Cybersecurity Budget Planning Guide for Indian Businesses

Why Cyber Budgeting Is Different

Cybersecurity budgeting is harder than most IT functions because the output is hard to measure. A successful cyber programme is one where nothing bad happens. There is no productivity uplift to point to, no revenue metric, no efficiency gain that can be plotted against spend. The CFO asks 'what did we get for that INR 50 lakh', and the honest answer is 'we did not get breached, lose customer data, fail an audit, or get hit with a regulator fine'.

The conversation works better when framed in risk terms: probability times impact times tolerance. A 5 percent annual probability of a INR 4 crore breach is a INR 20 lakh expected loss; spending INR 30 lakh on prevention may or may not be worth it depending on the customer's risk tolerance. Most Indian CFOs respond to this framing better than to a flat security ask. Codesecure delivers risk-based budget frameworks as part of compliance and security strategy engagements.

Benchmarks: What Do Others Spend?

Global benchmarks (Gartner, IDC, IBM Cost of a Data Breach 2024): cybersecurity spend averages 8 to 13 percent of IT budget across industries. Banking and financial services are above 13 percent. Healthcare around 10 to 12 percent. Manufacturing and retail closer to 6 to 9 percent. Government varies by country and tier.

Indian benchmarks: typical Indian organisations historically spent 5 to 9 percent of IT budget on cybersecurity, climbing as DPDP, RBI, IRDAI and SEBI obligations tightened. Regulated sectors (banks, NBFCs, insurance, healthcare) now spend 9 to 15 percent. Tech-first SaaS companies often spend more on a relative basis but smaller absolute amounts because their IT spend is largely cloud-consumption rather than headcount.

Benchmarks are starting points, not targets. A bank with mature SOC operations may justifiably spend less than an unprepared startup with comparable revenue, because the latter has more catching up to do. The right number is whatever covers the actual risk surface, not what the peer-group reports.

Risk-Based Prioritisation

The structured approach: enumerate threats relevant to the organisation, estimate likelihood and impact for each, identify controls that reduce likelihood or impact, estimate cost per control, calculate cost per unit risk reduction, prioritise by ratio. The output is a ranked control list.

Practical shortcut for organisations without mature risk management: rank threats into Critical (would-be-disastrous events: ransomware, BEC fraud, major data breach), High (significant disruption: targeted phishing, account takeover, supplier compromise), Medium (operational disruption: malware on individual endpoints, low-impact misconfigurations), Low (informational: minor exposure findings). Allocate spend roughly 60 / 25 / 10 / 5 across these tiers. Adjust based on the sector's specific threat picture.

Codesecure delivers risk assessments that produce this prioritisation as part of compliance and security strategy engagements. The output feeds the budget conversation directly.

Must-Have vs Nice-to-Have Controls

Every Indian organisation past 10 employees needs the must-haves. The nice-to-haves are scope-dependent.

• Must-have: identity (IdP + MFA), endpoint protection (EDR), backup with offline immutable copy, baseline awareness training, annual VAPT, basic IR plan
• Highly recommended at mid-size: SIEM with curated detection content, EDR managed by a SOC or MDR, structured awareness with monthly phishing simulation, ISO 27001 ISMS, IR retainer
• Sector-specific must-haves: PCI DSS (card-flow merchants), HIPAA (US-linked health-tech), SOC 2 (B2B SaaS), RBI / SEBI / IRDAI (regulated financial entities), NCIIPC (critical infrastructure)
• Nice-to-haves: advanced fraud platforms, deception technology, DLP at scale, threat intelligence platform, browser isolation, dedicated red team
• Expensive but justified at scale: 24x7 in-house SOC, dedicated CISO with team, advanced CNAPP, full-spectrum threat hunting

Building the Business Case

A defensible cybersecurity business case has four elements: the risk being addressed (described in business terms, not technical jargon), the control proposed and how it reduces that risk (mechanism, not buzzwords), the cost of the control (capex plus opex plus internal effort), and the comparator (cost of inaction quantified as probability times impact).

The framing for the board: 'Threat X has 5 percent annual probability and would cost the business INR 6 crore in direct and indirect impact. Control Y reduces the probability to 1 percent. Control Y costs INR 25 lakh per year. Expected risk reduction: INR 24 lakh per year. ROI: positive after year 1, compounded thereafter.' Numbers vary; the framing is what consistently works.

Cybersecurity spend justified through unmistakable narrative (a recent breach at a peer organisation, a customer questionnaire demanding the control, a regulator finding) is easier to win than spend justified through abstract risk argument. Capitalise on these moments when they happen; build the framework so subsequent asks have the structure ready.

Hidden Costs Often Underestimated

Cybersecurity budget conversations often focus on tools and headcount. The hidden costs that catch organisations off-guard:

Incident response retainer: a few lakh per year for an on-call IR partner. Cheap compared to mid-incident emergency rates that can be 3 to 5 times normal. Breach notification: per-affected-individual cost for letters, call centre, credit monitoring; aggregate for an Indian medium-impact breach typically runs INR 50 lakh to several crores. Cyber insurance premium: rising 20 to 50 percent annually in Indian market, with stricter underwriting; underinsured organisations pay out-of-pocket. Downtime cost: revenue-critical SaaS downtime costs lakhs per hour; production downtime in manufacturing costs more. Regulatory fines: DPDP up to INR 250 crore for failure of reasonable security safeguards, sector-specific fines for RBI / SEBI / IRDAI breaches. Reputation: harder to quantify; customer churn, lost deals, partner trust erosion.

These costs do not appear in the planned budget. They show up after an incident as unbudgeted expenses. Prevention spend that prevents one of these is, in retrospect, the cheapest line item in the year.

SMB vs Enterprise Budget Frameworks

Small (under 50 employees): INR 5 to 25 lakh per year covers identity, endpoint, backup, awareness, baseline VAPT, basic DPDP compliance, IR retainer (best effort). Managed services or vCISO arrangements stretch the budget. Codesecure offers startup-friendly bundles.

Mid-size (50 to 500 employees): INR 25 lakh to 2 crore per year. Adds SIEM or MDR, EDR managed at scale, structured awareness with simulations, ISO 27001 ISMS, annual third-party pentest, possible vCISO or part-time CISO, IR retainer with defined SLA, possibly SOC 2 or ISO 27001 certification.

Enterprise (500 to 5000 employees): INR 2 to 15 crore per year. Adds 24x7 SOC (in-house or co-managed), CISO with team, full compliance programme (ISO 27001, SOC 2, PCI DSS, RBI / IRDAI / SEBI as applicable), continuous VAPT, CSPM at scale, DLP, advanced fraud platforms, full IR readiness with multiple retainers.

Large enterprise (5000+ employees): 15 crore upward, often expressed as percentage of IT budget. Dedicated security organisation across multiple specialised teams, comprehensive tooling, board-level reporting cadence, cross-business-unit programme governance.