the testing program partially pays for itself through operational efficiency.

5. Regulatory Fine Avoidance

GDPR fines can reach 4% of global annual revenue. HIPAA penalties range from $137 to $68,928 per violation, up to $2.07 million per category per year. PCI-DSS non-compliance fines range from $5,000 to $100,000 per month. These are not abstract risks for companies handling sensitive data. Demonstrating proactive security testing is a key mitigating factor in regulatory enforcement actions.

Prioritizing Security Spend: What to Buy First

Not every company can fund a full security program from day one. Here is how to prioritize based on your stage and the threats that are most likely to impact your business.

Stage 1: Foundation (Budget: $5K - $25K)

If you are spending your first dollar on security testing, start here:

• Vulnerability scanning (automated, continuous): catches the low-hanging fruit that attackers scan for first. Many good options under $5,000/year.
• One penetration test per year on your primary application: validates that your most important asset is not trivially exploitable.
• Security code review if you are shipping AI-generated code: AI code reviews starting at $2,500 catch the patterns that LLMs consistently get wrong.

Stage 2: Growth (Budget: $25K - $100K)

As you pursue enterprise customers or compliance certifications:

• Annual or semi-annual penetration testing across web, API, and cloud infrastructure
• Compliance-driven testing aligned to SOC 2, ISO 27001, or PCI-DSS requirements
• Attack surface management for continuous external monitoring: know when new assets appear and when configurations drift
• Vulnerability management program with tracking and SLA-driven remediation

Stage 3: Maturity (Budget: $100K - $500K+)

For established companies with meaningful security risk:

• Quarterly penetration testing across all critical applications and infrastructure
• Annual red team engagement to test detection and response capabilities
• Continuous code review integrated into the development pipeline
• Social engineering assessments to test human factors
• Tabletop exercises and incident response testing
• Third-party and supply chain risk assessments

The Hidden Costs of NOT Testing

The line items you see on a breach cost report are only part of the story. Here are the costs that do not show up on any invoice but can be just as damaging.

Delayed Enterprise Deals

A prospect asks for your pentest report. You do not have one. The deal pauses while you scramble to schedule a test, wait 3 to 6 weeks for execution, then remediate findings before sharing results. Best case: you delayed revenue by 2 to 3 months. Worst case: the prospect went with a competitor who had their reports ready on day one.

Failed Compliance Audits

Missing or inadequate penetration testing evidence can result in qualified audit opinions, delayed certifications, or outright failures. A failed SOC 2 audit does not just cost you the audit fee. It costs you every deal that required SOC 2 as a prerequisite. It costs you the 3 to 6 months to remediate and re-audit. And it costs you the credibility you have to rebuild with customers who were told certification was imminent.

Incident Response Under Pressure

Companies without a testing program discover vulnerabilities the hard way: through exploitation. Incident response is dramatically more expensive than proactive testing. Emergency forensics consultants charge $300 to $600 per hour. Legal counsel for breach notification runs $400 to $800 per hour. Customer notification and credit monitoring services cost $5 to $30 per affected record. A breach affecting 50,000 records can easily exceed $1 million in response costs alone, before you count regulatory fines or lawsuits.

Talent and Retention Impact

Engineering teams that have been through a major breach carry the scars. Morale drops. Burnout increases. Your best engineers, the ones with the most options, leave first. The cost of replacing a senior engineer is 1.5x to 2x their annual salary. Lose three engineers post-breach and you are looking at $600,000 to $900,000 in replacement costs, not counting the institutional knowledge that walks out the door.

Valuation Haircuts

For VC-backed companies, a material security incident can reduce your next-round valuation by 10% to 25%. On a $50 million Series C, that is $5 million to $12.5 million in dilution. For companies pursuing an exit, acquirers routinely adjust purchase prices downward based on security findings during due diligence. A $100,000 annual security program looks very different when the alternative is a $5 million valuation hit.

Making the Business Case: What to Say to Your Board

The biggest mistake security teams make when requesting budget is leading with fear. Boards have heard "we might get breached" enough times that it has lost its impact. Here is what works instead.

Lead with Revenue, Not Risk

"Our three largest prospects require SOC 2 and annual penetration testing as a vendor requirement. These deals represent $1.2 million in ARR. The security program to close them costs $85,000." That is a 14:1 return. Every CFO understands that math.

Benchmark Against Peers

"Companies at our stage and in our industry typically allocate 8% to 12% of IT budget to security. We are currently at 3%. This gap creates risk exposure and puts us at a competitive disadvantage in enterprise sales." Benchmarks create urgency without alarmism.

Quantify the Status Quo

"Last quarter, we spent 120 engineering hours responding to the security questionnaires we could not fully answer. At a loaded cost of $150/hour, that is $18,000 per quarter in engineering time diverted from product development, and we still lost two deals due to incomplete security evidence." Show what the lack of a program is already costing.

Present a Phased Plan

Do not ask for everything at once. Present a three-phase plan that starts with the highest-impact, lowest-cost items and expands as the program proves its value. Phase 1 might be $25,000 for a penetration test and vulnerability scanning. Phase 2 adds compliance testing and attack surface management for another $40,000. Phase 3 introduces red team exercises and continuous code review. Boards are more likely to approve a phased approach that shows thoughtful prioritization.

