The Three Ways Small Organizations Waste Their Security Budget

This is sometimes called shelfware: software that gets purchased, checked off a list, and then never fully implemented. A 2015 study from Osterman Research, sponsored by Trustwave, found that roughly 28 percent of security software spending went underused or unused, and in some organizations as much as 60 percent of purchased security software sat essentially unused. The study is more than a decade old, but the pattern it describes has not gone away, and the reasons behind it are still familiar.

The reasons are mundane, not embarrassing. In that research, the most common explanations were that IT was too busy to implement the tool properly, the organization lacked the resources to operationalize it, or staff simply did not understand the software well enough to configure it correctly. None of that is a character flaw. It is what happens when a tool gets bought to solve a budget-cycle problem (get something purchased before the fiscal year ends) rather than a specific, understood risk.

For a small organization, this risk is actually higher than for a large one, because there is no dedicated person whose job is to make sure a purchased tool gets fully turned on. The invoice gets paid. The configuration gets left at whatever the default was during setup.

This blog's earlier post on nonprofit myths covered the mechanics: when the controls an organization attested to at enrollment (MFA, tested backups, documented access management) are not actually in place when an incident happens, coverage can be disputed or denied. And even when a claim is paid, the policy rarely covers everything. NetDiligence's 2025 Cyber Claims Study found that over five years, insurance paid about 69 percent of total incident costs for small and mid-size businesses. The rest, including the retention an organization pays before coverage starts, came out of its own budget. The budgeting version of this myth is subtler. It is not "we don't need controls because we have insurance." It is treating the insurance premium as if it were the security budget, so the actual controls spending from Post 2 of this series never gets funded.

Insurers have caught on to this pattern faster than most policyholders. Underwriters increasingly require proof of specific controls, not just an attestation on a form, before they will bind coverage at all, and premium discounts are increasingly available to organizations that can document real controls. The organizations getting the best insurance terms right now are the ones spending on controls first and treating the policy as what is left over, not the other way around.

This blog's incident response series covered the version of this problem specific to response plans: a plan that never gets revisited goes stale: the named decision-maker leaves, the call list has an old phone number, and nobody finds out until the plan is actually needed. The same decay applies to every other control in this series. A password manager rollout that never gets audited drifts back toward reused passwords as new hires arrive. A backup that was tested once, two years ago, is an assumption again.

The organizations that avoid this pattern do not spend more in total. They spend the same or less, distributed across the year instead of concentrated into a single annual push, with a recurring review built into the calendar rather than treated as optional. A modest, sustained budget outperforms an occasional large one, because security is a condition to maintain, not a project to finish.