CIO’s 2019 State of the CIO survey asked 683 IT executives worldwide what percentage of their companys total IT budget was represented by IT security. Nearly one quarter of organizations are devoting 20% or more of their IT budget to security. As a rule of thumb, an organization should spend between 7% and 10% of its IT budget on security. At HITRUST, a company that provides risk management and security services, the security budget has remained stable over the years.”]
Source: https://www.csoonline.com/article/3432138/how-much-should-you-spend-on-security.html