Cybersecurity Budgets: How SA Businesses Should Spend in 2026

Most South African boards treat the cybersecurity budget as a line item to be minimized. This is a failure of governance. In a climate where ransomware is no longer a possibility but a certainty, the budget is not a cost of doing business. It is a risk management tool. If you are looking at your spend through the lens of IT expenses, you are missing the point. Security is a business continuity function. The board’s job is not to find the cheapest way to stay compliant but to determine the acceptable level of loss and fund the gap. For many firms, the current approach is reactive. They wait for a breach, then dump money into a project to fix the specific hole that was exploited. This cycle of panic-spending is inefficient and leaves the business exposed to the next variation of the attack. Real resilience requires a shift from Capex-driven tool acquisition to Opex-driven capability management.

What actually eats a modern security budget?

The days of buying a big firewall and calling it a day are over. Modern spend shifts toward identity and visibility. According to the Sophos State of Ransomware 2026 report, 79% of attacks start with an identity-based approach. This means your money should be flowing into robust Identity and Access Management (IAM). If you are not spending on MFA that covers every single entry point, you are leaving the door open. This includes not just the email account, but the VPN, the firewall admin console, and the legacy apps that your developers forgot to update in 2019. The cost of IAM is not just the license but the rigorous process of auditing every single account and permission set. It is a tedious, expensive process, but it is the only way to stop identity theft from becoming a business-ending event.

Managed Detection and Response (MDR) is another major cost. Most SA firms cannot afford a 24/7 internal SOC. Outsourcing this to a provider that actually knows the local threat environment is a necessary expense. You pay for the eyes on the screen. You pay for the ability to kill a process at 3 AM on a Sunday before it encrypts your entire server farm. This is where the money goes if you want to stop the bleed. The value of MDR is not in the alerts it generates, but in the time it saves. Every minute an attacker spends moving laterally through your network is a minute you have to stop them. A budget that ignores detection is a budget that accepts total failure. The monthly retainer for a quality MDR provider is a predictable cost that prevents an unpredictable catastrophe.

Endpoint protection has evolved. It is no longer about signatures but about behavior. This requires continuous tuning and expert oversight. The cost is not just the license but the human intelligence required to manage the alerts. Without that, you have bought an expensive alarm system that nobody monitors. Boards often approve the software license but reject the budget for the analysts who actually run the software. This is a critical error. Software without a driver is just a fancy paperweight. You need a budget for the people who can distinguish a false positive from a genuine lateral movement attempt by a threat actor. This expertise is rare in the South African market and commands a premium price.

Where is your spending being wasted?

The biggest waste in SA cybersecurity is shelfware. Companies buy “all-in-one” platforms because a salesperson promised a silver bullet. They pay for a dozen modules they never configure. This is a common board-level failure: approving a massive Capex spend for a tool that the team has no capacity to implement. A tool that is 10% configured provides 0% security. You end up paying for a suite of features that sit idle while the attackers use basic techniques to get in. The goal should be a lean, fully implemented stack over a bloated, half-implemented one. If you cannot prove that a tool is actively blocking attacks, it is a waste of capital.

Another waste is the “AI magic” trap. Many vendors are now slapping “AI-powered” on every feature. While AI helps with pattern recognition, it is not a substitute for basic hygiene. Spending a premium on AI tools while your admins are still using the same password for ten different systems is a waste of capital. Hygiene is cheap. Sophistication is expensive. You cannot buy your way out of a lack of discipline. Boards should ask why they need an AI-driven anomaly detector when they haven’t even implemented basic least-privilege access controls for their staff. The most sophisticated AI in the world cannot stop an attacker who has a valid admin password because of a simple phishing mail.

Redundant toolsets also drain the budget. I see firms using three different vendors for the same function because different IT managers had different preferences over five years. This creates complexity. Complexity is the enemy of security. It creates gaps that attackers love. Consolidating your stack often saves money and increases the actual security posture. When you have too many tools, your team spends more time managing the tools than they do managing the threats. This “tool fatigue” leads to missed alerts and slow response times. The budget should be used to prune the garden, not just add more plants. A unified security architecture is always more effective than a collection of disjointed tools.

