# Cybersecurity takes 4% to 10% of IT budgets

Markdown copy of https://realalpha.app/s/cybersecurity-takes-4-to-10-of-it-budgets/ on Real Alpha, the best minutes from long interviews with the people building AI. Cite and link the page, not this copy.

- Speaker: [Nikesh Arora](https://realalpha.app/people/nikesh-arora/) · Nikesh Arora is CEO of Palo Alto Networks. · Chairman and CEO of Palo Alto Networks, which he grew into a $300 billion cybersecurity leader.
- Host: [Chamath Palihapitiya](https://realalpha.app/people/chamath-palihapitiya/) · Founder & CEO, Social Capital · Led Facebook's growth team; his firm backed Slack and AI chipmaker Groq.
- Host: [Jason Calacanis](https://realalpha.app/people/jason-calacanis/) · Founder & CEO, LAUNCH · Early Uber angel; sold Weblogs Inc. to AOL; hosts This Week in Startups.
- Host: [David Friedberg](https://realalpha.app/people/david-friedberg/) · CEO, Ohalo · Founded The Climate Corporation, sold to Monsanto for about $1.1B in 2013.
- Show: All-In
- Episode: [AI Cyber Panic, Ken Griffin’s Bubble Warning, The Fall of France?](https://realalpha.app/v/6czo-C3FU7I/), Oct 23, 2026
- Moment: 35:55 to 40:04 of the episode (4 min), playing on https://realalpha.app/s/cybersecurity-takes-4-to-10-of-it-budgets/; the episode from there: https://realalpha.app/v/6czo-C3FU7I/?t=2155

## Quote

> “the cost is somewhere in the **4% to 10% range** for cyber. 10% is typically where you'll find financial services”
> — [Nikesh Arora](https://realalpha.app/people/nikesh-arora/) at [39:24](https://realalpha.app/v/6czo-C3FU7I/?t=2364) · All-In

## Takeaways

1. Maintenance often loses out to work on new products.
2. Self-hosted deployments create version drift for software vendors.
3. Cyber spend ranges from 4% to 10% of IT budgets.

## About this segment

Nikesh Arora explains why maintenance loses to new projects and why customized deployments drift apart. He puts cyber at 4% to 10% of IT budgets, with financial services near the top.

From “AI Cyber Panic, Ken Griffin’s Bubble Warning, The Fall of France?”, Oct 23, 2026. [Watch the full episode](https://realalpha.app/v/6czo-C3FU7I/)

## Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

[36:00](https://realalpha.app/v/6czo-C3FU7I/?t=2160) historically, have we just under and a lot of these causes of these cyber scares? Is this just all because corporations deprioritize security and technical debt, and that we just need to change that in this new world? And that will essentially solve the problem if we prioritize safety first? Nobody wants to work on this stuff. I mean, the problem is when you ship something into prod, everybody wants to work on like the next greatest thing. Nobody really thinks about like maintenance as like a sexy idea. That's one thing. Second thing is, if you actually deploy it inside of your own virtual private cloud, the problem is, the software vendors don't have this one version that's constantly updated, you have a drift problem where you have a version, Nikesh has a version, Freeberg has a version, they're all out of sync. And so now you know,

[36:43](https://realalpha.app/v/6czo-C3FU7I/?t=2203) you as a software vendor are maintaining 19 versions, because everybody has their own pace and cadence for upgrades and migrations. Then you have the fact that technologies are constantly changing and the underlying way in which things can happen change so rapidly but the way in which you've done it represents a sunk cost and you can't just rip and replace this stuff and you multiply that by millions of companies and hundreds of trillions of lines of code and this is why it is like it is and chamath also to add to that the incentive alignment problem the cios are not incented to maintain the most modern infrastructure they maintain to keep costs low and then maintain to keep everything available all the time so every time you want to upgrade something and introduce the risk of blowing up or going down it's like i don't want

[37:26](https://realalpha.app/v/6czo-C3FU7I/?t=2246) to go i don't want to go change everything all the time because all my users complain because you know what every time you upgrade something change something it causes friction in the system and then it costs money the last time your your cio showed up and you said yeah great have some more money and have a bigger budget because this is uh this is a real tragedy um and and you'll see this with like say the cia or the fbi if there's no terrorist attacks people are like we're spending too much money and it's like or we're spending the right amount of money because we haven't had a 9-11 again and when they come to us and say hey we need more because based on what we're seeing you know there could be another god forbid 9-11 and then congress or whoever's you know got the power of the purse at the given point in time says yeah you know we're not going to give

[38:07](https://realalpha.app/v/6czo-C3FU7I/?t=2287) you more money because we haven't had one in 20 years that that is really the core of this problem is they only get credit that's about to change because we're gonna have a bunch of 9-11s in cyber yeah guess what the phones keep ringing every day and the conversation always is now how do i get out of this because i'm tired of once getting punched in the face every morning when i wake up when people really appreciate the the sisso and and those groups uh when these things and the systems come back online and the system's been hacked it's going to be brutal the next uh year or so yeah it's going to be a big transition time nikesh i think i think you know the CIOs could become the next CEOs.

[38:44](https://realalpha.app/v/6czo-C3FU7I/?t=2324) Think about it. If you believe in three years from now, every business function of yours wants to transform themselves with AI. Let's go to the positive side, right? My CFO has never wanted AI. He's saying, dude, I could do all this financial analysis. Just appoint some people to my team. My marketing people want them. My HR people want them. So almost every function wants more AI people, which has never happened historically.

[39:06](https://realalpha.app/v/6czo-C3FU7I/?t=2346) Everybody wants AI people. If that's what's going to happen, every function is waiting for AI or technology people, they all want the CIO to come and help them, then who's the person running the company? What percentage do enterprises spend on security of their total spend and what should it be ideally? I'm just curious. We have no insight here. The insight is that typically if you're IT budget, the cost is somewhere in the 4% to 10% range for cyber.

[39:34](https://realalpha.app/v/6czo-C3FU7I/?t=2374) 10% is typically where you'll find financial services, the federal government, because they want to make sure things are secure and robust. 4% can either be cloud people, because that's where the hyperscaler would take care of infrastructure security for you. You just have to worry about application and software security. So it ends up at 4% to 5%. That's the range. You can get a 4% to 5% to 8% to 10%.

[39:54](https://realalpha.app/v/6czo-C3FU7I/?t=2394) Yeah. And that's going to have to go up. And there's an issue I think, as you're pointing out, if there is AI