How many cybersecurity staff does a company need?

There is no universal ratio (like '1 security person per 100 employees') that holds across industries, because staffing need tracks risk exposure, not headcount. A 50-person fintech handling payment data has materially higher security staffing need than a 500-person company with low-sensitivity data and minimal regulatory exposure. Start from your actual data sensitivity, regulatory obligations (PCI-DSS, HIPAA, SOC 2, GDPR), and infrastructure complexity (cloud footprint, number of applications, third-party integrations), not from a headcount formula.

For companies under roughly 100 employees, a fully in-house team is usually not cost-effective. A fractional vCISO for strategic direction plus a managed detection and response (MDR) provider for 24/7 monitoring typically covers the need at a fraction of the cost of even two full-time hires, and the round-the-clock coverage that a single in-house hire cannot provide alone.

For companies in the 100 to 1,000 employee range, a small dedicated team (1 to 5 people) covering a working lead, one or two SOC/detection-focused staff, and a GRC-focused staff member, supplemented by managed services for after-hours monitoring, is a common and defensible structure. This range is also where the entry-level-versus-experienced staffing tradeoff (see entry-level-vs-experienced-cybersecurity-hire) starts to matter, since a small team needs at least one experienced lead who can handle ambiguous incidents.

For companies above roughly 1,000 employees, or any company with significant regulatory exposure regardless of size, a full internal team spanning SOC (Tier 1 through Tier 3), GRC, security engineering, and a dedicated CISO or VP Security becomes standard. At this scale, the cost of an internal team is justified by the volume of alerts, audits, and engineering integration work that a fractional model cannot absorb.

Regulatory exposure can override the headcount-based benchmark entirely. A 30-person healthcare startup handling protected health information has HIPAA-driven security and compliance obligations that push its effective staffing need closer to what a much larger company would need in a lower-regulation industry.

Budget benchmarking: industry surveys commonly cite security spend in the range of 8 to 15% of total IT budget for regulated industries, lower for less-regulated ones; use this as a sanity check against your staffing plan rather than a hard target, since spend composition (staff versus tooling versus managed services) varies by maturity stage.

DecipherU for Teams supports staffing decisions at every stage of this curve: standardized assessments help a lean team hire its first few staff correctly, and the same infrastructure scales to screening a full SOC-through-CISO team as the organization grows. See the related answer entry for why-is-it-hard-to-hire-cybersecurity-talent for the market context shaping how competitive each of these hires will be.