The budget it takes
Everyone agrees security matters. Then it waits for a quieter month, something quick gets done, and it waits again. That gap is the one attackers count on.
13%of IT budgets go to cybersecurity at managed IT service providers, the most exposed sector; 9% across all sectors
63%of organisations take a month or more to apply critical patches to critical systems; 28% take more than three months
94%of smaller companies find it hard to hire cybersecurity staff, and 83% of large ones
Source: ENISA, NIS Investments 2025, a survey of 1,080 organisations in the EU, published 8 December 2025.
What the more exposed sectors set aside
The more a business depends on its systems, and the more others depend on it, the larger the share it puts into security. For a company with €25 million in turnover, the sector medians come to:
Table 1 Security budgets in the more exposed sectors, from ENISA’s sector medians.
| Sector | IT, share of turnover | Security, share of IT | A month, at €25 million turnover |
| Managed IT services | 8.9% | 13.3% | about €24,700 |
| Digital infrastructure: data centres, cloud, telecoms | 8.2% | 11.5% | about €19,600 |
| Financial market infrastructure | 7.2% | 10.5% | about €15,800 |
| Banking | 6.1% | 9.4% | about €11,900 |
| Health | 5.0% | 9.0% | about €9,400 |
ENISA, NIS Investments 2025, survey data companion: sector medians (Figures 33 and 39). The monthly figure multiplies the two medians, so read it as an order of size.
For the example estate, Complete costs €9,780 a month and Managed €5,860. With us, the budget buys the work itself, every month: updates carried out, attacks answered and every step on the record.
A team of your own. Watching every hour of the year takes about five people: a year has 8,760 hours, and one person works about 1,700 of them after leave and holidays. At €5,000 a month each, that is €25,000 a month in salaries, before tools, training and the people you cannot find.