The most common question we get is also the most poorly answered question in the industry: how much should a company our size spend on security?
Every analyst report cites the same statistic: 7 to 10 percent of IT budget. That number has been recycled in security sales decks for fifteen years. It's also useless, because it doesn't tell anyone what to actually buy or why.
A 200-person fintech and a 200-person law firm have wildly different risk profiles, regulatory loads, and operational realities. They should not spend the same amount or buy the same things. The "7 to 10 percent" advice is the security industry's equivalent of "eat a balanced diet." Technically true. Operationally meaningless.
This post is the answer we wish someone had given us. It's the actual breakdown, by category, with sourced prices, for a 200-person company at four common profiles: SaaS, fintech, healthtech, and professional services.
What changed in how we think about this
The traditional model assumed an in-house security stack that mirrored a Fortune 500's, just smaller. Buy a SIEM, buy an EDR, buy a firewall, buy a vulnerability scanner, hire two analysts, and you're done.
That model breaks at 200 people for two reasons.
First, vendor pricing has stratified. The list price for an enterprise SIEM at 200 employees is now wildly disproportionate to the value extracted. Splunk Enterprise Security at full ingestion volume can cost more than your annual cloud bill. Companies in this size range are making completely different choices than they were five years ago.
Second, threat economics have changed. The threat actors targeting a 200-person fintech are not interested in your network perimeter. They're interested in your identity layer, your developer environments, your SaaS sprawl, and your supply chain. The security stack that defends against the actual threats looks very different from what an Excel model based on Fortune 500 spending would suggest.
The four profiles, with real numbers
We pulled these numbers from CyberTwin's catalog, re-priced against its 2026-09-25 price pass. The catalog sources every price from vendor pages, AWS Marketplace listings, Vendr benchmark data, or reseller listings; usage-priced AWS services are modeled on AWS's published unit rates and labelled as estimates. Every number below has a citation; we're not making them up. A line with no citable price says not priced and stays out of the total rather than counting as zero.
These are illustrative Balanced-tier stacks, assembled by hand from catalog prices for each profile, not the engine's own recommendation (that is live on the Stack Builder, linked below, and picks differently). Balanced is what most 200-person companies actually deploy. We're showing the Balanced stack because the Lean stack is the floor (what you can defend in a finance meeting) and the Advanced stack is the ceiling (what you'd buy with full funding).
Profile 1 — 200-person SaaS, US-based, no regulated data
This is the simplest profile. Cloud-native, mostly remote workforce, primary risks are credential stuffing, supply chain attacks via dependencies, and customer data exfiltration.
- Identity (200 seats) — Microsoft Entra ID P2 — $24,000/yr
- Endpoint (200 endpoints) — Microsoft Defender for Endpoint P1 — $7,200/yr
- Email security (200 mailboxes) — Microsoft Defender for O365 P1 — $4,800/yr
- MDM (200 devices) — Microsoft Intune — $19,200/yr
- SIEM — Microsoft Sentinel (usage-priced, ~baseline) — $15,695/yr
- Cloud security — AWS GuardDuty + Security Hub (modeled estimate) — $4,800/yr
- AppSec — Snyk Team (15 devs) — $4,500/yr
- Backup — Veeam Data Platform Foundation (three 10-instance packs) — $4,650/yr
- WAF — Cloudflare WAF Business — $2,400/yr
Total: about $87k/year. Roughly $436 per employee per year. It's the cost of the Microsoft-native stack — one of CyberTwin's named reference architectures. It's chosen here because the integration coherence (everything in the M365 ecosystem) cuts operational overhead substantially.
A best-of-breed alternative (CrowdStrike + Okta + Splunk + Wiz) runs more than twice that on the same catalog — mostly because its Splunk figure is $94,200 a year against Sentinel's $15,695, and that figure is the median of all Splunk deals on Vendr, not a quote sized to 200 people — and carries meaningfully higher operational overhead.
Profile 2 — 200-person fintech, US-based, PCI DSS scope, payment cards
Different threat model, different regulatory load, different stack.
- Identity (200 seats) — Okta Workforce Identity (Core Essentials suite) — $33,600/yr
- PAM — CyberArk Privilege Cloud (~50 privileged users) — $89,424/yr
- Endpoint (220 incl. servers) — CrowdStrike Falcon Pro — $21,998/yr
- Email security — Mimecast Advanced Email Security (formerly M2A) — $15,000/yr
- Network/Firewall (HQ + DR) — Two FortiGate 200G, the successor Fortinet names for the end-of-order 200F — not priced (no catalog price for the 200G yet)
- ZTNA — Cloudflare One — $16,800/yr
- SIEM — Microsoft Sentinel (usage-priced, ~baseline; higher ingestion costs more) — $15,695/yr
- Cloud security — Wiz Essential — $24,000/yr
- AppSec — GitHub Advanced Security (20 active committers) — $11,760/yr
- DLP — Microsoft Purview Information Protection — $16,800/yr
- Backup — Rubrik Cloud Vault (entry contract) — $50,000/yr
- WAF — Cloudflare WAF Business — $2,400/yr
Total: about $297k/year, before the firewall line, which is not priced. Roughly $1,480 per employee per year, dramatically higher than the SaaS profile. The increase is driven by four things: PAM (a hard regulatory requirement), an immutable, air-gapped backup vault (Rubrik Cloud Vault), CNAPP (Wiz, because cloud risk in fintech is a critical control), and DLP (because payment card data triggers it).
