Build credibility, generate qualified enterprise pipeline, and win deals in the trust-driven cybersecurity market.
Book a Free Strategy CallA fractional CMO for cybersecurity companies gives you senior marketing leadership - strategy, team oversight, and execution direction - at a fraction of the cost of a full-time hire. Engagements typically run $8,000-$15,000/month and deliver results within 90 days.
By Mark Gabrielli, Fractional CMO and COO. Mark has built demand generation systems and led marketing teams behind $135M+ in qualified B2B pipeline for clients, holds a 90% client retention rate, and works with growth-stage companies across 370+ US cities.Cost benchmarks, category priorities and compliance requirements on this page were last checked on 20 August 2026. Crawler, framework and pricing data drift; treat any figure here as unverified after 20 November 2026.
Last updated: 10 August 2026
Cybersecurity fractional CMO engagements price by scope and weekly time commitment, not by headcount. The ranges below reflect current 2026 US market pricing, with a full-time security CMO shown as a reference point. Below roughly $2M-$20M ARR, and before a Series B, a full-time cyber CMO at $200,000-$350,000 per year plus equity is rarely justified - a fractional CMO delivers the same senior judgment at a fraction of the fixed cost.
| Engagement Type | Typical Monthly Cost | Time Commitment | Best For |
|---|---|---|---|
| Advisory / strategy only | $7,000-$9,000 | ~8-10 hrs/wk | Founders who need positioning, messaging, and a GTM plan their team can run |
| Standard fractional CMO | $9,000-$13,000 | ~10-18 hrs/wk | Companies with a small marketing team that needs senior direction and accountability |
| Embedded / GTM build | $13,000-$18,000 | ~18-25 hrs/wk | Post-Series-A teams building demand gen, ABM, and analyst relations from scratch |
| Full-time CMO (reference) | $16,700-$29,200 equivalent | 40 hrs/wk | $200,000-$350,000/yr plus equity, recruiting fees, and severance risk |
Ranges reflect typical US cybersecurity-sector fractional CMO pricing as of August 2026 and vary with scope, seniority, and deal stage. Figures are market ranges, not quotes. The full-time row converts a $200,000-$350,000 annual salary to a monthly equivalent.
Why the math favors fractional in security (reviewed August 2026): cybersecurity and B2B-SaaS companies run some of the highest marketing budgets in tech, roughly 12 to 20 percent of revenue at scale, versus a 7.8 percent cross-industry average in the 2026 Gartner CMO Spend Survey, which polled 401 marketing leaders across North America, the UK and Europe between January and March 2026 and found budgets essentially flat against 7.7 percent in 2025. That spend has to work harder here: median cost per sales-qualified lead in security runs $1,200 to $3,500, sales cycles stretch 6 to 18 months, and a 6-to-10-person buying committee has to be moved through multiple touchpoints. Below a Series B, a full-time cyber CMO at $250,000 to $570,000 in total compensation is hard to justify against that budget, while a fractional CMO at roughly $60,000 to $180,000 per year buys the same senior demand-gen and category-positioning judgment that decides whether the spend converts.
| Benchmark | Cybersecurity / B2B-SaaS | Why it favors fractional |
|---|---|---|
| Marketing budget as a share of revenue | 12-20% at scale (vs 7.8% cross-industry average, Gartner 2026) | High spend has to convert; senior judgment protects the budget |
| Median cost per sales-qualified lead | $1,200-$3,500 | Expensive leads punish weak targeting and messaging |
| Enterprise sales cycle length | 6-18 months | Content and analyst-relations infrastructure must be built before pipeline shows |
| Buying committee size | 6-10 stakeholders | Multi-persona ABM and CISO-grade positioning, not a single campaign |
| Full-time cyber CMO total compensation | $250,000-$570,000/yr plus equity | Hard to justify below a Series B against the budget above |
| Fractional CMO (same senior judgment) | $60,000-$180,000/yr | Roughly 25-45% of a full-time hire, no recruiting fee or severance risk |
Budget-share figure from the 2026 Gartner CMO Spend Survey; cost-per-SQL, sales-cycle, and buying-committee figures are typical cybersecurity and B2B-SaaS demand-gen benchmarks. Values are market ranges, not quotes, and vary by segment and stage.
Three things, from one federal dataset. First, most cybersecurity buyers do not work at technology companies: of the 190,650 information security analysts the federal wage survey counts, 43,440 (22.8 percent) work in computer systems design and 4,830 (2.5 percent) in software publishing, while banking, insurance and corporate holding companies together employ 45,080 (23.6 percent). Second, the industry pay premium in this sector lands on the marketing side, not the security side: a marketing manager in computer systems design earns 16.5 percent above the all-industry median, an information security analyst in the same industry 2.5 percent. Third, loading those wages with the employer's own benefit costs puts a full-time marketing leader at a cybersecurity services firm at $287,700 a year, or $24,000 a month, before equity or recruiting. Source: BLS Occupational Employment and Wage Statistics, May 2025 release, pulled 20 September 2026 through the public API.
