A cyber security budget used to be an afterthought for Australian SMBs. Bought after the server refresh and the accounting software upgrade, if money was left over.
That’s changed. Not because vendors got better at selling fear. Insurers, larger customers and regulators all now want to see controls, not intentions.
If you’re setting your 2027 numbers, your cyber security budget needs its own line. Here’s what should be in it.
Why 2027 is different from 2024
Insurers want proof, not promises. Renewal questionnaires that used to be half a page now cover MFA, backup testing, admin access and patching cadence in detail.
Answering “yes” without evidence is risky. Several insurers treat these answers as a condition of cover. A misrepresentation made when the policy was taken out, not one found later at claim time, can void the payout.
Your customers are auditing you. Supply to government, healthcare, education, financial services or a large corporate? A supplier security questionnaire has probably already landed in your inbox.
These increasingly name the Essential Eight directly. Being unable to answer is starting to cost businesses work.
Reporting obligations are already in force. The Cyber Security Act 2024 made ransomware payment reporting mandatory from 30 May 2025. It applies once turnover passes $3 million.
- Report to the Australian Signals Directorate within 72 hours
- Civil penalties of up to $19,800 for not reporting
- The $3M threshold mirrors the Privacy Act small business exemption
That sits alongside the existing notifiable data breach rules under the Privacy Act 1988.
Your IT provider might not already cover this. Plenty of SMBs assume paying for “managed IT” means MFA and backups are already handled. Often they aren’t.
Enforcing MFA properly generates support tickets; a lot of cheap IT arrangements were never priced to absorb.
Confirm what’s actually configured before budgeting for anything new.
What actually goes into a cyber security budget
Most SMBs underestimate this cost because they treat cyber security as one product. It’s five categories:
- Identity and access: MFA on every account touching business data, admin accounts kept separate, access removed the day someone leaves. Highest-value spend on the list, and usually the cheapest.
- Endpoint and email protection: Modern endpoint detection on every device, plus filtering that catches impersonation attempts standard spam filters miss. Business email compromise is still the most common way SMBs lose money.
- Patching and asset visibility: You can’t patch what you don’t know you own. Budget for the tooling and labour to keep everything current, including software nobody remembers installing.
- People and process: Staff training built around real threats, a written incident response plan, and a few hours a quarter of someone senior reviewing progress. Gets cut first, matters most at claim time.
For a deeper breakdown of which controls matter most, see our guide to practical cyber security controls for SMBs.
Backup and recovery, the part everyone gets wrong
“We have backups” is an assumption, not a control. It usually fails because nobody has tried restoring from it.
The baseline is 3-2-1:
- 3 copies of your data
- 2 different storage types
- 1 copy kept offsite
Check what Microsoft 365 or Google Workspace actually backs up, too. Default retention recovers a deleted file.
It won’t survive a real incident, and it isn’t a substitute for a proper backup product.
How to size your cyber security budget
There’s no universal percentage for a cyber security budget, and anyone who gives you one exact figure is guessing.
Published ranges vary:
- 3% to 8% of total IT budget for lower-risk SMBs
- 9% to 12% for businesses with higher compliance exposure
Set your figure against what a week of downtime would cost, plus what your insurer and biggest customer are already asking you to prove.
For most SMBs in the 10 to 100 staff range, the real first-year cost isn’t the tooling. It’s the uplift work: getting from “we have some of this” to “we can evidence all of this.”
Budget that separately from ongoing licence costs, or you’ll blow the number in month two.
Do this before renewal season
- Get an honest baseline: Map what you have against Essential Eight Maturity Level One. Not level three, level one. Most SMBs are partway there and don’t know which parts are missing.
- Audit last year’s insurance questionnaire: Mark every answer you couldn’t prove with a screenshot or a report. That’s your real gap list.
- Price the gap, then phase it: You don’t have to close everything this financial year. You do need a documented plan with visible progress.
The practical takeaway
Cyber security is now a cost of doing business, like insurance or compliance. Predictable, unglamorous, and expensive to ignore.
The SMBs handling it well aren’t spending the most. They’ve moved it from “if there’s a budget” into “this is what it costs to operate.”
Where to start
If you’re locking in 2027 numbers and aren’t sure what’s realistic, start with a baseline, not a quote.
Technofy IT runs a cyber security risk assessment for Victorian SMBs, benchmarked against Essential Eight Maturity Level One. An honest read of where you sit, a check of whether your backups actually meet 3-2-1 in practice, and a findings report with a prioritised, costed gap list.
No lock-in contract. You deal directly with the person doing the assessment, backed by the same enterprise IT strategy thinking behind every engagement.
Book a free 30-minute strategy call to find out where your 2027 cyber security budget should actually go.