A 200-person fintech that tries to spend $75,000 a year on security is going to fail their PCI audit and lose their merchant agreement. The numbers don't lie about that.
The "7-10% of IT budget" rule hides the spread that matters. At the same headcount, the fintech stack costs at least 3.4× the SaaS one.
Profile 3 — 200-person healthtech, US-based, HIPAA scope, PHI handling
Similar size, different regulatory regime, different threat profile.
- Identity (200 seats) — Microsoft Entra ID P2 — $24,000/yr
- PAM — Delinea Secret Server Cloud (~50 privileged users) — $35,900/yr
- Endpoint (200 endpoints) — Microsoft Defender for Endpoint P2 — $12,480/yr
- Email security — Mimecast Advanced Email Security (formerly M2A) — $15,000/yr
- Network/Firewall (HQ + clinic sites) — FortiGate 120G at HQ, the successor Fortinet names for the end-of-order 100F, + FortiGate 60F × 2 at the clinics — $2,380/yr for the two 60Fs in year one (hardware plus the first year of FortiGuard; later years are the renewal only); the 120G is not priced (no catalog price yet)
- MDM — Microsoft Intune — $19,200/yr
- SIEM — Microsoft Sentinel (usage-priced, ~baseline) — $15,695/yr
- Cloud security — AWS GuardDuty + Inspector + Config (modeled estimate) — $10,800/yr
- Backup (immutable, RTO-tight) — Veeam Data Platform Foundation — $4,650/yr; the immutable repository is not priced
- DLP (PHI-specific) — Microsoft Purview — $16,800/yr
- WAF — AWS WAF + Shield Standard (modeled estimate) — $3,600/yr
Total: about $161k/year for the priced lines; the FortiGate 120G and the immutable repository are not priced. Roughly $800 per employee per year. The driver is PHI exposure: every component above either prevents PHI exfiltration, contains it when prevention fails, or proves to OCR that the company has reasonable safeguards.
Healthtech companies that go cheaper here typically end up paying it back later in HHS settlements. A single $1.5M HIPAA settlement (the average for breaches over 500 records) pays for most of a decade of the stack above.
Profile 4 — 200-person professional services firm, US-based, no specific regulatory regime
Lower threat exposure, no specific compliance forcing function, mostly knowledge workers on managed laptops.
- Identity (200 seats) — Google Workspace Enterprise Plus (incl. identity) — $84,000/yr
- Endpoint (200 endpoints) — Sophos XDR (formerly Intercept X Advanced with XDR) — $27,320/yr
- Email security — included in Workspace — $0
- MDM — Jamf for Mac (Jamf Pro + Connect + Protect; Mac-heavy fleet, 200 devices) — $30,000/yr
- SIEM — Sumo Logic Cloud SIEM Enterprise (Vendr median deal, not sized to 200 people) — $85,135/yr
- Cloud security — AWS GuardDuty + Security Hub (modeled estimate) — $4,800/yr
- Backup — Datto SIRIS — not priced (sold only through MSPs, price on request)
- WAF — Cloudflare WAF Business — $2,400/yr
Total: about $234k/year, before the backup line, which is not priced. Roughly $1,170 per employee per year. Two lines carry it: Workspace, which is large because it's bundled — identity, email, productivity, and security in one SKU — and the SIEM, whose catalog price is a median across real Sumo Logic deals rather than a quote sized to a 200-person firm.
What these numbers tell you
Three observations:
The "7-10% of IT budget" rule obscures the variance. At the same 200 people, the SaaS stack above costs about $436 per employee and the fintech stack at least $1,480. One percentage can't describe both.
Sector matters more than size. A 200-person fintech spends at least 3.4× what a 200-person SaaS company spends. The difference isn't because fintechs are 3.4× larger or 3.4× more sophisticated — it's because their regulatory load and threat exposure are categorically different.
The Balanced tier exists where it does for a reason. In the engine's own current run of these four 200-person profiles (its own picks, which differ from the illustrative stacks above), the Lean tier costs roughly 55-75% of its Balanced stack and the Advanced tier roughly 1.5-1.9×. The bell curve of "what most companies actually deploy" centers on the Balanced number because that's where the marginal dollar of spend stops returning meaningful risk reduction.
Why we publish these numbers
The security industry has spent two decades hiding behind "every situation is unique." Pricing pages disappeared, list prices vanished from vendor sites, and analyst firms charged five-figure sums to tell you what your competitors were paying.
That's not real. The numbers above are sourced from public pricing pages, public marketplace and reseller listings, and benchmark data from Vendr that's published openly. There's no proprietary information in this post.
The reason most security companies don't publish numbers like this is that the numbers reveal how much markup their products carry. Once you can see that a Sentinel deployment for a 200-person company costs about $15,695 a year at the catalog's modeled ingest and that the median Splunk deal on Vendr is $94,200, the conversation changes.
We think it's better to have that conversation honestly than to keep hiding it. So when CyberTwin produces a recommendation, every product in the stack carries its price, the source URL we got it from, and the date we last verified it — or says not priced, with the reason, when no citable price exists.
You can argue with our recommendations. You can argue with our priorities. You shouldn't have to argue with our numbers.
That's the point.
Update, September 2026. This post first ran on the catalog's April 2026 prices; every line above is now re-priced against the 2026-09-25 price pass. Fortinet has ended orders for the FortiGate 100F and 200F, so those lines now name the successor models, which the catalog does not yet price. The engine's current answer for twenty-four industry-and-size combinations, these four among them, is live on the Stack Builder, with every total dated to the day its prices were last checked.