| Industry | Information security analysts employed | Share of national total |
|---|---|---|
| Computer systems design and related services | 43,440 | 22.8% |
| Management of companies and enterprises | 19,390 | 10.2% |
| Credit intermediation (banking) | 16,840 | 8.8% |
| Management and technical consulting | 12,480 | 6.5% |
| Insurance carriers and related | 8,850 | 4.6% |
| Scientific research and development | 7,610 | 4.0% |
| Engineering services | 7,230 | 3.8% |
| Computing infrastructure, data processing, hosting | 6,890 | 3.6% |
| Educational services | 4,920 | 2.6% |
| Software publishers | 4,830 | 2.5% |
| Telecommunications | 4,030 | 2.1% |
| Aerospace product and parts manufacturing | 3,660 | 1.9% |
| Computer and electronic product manufacturing | 3,130 | 1.6% |
| Local government (ex schools/hospitals) | 2,880 | 1.5% |
| State government (ex schools/hospitals) | 2,440 | 1.3% |
| Ambulatory health care | 1,470 | 0.8% |
| Investigation and security services | 690 | 0.4% |
| Computer and peripheral equipment mfg | 460 | 0.2% |
| Federal executive branch | 280 | 0.1% |
| All industries, national total | 190,650 | 100.0% |
Table 13. Where the people who buy cybersecurity actually work. Employment of information security analysts (SOC 15-1212) by industry, BLS Occupational Employment and Wage Statistics, May 2025 release, pulled 20 September 2026. The industries listed cover 151,520 of the 190,650 analysts counted nationally (79.5 percent); the remainder sit in industries not queried. The federal executive branch figure is published here as the series reports it and is too small to represent federal cybersecurity staffing, so no claim on this page rests on it.
The pay figures outside technology point the same way. The median information security analyst earns $131,220 in banking, $126,130 in insurance, $128,950 at corporate holding companies and $125,420 in management consulting, against $129,180 across all industries. Whatever else varies about a security buyer, what they are paid barely does, which is one reason industry is a weak segmentation variable here while headcount and compliance obligation are strong ones.
| Occupation and percentile | All industries | Computer systems design | Software publishers | Computing infrastructure and hosting |
|---|---|---|---|---|
| Marketing managers, median | $166,790 | $194,300 (+16.5%) | $206,400 (+23.7%) | $188,490 (+13.0%) |
| Computer and information systems managers, median | $175,140 | $179,510 (+2.5%) | $202,250 (+15.5%) | $179,470 (+2.5%) |
| Information security analysts, median | $129,180 | $132,410 (+2.5%) | $144,970 (+12.2%) | $129,810 (+0.5%) |
| Marketing managers, 90th percentile | $293,610 | $299,730 (+2.1%) | $322,310 (+9.8%) | $303,640 (+3.4%) |
| Computer and information systems managers, 90th percentile | $297,510 | $301,410 (+1.3%) | $313,390 (+5.3%) | $309,460 (+4.0%) |
| Information security analysts, 90th percentile | $199,850 | $206,920 (+3.5%) | $221,690 (+10.9%) | $239,990 (+20.1%) |
Table 14. The industry pay premium in cybersecurity lands on the marketing side, not the security side. Annual wage, BLS OEWS May 2025. Percentages in brackets are the premium over the same occupation's all-industry figure. There is no cybersecurity NAICS code, so computer systems design and related services is used as the closest industry proxy and it also contains IT firms that do no security work.
The premium is not flat across the distribution, and quoting the median one as if it were would overstate what a senior hire costs. At the 90th percentile the marketing-manager premium in computer systems design falls to 2.1 percent and in software publishers to 9.8 percent, while the analyst premium in computing infrastructure rises to 20.1 percent. The top of the marketing leadership market is priced close to a national market; the middle is priced by industry.
| Employer's industry | Median wage | Loaded median cost | Monthly equivalent | Loaded 90th percentile |
|---|---|---|---|---|
| All industries | $166,790 | $247,000 | $20,600 / mo | $434,800 |
| Computer systems design and related services | $194,300 | $287,700 | $24,000 / mo | $443,900 |
| Software publishers | $206,400 | $305,700 | $25,500 / mo | $477,300 |
| Computing infrastructure, data processing, hosting | $188,490 | $279,100 | $23,300 / mo | $449,700 |
Table 15. What a full-time marketing leader costs a cybersecurity employer once the employer's own benefit costs are added. Wage is the BLS OEWS May 2025 figure for marketing managers (SOC 11-2021). Loaded cost multiplies the wage by 1.4809, the ratio of total compensation (88.63 dollars per hour) to wages and salaries (59.85 dollars) for management, business and financial occupations in private industry, BLS Employer Costs for Employee Compensation, 2026 Q2, the same basis this site uses on its fractional CMO cost and SaaS pages. Equity, bonuses above the survey definition, recruiting fees and severance are excluded.
