There's no single right answer, but there are defensible benchmarks. For UK SMEs in 2026, cyber security spend typically lands between 5% and 12% of total IT budget — or roughly £40–£90 per user per month for a managed, end-to-end approach.
What that spend covers
- EDR/MDR on every endpoint with 24/7 monitoring.
- Email security and phishing protection.
- Identity and access management (MFA, Conditional Access).
- Patching and configuration management.
- Security awareness training and phishing simulations.
- Backup and disaster recovery for core systems.
- Compliance support (Cyber Essentials, insurance questionnaires).
- Incident response retainer.
DIY vs managed — the maths
Building this in-house typically requires:
- 1–2 FTE security/IT engineers: £80k–£160k loaded cost.
- Tooling stack (EDR, SIEM, email security, training): £15k–£40k/year.
- 24/7 coverage: a recruitment problem, not just a budget one.
A managed subscription bundles the tooling, the engineers and the 24/7 coverage. For a 50-person business, that's typically £2,500–£4,500/month vs £100k+ to build the equivalent internally.
How to present it to the board
- Quantify exposure in business terms (downtime, data loss, contract impact, regulatory fines).
- Benchmark against peers in your industry and headcount band.
- Present three options: insufficient, adequate, robust — with cost and residual risk for each.
- Tie spend to specific outcomes (certifications won, incidents detected, downtime avoided).
Next step
Want a costed proposal for your business, with a clear breakdown of what's included? Book a free 30-minute review — no obligation, plain-English numbers.