Controls versus insurance: Where to put the money?

There is a dangerous trend of boards treating cyber insurance as a replacement for security controls. It is not. Insurance is a financial hedge for the residual risk you cannot mitigate. It is the safety net, not the tightrope. If you spend your budget on a premium policy but ignore your patching cycle, you are gambling. Some insurers are now refusing to pay out if basic controls, like MFA, were not active at the time of the breach. They are tired of insuring negligence. They are moving from a “trust and pay” model to a “verify and pay” model. If you cannot provide logs showing that your controls were active, the insurance policy is just a piece of paper.

You should read my detailed breakdown on what your policy really covers in 2026 to understand these gaps. The premium is a sunk cost. A control, such as a hardened backup system, provides value every day. If you have to choose between a higher insurance limit and a better recovery strategy, choose the recovery. Insurance pays for the lawyer and the forensics. It does not bring your business back online in two hours. It does not fix the reputation damage when your clients realize their data is on a leak site. A payout does not recover lost market share.

The goal is to reduce the probability of an event so that your insurance is a last resort. When you over-invest in insurance at the expense of controls, you are essentially paying for a funeral instead of investing in health care. It is a logical fallacy that should be challenged at the board table. A board that prioritizes the policy over the patch is choosing a payout over a functioning business. In the long run, the cost of the payout is almost always lower than the cost of the business interruption. The most cost-effective insurance policy is the one you never have to use because your controls worked.

The cost of POPIA and “check-box” compliance

Compliance is not security. This is the hardest lesson for boards to learn. POPIA requires you to take “reasonable” technical and organizational measures to secure personal information. The problem is that many firms spend their budget on the “organizational” part: policies, manuals, and consultants who write a 50-page document that nobody reads. This is check-box compliance. It makes the board feel safe because they have a signed document, but it does nothing to stop a Russian ransomware gang from encrypting their database. A legal opinion on compliance is not a technical control.

A policy that says “we use strong passwords” is useless if the budget for a password manager was denied. True compliance requires funding the technical controls that make the policy possible. For a practical starting point, refer to my POPIA compliance checklist. Use it to see if your spend matches your obligations. If your compliance budget is 90% consulting and 10% technology, you are not compliant in any way that matters during a breach. The Regulator will not be impressed by a manual if the data was stolen because of a default password on a router.

The Information Regulator of South Africa is becoming more active. The cost of a fine is significant, but the cost of the mandatory breach notification is often higher. You have to notify every affected data subject. The administrative cost of that process can dwarf the actual fine. Budgeting for a proactive security posture is always cheaper than budgeting for a regulatory cleanup. Boards need to realize that the Regulator does not care about your policy manual. They care about whether the data was encrypted and whether the breach was preventable. For more context on the legal framework, the official POPIA site provides the baseline for what is expected of a responsible party.

The breach-cost argument: Prevention versus recovery

Boards love to ask: “What is the ROI on this security spend?” The answer is the avoidance of a catastrophic loss. The Sophos 2026 data shows that the average recovery cost is $1.7 million per incident. This is not just the ransom. It is the downtime, the lost revenue, the forensic fees, and the customer churn. For a medium-sized SA business, a $1.7 million hit is often an existential threat. This is a number that should be on every board’s risk register. It is the baseline cost of failure. When you frame the budget as a fraction of the potential loss, the “cost” of the security program suddenly looks like a bargain.

Prevention is a steady, predictable cost. Recovery is a spike of extreme volatility. When you compare a yearly budget of R5 million for security against a potential $1.7 million loss, the math is simple. However, prevention never stops 100% of attacks. That is why you must budget for the response. You need a funded, tested plan for when things go wrong. A recovery budget includes offline backups that cannot be deleted by an admin account and a clear chain of command for emergency decisions. If you have not budgeted for the recovery, you are essentially planning to fail.

