European CISOs, WG 3

Cybersecurity Budgets: Ownership, Reporting, Trends

February 13, 2025

The ECSO CISO Community presents a survey analysis providing CISOs and their corresponding organisation’s stakeholders with a broader perspective and better understanding on the ownership, cost reporting and budgets structure in the cybersecurity area. The responses provide valuable insights on existing practices and desired changes in cybersecurity cost reporting. A unique aspect of this survey is a focus on comparing the current situation of respondent organisations with what CISOs would like to see. This survey aims to answer pivotal questions such as:

• Which labour costs should be counted as cyber costs?
• What is the status of cyber cost reporting in your organisation?
• Which tools, services and capabilities related costs are counted as cyber costs?

The objective of this survey is to raise awareness on cybersecurity cost reporting and to enhance general knowledge among the interested public.

About the ECSO CISO Community

The ECSO CISO Community hosts Chief Information Security Officers (CISOs) and other cybersecurity experts working closely with CISOs*, from all across Europe and sectors. Its objective is to promote the exchange of information, good practices, threat intelligence, and to develop common positions of cybersecurity practitioners. To achieve this, the ECSO CISO Community provides regular discussions on topics of general interest to CISOs with a variety of backgrounds and experience levels.

About the ECSO Working Group on Cyber Threat Management

The author of this paper is the ECSO Cyber Threat Management Working Group. The mission of this group is to provide support to organisations in tackling cyber threats, creating an environment for practitioners and end-users in cybersecurity where they can share information, lessons learned and best practices to increase cyber resilience of European companies and organisations.