Talking Points Template

Annual Security Testing Cadence

A well-structured testing cadence ensures continuous coverage without redundant spend. Here is a model annual plan that balances thoroughness with budget discipline.

This cadence ensures something is being tested every quarter, no single quarter bears an outsized budget hit, and you always have recent testing evidence for compliance and customer requests. Adjust the specific activities based on your risk profile. Companies with heavy API exposure might swap the Q3 code review for an API-focused pentest. Companies pursuing SOC 2 might align Q1 testing with their audit window.

When to Hire vs. When to Outsource

One of the most expensive mistakes companies make is hiring a full-time security team before they need one, or outsourcing everything when they should be building in-house capability.

Outsource When:

• You need specialized skills for specific engagements: Red teaming, cloud security, IoT testing, and mobile application testing require niche expertise that does not make sense to maintain in-house unless you need it continuously.
• You are under 200 employees: At this size, an in-house security team is rarely cost-effective. One senior security engineer costs $180,000 to $250,000 in total compensation. For the same budget, you can fund a full year of outsourced testing, vulnerability management, and attack surface management.
• You need an independent assessment: Compliance frameworks and enterprise customers often require third-party testing. Your internal team cannot audit itself.
• You need surge capacity: New product launches, M&A due diligence, and incident response require short bursts of intensive security work that an outsourced partner can scale to meet.

Build In-House When:

• You have continuous, daily security needs: Security operations (monitoring, alerting, incident response) benefit from in-house staff who know your environment intimately.
• You are over 500 employees: At this scale, you likely need at least a small security team for security architecture reviews, developer training, policy management, and vendor coordination.
• You are in a highly regulated industry: Financial services, healthcare, and defense often require in-house security staff for regulatory reasons.
• You ship code at high velocity: A security champion embedded in your engineering team can catch issues earlier and cheaper than any external engagement.

The optimal model for most companies between 50 and 500 employees is a hybrid: one or two in-house security generalists who manage the security program, coordinate with outsourced specialists for testing, and oversee managed services like vulnerability scanning and attack surface management.

Building Your Security Budget: A Step-by-Step Framework

Here is a practical framework for building a security testing budget from scratch.

1. Inventory your assets: List every application, API, cloud account, and network segment. You cannot budget for testing if you do not know what you need to test.
2. Map your obligations: List every compliance framework, customer contract, and regulatory requirement that mandates security testing.
3. Identify your business triggers: Mark the upcoming fundraising rounds, enterprise deals, product launches, and compliance deadlines that create security testing needs.
4. Prioritize by risk: Rank your assets by business criticality and data sensitivity. Your payment processing system needs more testing than your internal wiki.
5. Build the testing plan: Match each priority asset to the appropriate testing type and frequency. Use the cadence table above as a starting point.
6. Price it out: Use the cost ranges in this guide to estimate spend per engagement. Add 15% to 20% contingency for unplanned testing needs (new product launch, incident investigation, customer request).
7. Calculate the ROI: Use the avoided breach cost, deal acceleration, and insurance premium frameworks above to build your financial justification.
8. Present a phased plan: Break the budget into quarterly phases with clear deliverables and success metrics tied to each phase.

Common Budget Mistakes to Avoid

Even well-intentioned security budgets can go wrong. Here are the patterns we see most often.

• Spending on tools before testing: Do not buy a $50,000 SAST platform before you have had a single penetration test. You need to understand your actual vulnerabilities before investing in automation to find more of them.
• One-and-done testing: A single pentest is a snapshot. Vulnerabilities are introduced with every code push, infrastructure change, and new deployment. Budget for ongoing testing, not just one engagement.
• Ignoring remediation costs: Finding vulnerabilities is only half the work. Budget engineering time for remediation and retesting. A pentest that produces 30 findings requires 40 to 80 hours of engineering work to remediate properly.
• Chasing compliance instead of security: Compliance testing is necessary but not sufficient. A SOC 2 pentest scoped to the minimum controls does not tell you whether your application is actually secure. Budget for compliance AND for genuine security testing.
• Not budgeting for incident response: Even with a testing program, incidents happen. Budget for an incident response retainer ($2,000 to $10,000 per month) so you have expert help available when you need it, not after a 48-hour procurement process.

The Bottom Line

Security testing is not a luxury for companies that can afford it. It is a business necessity that pays for itself through avoided breach costs, accelerated revenue, reduced insurance premiums, and compliance efficiency. The companies that understand this invest early and consistently. The companies that do not learn the lesson the expensive way.

The right budget is the one that matches your risk profile, supports your business goals, and scales with your growth. Start with the fundamentals. Measure the impact. Expand as the program proves its value. Your CFO does not need to understand OWASP Top 10 or CVSS scores. They need to see that every dollar spent on security testing generates multiple dollars in risk reduction and revenue protection.

If you are building your security budget for the first time or revisiting an existing one, the numbers in this guide give you a realistic starting point. The benchmarks keep you honest. And the ROI framework gives you the language to get it approved.

Lorikeet Security Team

Penetration Testing & Cybersecurity Consulting

We've completed 170+ security engagements across web apps, APIs, cloud infrastructure, and AI-generated codebases. Everything we publish here comes from patterns we see in real client work.