Build an AppSec budget from your own facts: how much software you run, which risks matter most, and how much work findings create. Split spend into people, tools, services, training and contingency, then present three scenarios. Do not borrow a percentage from a survey and hope it fits.
Why benchmarks mislead
A published percentage of IT spend describes other companies with other risks. It may help as a sanity check, but it does not tell you what to fund first. Budget requests succeed when they connect each line to a specific risk or deal.
Five cost buckets
| Bucket | Examples |
|---|---|
| People | AppSec staff, champion time, developer time for fixes |
| Tools | Scanners, platform, integrations |
| Services | Penetration tests, design reviews, contractors |
| Training | Developer education, champion programs |
| Contingency | Incident response retainer, unexpected work |
Developer time to fix findings is the bucket most often left out. Tools find issues, and someone must pay the engineering cost of closing them.
Steps
- Count your estate. Repositories, applications, internet facing services, regulated data stores.
- List your top risks from the baseline scan, incident history and customer requirements.
- Map each risk to a control and an owner. Mark whether you do it today.
- Cost each gap in three ways. Do it with existing staff, do it with a tool, do it with a service. Get actual quotes, never guess.
- Package three scenarios: a floor that covers legal and contractual obligations, a target that addresses top risks, and a stretch.
- Tie each scenario to outcomes you will report, such as age of severe findings.
Defending the request
Talk in terms leaders already use: deals unblocked, incidents avoided, audit findings closed. If a customer or regulator requires a control, say which one and cite it. Avoid fear. Show the trade-off and let leaders pick a scenario. See getting management support.
Review cycle
Check actual spend and results each quarter. If a tool is unused or findings are not being fixed, say so first. Credibility on small items earns trust on large ones.
Quick check
What share of the engineering budget should go to security?
There is no universal figure you can rely on. Use your own risk and workload to size it, and treat any percentage as a rough cross check at most.
What is the most forgotten cost?
Developer time to remediate, followed by tuning and integration effort.
Try it yourself
Click through it at your own pace, or open it full screen.
See how controls map to a framework. Mapping gaps to required controls gives you a defensible reason for each budget line.
Safeguard's compliance and evidence automation can reduce the manual effort in audit preparation, which is one budget line you can estimate from past audits. Try the free scan to start your baseline.
Last reviewed: 19 October 2026.
