Lets assume the product is pure software or a blend of software and cheap commodity hardware.
Is there any work showing what the average industry spending is on just the security aspects as a percentage of the total product development costs?
I do see this post but that only talks about estimating absolute $ figures from bottom-up. I'm looking for a relative or % of the total budget figure for a top-down assessment. I understand the range might not be as tight as we'd like
EDIT: We are the developers (SMB, veteran owned), presenting to the customer(s) (US Govt entities) to protect critical infrastructure. Product can be thought of a system running custom software on commodity embedded hardware. There will also be a web-application for the same customer for a similar focus (protect/monitor critical infra), but that's being tracked as a separate product/budget. So also interested in that.
EDIT#2: One can totally argue that the context means the costs are "inherent" or 100%. We got some push back saying "Can be built by gluing A, B and C at $XYZ. That is insecure, we know but why the extra 60% just to make it more secure?"