The headline from Security magazine’s 2026 Security Benchmark Report will be repeated in every industry newsletter this month: a majority of security leaders (62%) reported a budget increase over last year. It reads like recovery. It is not.
Read one table further and a different picture appears. Security leaders who received an increase averaged 5%. Those who were cut averaged 20%. And the share of programs cut (23%) matches the highest share the report has recorded in five years. Budget is tied for the fourth-largest concern security leaders report, behind workplace violence, extremism and crisis management.
The common response is to argue for more money. Our view runs the other way. A budget cut is not the problem; it is evidence of one. In Enterprise Security Risk Management (ESRM) terms, every budget decision is a risk decision made by the business. When the cut arrives, it tells you that the business, not security, decided which risks to accept, and that security was not in the room when that decision was made.
The Budget Math: More Programs Grew, but the Field Lost Ground
The report's year-over-year tables (p. 21) tell the story the headline does not:
Year Increased Decreased Average increase Average decrease
2026 62% 23% 5% 20%
2025 50% 17% 12% 7%
2024 67% 8% 34% 29%
A simple weighting of the 2026 figures (62% of programs gaining 5%, 23% losing 20%) suggests the average respondent's budget moved down by roughly 1.5 percentage points. More programs grew; the field, taken as a whole, lost ground. The increases were modest adjustments. The cuts were reductions in capability.
Consider what a 20% cut means in practice. It is rarely trimmed evenly. It removes a contract guard post, defers a technology refresh, or cancels a training cycle. Each of those choices changes the organization's exposure. Yet in most organizations, no one records the change in risk that accompanies the change in spend.
The Contradiction: Value Metrics and Shrinking Budgets
Here is the finding that should give every security executive pause. 81% of respondents say they maintain a metrics program that clearly defines productivity, value creation and cost avoidance (p. 31). If four in five programs can demonstrate their value, why did nearly one in four lose a fifth of their budget?
The answer appears on the next page. The metrics respondents named as most impactful with the C-suite were safety trends, ROI, audit and compliance ratings, calls for service, response times and staffing (p. 32). Most of these are activity metrics. They describe how busy security is. They do not describe which business objectives are exposed, by how much, and what the organization accepts when it spends less. Executives do not cut what they understand to be protecting revenue; they cut what looks like overhead.
The Real Issue: Who Makes the Risk Decision
The report also shows how far many security programs sit from the decisions that drive budget (pp. 6, 11–12):
Aligning security with the business: owned or led by security in only 57.6% of programs.
Risk assessments and enterprise risk management: owned or led in 45.4%.
Business expansion support: owned or led in 9.1%.
Mergers, acquisitions and site expansion or contraction: owned or led in 0%; 54.5% are not involved at all.
Reporting line: 26.7% of programs report to risk or legal, 23.3% to operations, and only 13.3% to the CEO.
Military risk management offers a useful discipline here. U.S. Army doctrine (ATP 5-19, Risk Management) directs that risk decisions be made at the appropriate level, by the leader who holds both the authority to accept the risk and the resources to control it. A budget cut is exactly that kind of decision. When security is absent from the strategic conversation, the decision is still made; it is simply made without anyone stating the risk being accepted.
What to Do About It: Four ESRM Moves
Treat every cut as a risk acceptance decision. When a reduction is proposed, document what capability is lost, which risks change, and who in the business is accepting the residual risk. Ask that executive to sign it. Most cuts look different once someone must own the consequence.
Replace activity metrics with risk metrics. Calls for service and response times have their place in operations. In the boardroom, report exposure against business objectives: which revenue streams, sites, people and obligations are protected, and what changes if funding changes.
Get into the room before budget season. The report shows security is largely absent from M&A and expansion planning. Those are the decisions that create new risk and set next year's priorities. Ask to be part of them, and bring a risk perspective rather than a spending request.
Benchmark against your risk profile, not your peers' spending. The report's average security budget of 1.32% of revenue (p. 19) is pulled up by one sector at 5.39%; four of the five reported sectors fall between 0.21% and 0.41% (p. 20). A peer average tells you what others spend, not what your risks require.
The Bottom Line
A security budget is not a measure of protection; it is a record of the risks leadership has chosen to accept. Security leaders who spend this season defending their budget line will keep losing the argument. Stop asking how to protect the budget, and start asking which risks the business is prepared to own.
A note on the data: the report does not publish its sample size, and percentages on several charts move in steps of about three points, which suggests roughly 30 respondents answered those questions. Treat the findings as directional signals, not industry-wide measurements.
Do not wait for the next budget cycle to reveal how your security program is perceived. Cider Hill Consulting offers an independent Security Program Assessment that measures your program against the risks your business actually faces and gives your executives a clear basis for risk decisions. Contact us to begin the conversation.
Sources: The 2026 Security Benchmark Report, Security magazine, November 2026. U.S. Army, ATP 5-19, Risk Management (2021), Army Publishing Directorate.
