Underinvestment in Cybersecurity: 57% of Companies Allocate Less Than 10% of IT Budgets

Spanish companies are grappling with an unprecedented surge in cyberattacks, yet investment in cybersecurity remains alarmingly low. According to the 2024 Cyber Preparedness Report, 57% of businesses allocate only 1–10% of their IT budgets to security measures¹. This trend persists despite the fact that 81% of organizations face costs of approximately €100,000 per major cyber incident¹. The disparity between threat levels and budgetary commitments raises critical questions about organizational resilience.

Budget Allocation Trends

The median company dedicates just 4% of its IT budget to cybersecurity, with 60% of IT leaders attributing this to a “lack of maturity” in security programs⁶. Regional disparities exist: Latin American banks allocate 7–10%⁸, while 32% of global enterprises spend only 1–3%⁴. These figures contrast sharply with the 66% year-over-year increase in cyberattacks reported in Spain during Q1 2025².

Emerging Threat Landscape

AI-driven threats now surpass human capabilities in phishing campaigns, with generative AI tools demonstrating higher success rates². This aligns with findings that 56% of firms report increased vulnerability due to AI adoption³. Meanwhile, operational technology (OT) environments show systemic weaknesses—55% contain four or more remote-access tools, creating exploitable entry points².

Metric	Value	Source
Companies allocating 1–10% of IT budget to security	57%	¹
Median security budget allocation	4%	⁶
Q1 2025 attack increase in Spain	66%	²

Industry Responses

Some organizations are adapting: 70% of firms plan budget increases, focusing on cloud security and ransomware defenses⁵. CyberArk recently launched an AI protection solution, while Palo Alto Networks exposed the “Slow Pisces” malware campaign targeting cryptocurrency firms via LinkedIn and GitHub². However, EU SMEs still lag 15% behind larger enterprises in implementing security controls².

Strategic Recommendations

Organizations should consider these steps:

Benchmark security spending against industry peers (e.g., banking sector averages)
Prioritize AI threat detection capabilities
Conduct OT environment audits to identify excessive remote-access tools

The data reveals a troubling gap between cyber risk and resource allocation. With threat actors increasingly leveraging AI, companies allocating less than 10% of IT budgets to security may face disproportionate consequences. Future research should examine whether budget constraints correlate with specific attack success rates.