Twenty Percent More, Spent Wrong: What Security Leaders Actually Want Versus What Procurement Delivers

Pose a hypothetical to a room of CISOs—say, a permanent 20% budget increase, no strings attached—and a curious pattern emerges. Almost nobody asks for another product. The wish lists cluster around people, time, and consolidation: two additional analysts, a dedicated detection engineer, paid hours for tabletop exercises that currently happen after hours. The contrast with actual spending patterns is stark, and it says something uncomfortable about how security budgets get built in American mid-market companies.

What the Wish Lists Say

In conversations with practitioners across manufacturing, healthcare services, regional finance, and logistics—sectors that form the backbone of the US mid-market—the same three priorities surface repeatedly.

Staffing before tooling. The most common request is headcount, specifically senior analysts who can tune detections and close the gap between alerts and action. Several leaders noted they own tools whose advanced features have never been configured because nobody has the cycles to learn them.

Consolidation over expansion. The second theme is subtraction. Leaders describe stacks of overlapping products acquired during a three-year spending surge, each with its own console, contract renewal date, and alert format. Given new money, many would rather rip out two tools than add a third.

Rehearsal time. The third wish is almost always unbudgeted today: dedicated time for tabletop exercises and purple-team sessions. Practitioners consistently describe incident response plans that exist on paper but have never survived contact with a realistic scenario.

What Actually Gets Bought

Then compare that list to purchase orders. The mid-market security spend continues to flow toward endpoint agents, email gateways, and—increasingly—anything with an AI-forward brand name. The drivers are rarely threat-informed.

Compliance inertia plays a large role. A SOC 2 audit or cyber insurance questionnaire creates a checklist, and checklists map neatly to products. A control that says "monitoring in place" is satisfied fastest by buying a box, not by hiring the person who would make monitoring meaningful.

Vendor pressure supplies the rest. Mid-market IT teams are frequently outgunned in procurement conversations—vendors bring dedicated sales engineers, ROI calculators, and analyst citations, while the buyer brings a spreadsheet and a day job. The result is a budget shaped by what is easy to buy rather than what is needed to defend.

Why the Gap Persists

The structural explanation is simple: staffing and rehearsal produce no line item a board can point to, while a platform purchase produces a contract, a logo, and a checkbox. A security leader who spends $300,000 on analysts and nothing visible can be second-guessed in any budget review. One who buys a named product has an artifact to defend the spend.

Insurance dynamics compound this. Questionnaires reward tooling signals, not organizational maturity, so rational buyers optimize for the questionnaire.

A Modest Proposal for the Next Budget Cycle

For IT leaders planning FY budgets, three reframings are worth considering:

1. Price the gap, not the product. Before evaluating any new platform, document which alerts currently go uninvestigated and which response steps have never been rehearsed. If the answer is "most of them," the constraint is people and practice, not capability.

2. Treat consolidation as a security control. Retiring a redundant tool reduces alert noise, shrinks the attack surface, and frees budget for staffing. Put it on the roadmap with the same formality as an acquisition.

3. Budget for failure, not just prevention. A line item for tabletop exercises and third-party incident response retainers will never appear in a vendor pitch deck, yet it addresses the scenario that ends most mid-market companies that fail after a breach.

The twenty-percent hypothetical is useful precisely because it strips away procurement gravity and reveals what practitioners believe matters. The discipline for leadership is closing the distance between that answer and the actual purchase order—because adversaries are not waiting for the next renewal cycle.