I have outlined how to build an incident response plan. This plan requires a budget for tabletop exercises and retainer fees for a forensic firm. If you wait until the breach to find a forensic partner, you will pay a “panic premium” that is three times the normal rate. Budget for the response now so you do not overpay later. A board that ignores the cost of recovery is essentially hoping that they will never be attacked. Hope is not a strategy. A tested response plan is a business asset.

How to sanity check your cybersecurity number

There is no magic percentage of IT spend that is “correct.” That is a myth. Instead, look at your critical assets. If your entire business relies on one legacy database, that database is where the budget goes. Hardening the perimeter is useless if the core is soft. Your budget should be proportional to the value of the data you protect. If you protect a billion rand of intellectual property with a ten thousand rand security budget, you are not managing risk. You are ignoring it. The budget should reflect the cost of replacing your most valuable asset.

A simple sanity check is to ask your CISO: “If we had a total outage tomorrow, how long until we are back, and how much of that time is spent waiting for a tool we didn’t buy?” If the answer is “weeks,” your budget is too low. If the answer is “hours,” you are likely in the right zone. The board should focus on the “Time to Recover” (TTR) metric. This metric is the only one that truly matters to the bottom line. If the TTR is too high, the budget needs to increase until the recovery time is acceptable to the board. This turns a technical conversation into a business conversation.

Also, look at your staff. Human error is a primary root cause. Phishing and malicious emails account for half of all incidents. If your budget does not include continuous, high-quality training, you are wasting your technical spend. You can have a million-dollar firewall, but it cannot stop a user from giving away their credentials on a fake login page. Check out my guide to POPIA-grade security training to see what a real program looks like. Training is the cheapest way to increase your security posture because it turns your employees from a liability into a first line of defense. A budget that ignores the human element is a budget that ignores the primary attack vector.

Frequently Asked Questions

How much of the IT budget should go to security?

Avoid fixed percentages. Focus on risk. A bank needs more than a retail shop. Start by identifying your “crown jewels” and fund the controls to protect them. Once the critical risks are managed, you can optimize the rest of the spend based on threat intelligence. The number is correct when the cost of the control is lower than the expected loss of the risk it mitigates.

Is cyber insurance a valid substitute for a security budget?

No. Insurance covers financial loss. It does not prevent the breach or recover your data. Insurers are also raising standards. Many will deny claims if you cannot prove that you had active, managed controls like MFA and updated backups in place. Treat insurance as the final layer of a defense-in-depth strategy, not the first.

Does POPIA compliance automatically mean we are secure?

Absolutely not. Compliance is a legal baseline. You can be compliant with a paper-based policy and still be wide open to a ransomware attack. Security is a technical state. Compliance is a legal state. You need both to protect the business. One keeps you out of court, the other keeps you in business.

What is the most cost-effective way to reduce risk?

Implement MFA on every external facing system. It is relatively cheap and stops the majority of identity-based attacks. Combine this with a strict patching schedule for your edge devices. These two steps alone remove a massive amount of risk for very little spend. They are the high-yield investments of the security world.

Should we buy more tools or hire more people?

Hire the people. Tools are force multipliers, but they require a human to multiply. A suite of expensive tools managed by an overwhelmed IT generalist is a liability. Invest in expertise first. The expert will tell you which tools are actually needed and, more importantly, how to configure them so they actually work.

Final thoughts on the cybersecurity budget

The board must stop viewing the cybersecurity budget as an IT cost. It is a strategic investment in the survival of the company. In the South African context, where the threat is high and the regulatory environment is tightening, the cost of inaction is far higher than the cost of a professional security program. Stop looking for the cheapest option. Start looking for the most resilient one. A budget that prioritizes resilience over cost is the only one that will survive the next decade. The goal is not to be unhackable, but to be recoverable.