Lets assume the product is pure software or a blend of software and cheap commodity hardware.

Is there any work showing what the average industry spending is on just the security aspects as a percentage of the total product development costs?

I do see this post but that only talks about estimating absolute $ figures from bottom-up. I'm looking for a relative or % of the total budget figure for a top-down assessment. I understand the range might not be as tight as we'd like

EDIT: We are the developers (SMB, veteran owned), presenting to the customer(s) (US Govt entities) to protect critical infrastructure. Product can be thought of a system running custom software on commodity embedded hardware. There will also be a web-application for the same customer for a similar focus (protect/monitor critical infra), but that's being tracked as a separate product/budget. So also interested in that.

EDIT#2: One can totally argue that the context means the costs are "inherent" or 100%. We got some push back saying "Can be built by gluing A, B and C at $XYZ. That is insecure, we know but why the extra 60% just to make it more secure?"

  • 2
    The range is from 0-100%, depending on industry being sold to and the nature of the product. You are going to need a lot more detail if you want a more detailed response. – Tim Brigham Jul 2 '14 at 20:26
  • @schroeder: Sorry, added more context. – Cat Nap Jul 2 '14 at 20:31
  • You have to conduct a detailed, bottom-up threat & risk (CYA) analysis of all relevant alternatives. A horde of Eastern Asian hackers eagerly awaits the results. Top-down stuff doesn't translate well between projects. – Deer Hunter Jul 2 '14 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.