» Resources » Eye Security Blog »
Cyber budgets have climbed every year for a decade. Attacks keep succeeding anyway. This gap tells us that the size of the budget was rarely the issue.
September is when European leadership teams set the budget allocation for 2027. Every department competes for the same investment, and cybersecurity has to earn its place alongside the rest. More cyber spending, however, does not reliably buy more protection. Past a certain point, it can even leave you less prepared than you were.
The budget question for 2027: Are you spending in the right places?
For years, cyber budgets rested on one assumption: keep attackers out. Stronger firewalls, better endpoint protection, more phishing training. Stack enough of it, and risk should fall away.
But threat actors have stopped forcing the front door. They now walk in through stolen credentials, compromised identities, and trusted third-party access, then operate as what looks like a legitimate employee.
In the business email compromise cases our team investigated last year, phishing and account takeover were the entry point in roughly 80% of incidents.
By the time traditional controls flag anything, the threat actor is already inside, operating as a trusted employee.
“The global trends call for an urgent pivot where organisations should operate from an assume-breach mindset.”
– Lodi Hensen, VP Security Alliances
This reframes the question leadership teams need to ask. From preventing every attack, the goal is shifting to answering one question:
This is the defining shift in cybersecurity thinking over the past five years. Success now comes down to how fast you detect, contain, and recover from the attacks that get through.
Who sees it. Who investigates. Who has the authority to contain it. Whether help is there at 2am on a Sunday. And whether the response is already funded, or whether you go looking for an emergency budget while the incident runs.
For a leadership team building the 2027 budget, the honest answers show where next year’s money belongs.
“Cyber resilience is now measured by how quickly an organisation can detect, contain, and learn from an attack. The organisations that thrive in this environment are the ones that respond with speed and coordination.”
– Lodi Hensen, VP Security Alliances
Security tooling, insurance, and incident response usually sit in three separate budget lines, owned by three separate people, with nobody reviewing the whole. That is how a business convinces itself it is covered while overlap piles up in one column and gaps open in another. The gaps stay invisible until an incident finds them, and then they get expensive fast.
Three capabilities carry most of the weight. Assess them together, and hold each to the same three questions: what does it cost, what gap does it leave, what happens without it.
“Resilience today is not the promise that technology will stop every attack; it’s the ability for humans and technology together to make the right decisions under uncertainty, at speed, in an environment you must treat as already compromised.”
– Lodi Hensen, VP Security Alliances
Most organisations already own tools that generate alerts. Far fewer have someone watching those alerts around the clock with the authority to act. That gap is the entire value of Managed Detection and Response (MDR), and the numbers make it concrete.
Our analysis of 630 cyber incidents found a median threat actor dwell time of 18 days in environments without continuous monitoring. With MDR in place, median dwell time dropped to 19 minutes.
Eighteen days gives an attacker time to read the mail, map the finance function, reroute an invoice, and pivot into your suppliers. Nineteen minutes gives you the chance to shut them down before any of that lands. Skip MDR, and every other investment on this list defends a building nobody is watching.
Read The State of Cyber Incidents 2026
Detection tells you something is wrong. Incident response is the team that picks up, investigates, and contains it, at speed, at any hour. Many organisations assume their MDR provider handles this end-to-end.
You can run MDR and still need a standalone incident response retainer. For many providers, standalone incident response (IR) retainers commonly start at €20,000+ annually for base readiness and guaranteed SLAs. Discover that gap during an incident and you face the worst version of it: you know you are breached, and nobody has the authority to act.
Insurance is where “prepared” and “covered” part ways. Hiscox’s Global Protection Gap Report 2025 found 74% of SMEs may be underinsured. Related research puts European cyber insurance penetration at just 7 to 15%.
Holding a policy is not the same as being protected by it. Leadership teams need to know where sublimits apply, what sits outside the cover, whether incident response needs the insurer’s prior approval, and which costs the business still absorbs. That makes insurance part of the resilience conversation. Bought without reading the fine print, it delivers the most expensive gap of all: the one you were sure you had closed.
Budget planning pushes hard for a single “right” number for cyber. No universal figure exists. Distribution matters far more than total: prevention, but also detection, response, recovery, and financial protection that holds when an incident becomes a business crisis. The budget conversation covers how you stop an attack. But even more so, it also covers what you have already paid for when one gets through.
Many teams already run dozens of products, each firing its own alerts, dashboards, and reports.
Every added platform brings another data source, another integration to maintain, another screen to watch. Past a point, the next tool stops adding protection and starts adding noise.
The smartest security investment is often not another product. Consolidate vendors. Improve integration. Invest in MDR that separates genuine threats from the background hum. Before approving another platform for next year, a leadership team should know what it already pays for. Which tools overlap. Which alerts anyone actually monitors. Who responds outside office hours. And what happens the moment one of those tools flags a real attack.
For leadership teams, that reactive stance is running out of room. NIS2, DORA, and the EU AI Act add more than technical requirements. They raise the bar on governance, resilience, and accountability, and national law across Europe now enforces them.
GDPR Article 33 demands breach notification within 72 hours. NIS2 adds further duties for critical sectors. During a live incident, while your team is still establishing what happened, what was accessed, and whether the threat is contained, three days evaporates.
The capabilities that let you hit that clock, detection, response, and a rehearsed process, cost far less built into next year’s budget than funded in a panic when a deadline or an incident forces it.
Cyber incidents now halt operations, delay production, dent customer confidence, and pull in regulators. The conversation has moved past IT and “what should we buy.” It runs on resilience and “how fast can we detect and contain an attack.”
The most useful move a leadership team can make is to drop the abstract framing of cyber risk. What does one full day without your core IT systems cost. Which revenue streams stop. Which customers go unserved. Which third-party systems can freeze operations.
Security investments deserve the same test as every other strategic investment: how much operational risk do they remove.
This is why budgets now flow toward capabilities that limit the impact of an attack, alongside the controls that try to prevent one.
Here is a stance most of the industry avoids: beyond a solid baseline, more prevention spending is the weaker investment. The next euro works harder on detecting and containing the attacks that get through than on raising a wall determined attackers already route around.
Our 630-incident analysis puts a figure on it. Eighteen days of undetected access against nineteen minutes is a step change, not a tweak. One outcome hands an attacker time to dig in across your business. The other stops them before they establish a foothold. MDR, continuous monitoring, threat hunting, and incident response planning all drive toward the same result: find malicious activity fast, contain it faster.
Budget planning comes down to choices. Every euro spent on cybersecurity is a euro spent nowhere else, so each one has to buy a real reduction in business risk. Before you approve the 2027 budget, your leadership team should be able to answer five questions:
The businesses that enter 2027 in the strongest position carry the capabilities that let them detect faster, respond earlier, and recover with confidence. Budget size is not what sets them apart. Where they put it is.
The question for 2027 is not how much you spend on cybersecurity. It is whether you spend it in the right places.
A lot can change in 12-months. Your business may have added new systems, suppliers, or employees. The amount of data you hold may have increased. Your security controls may have changed. And your current insurance policy may no longer offer the protection you think it does.
If a threat actor logged into one of your employees’ Microsoft 365 accounts right now, how long would it take you to notice?
The world’s most expensive cybersecurity systems have an awkward weakness. They trust the right people. And this is exactly what attackers are counting on.