This corrects a row in Table 1 above, and the correction is published rather than quietly applied. Table 1 shows a full-time cyber CMO at $200,000 to $350,000 a year and converts that to $16,700 to $29,200 a month. That conversion divides a salary by twelve; it is not what the employer pays. Loading the same salary band at the ECEC ratio used in Table 15 gives $24,700 to $43,200 a month, about 48 percent higher, and that is before equity or recruiting fees. The page's own later figure, $250,000 to $570,000 in total compensation, is consistent with the loaded band; the monthly cells in Table 1 are not. The sales copy has been left exactly as published, because changing a price range is an editorial decision, not a data one.
Limits of this data. OEWS pools three years of survey responses, so a single release is not a one-year reading. Industry is coded at the establishment, so a security engineer employed by a bank is counted in banking, not in technology. Wages exclude benefits, equity and bonuses outside the survey definition, which is why Table 15 applies a separate federal load factor, itself a broad occupational-group average rather than a cybersecurity figure. There is no cybersecurity industry code and no CMO occupation code, so both are proxies. The federal executive branch figure in Table 13 is reported as the series publishes it and no claim here is built on it.
Mostly not at technology companies. The BLS May 2025 wage survey counts 190,650 information security analysts in the United States. Computer systems design and related services, the industry most security vendors and consultancies sit in, employs 43,440 of them (22.8 percent). Software publishers employ 4,830 (2.5 percent). Banking, insurance and corporate holding companies together employ 45,080 (23.6 percent), about 2.4 times the software, hosting, telecom and computer-hardware industries combined. A campaign aimed only at tech-company security teams reaches roughly a quarter of the buying population.
Yes, and it is larger than the premium they pay their security staff. In computer systems design the median marketing manager earns $194,300, 16.5 percent above the all-industry median, while the median information security analyst in that same industry earns $132,410, only 2.5 percent above the national figure for that occupation. In software publishers the gap is wider: marketing managers 23.7 percent above national, analysts 12.2 percent. Across the same four industry cuts the marketing-manager median varies by 23.7 percent and the analyst median by 12.2 percent. Security talent is priced close to a national rate; senior marketing talent is not.
About $287,700 a year, or $24,000 a month, at the median. That is the BLS May 2025 median wage for a marketing manager in computer systems design ($194,300) loaded at 1.4809, the federal ratio of total compensation to wages for management occupations in private industry. At the 90th percentile the loaded figure is $443,900. Equity, recruiting fees and severance sit on top of all of these, because the wage survey excludes them.
No. The federal occupation classification has no CMO line. Employers code the role as a marketing manager or as a chief executive, so any federal figure for a CMO is a proxy built from one of those two. There is also no cybersecurity industry code, so the figures on this page use computer systems design and related services as the closest proxy, an industry that also contains IT firms doing no security work. Both limits are why this page quotes ranges and names the occupation code rather than claiming a CMO salary.
This is one of the most common challenges cybersecurity companies face without dedicated marketing leadership.
Without a senior strategist, marketing efforts lack the cohesion needed to drive compounding results.
This gap between marketing activity and business results is exactly what a fractional CMO is built to close.
A fractional CMO who knows how to build trust and authority in the security space - from analyst relations and thought leadership to ABM campaigns targeting security-conscious enterprise buyers.
Most B2B marketing playbooks do not work in cybersecurity. The buyers are technical, deeply skeptical, and have seen every fear-based campaign that has ever been run. Messaging built around breach statistics and worst-case scenarios may generate awareness, but it rarely generates qualified pipeline - and it never builds the trust that closes a $250K enterprise contract.
Security buyers - CISOs, VPs of IT Security, and security architects - buy from vendors they trust. Trust is built through credibility, not urgency. That means original research, third-party validation, peer recommendations, and a consistent track record of saying accurate, useful things over time. The companies that win in this market are not the ones with the loudest ads. They are the ones that show up at the right analyst briefings, publish the right threat reports, and get quoted by the right journalists.
The buying process is also fundamentally different. Security purchases go through committees. A CISO rarely makes a final buying decision alone - procurement, legal, finance, and the board all get involved in enterprise deals. That means your marketing must speak to multiple stakeholders, address compliance and risk concerns proactively, and build consensus across the organization rather than targeting a single decision-maker.
A fractional CMO who understands this dynamic will build a marketing program around trust-first positioning. That means leading with expertise, not fear. It means building content that earns its place in a CISO's reading list rather than fighting for attention in a crowded inbox. And it means aligning every marketing touchpoint to the way security buyers actually make decisions - slowly, carefully, and with a lot of internal review.
The scope of fractional CMO work in cybersecurity spans the full go-to-market function. Whether your company sells endpoint detection, cloud security, identity and access management, GRC platforms, or managed security services, the strategic challenges are similar: how do you build credibility with enterprise buyers, generate consistent pipeline, and differentiate in a crowded market where every vendor claims to be the best?
GTM strategy: Defining your ideal customer profile, positioning your product in the context of the competitive landscape, and mapping the full buyer journey from first awareness through renewal. For security companies, this includes understanding where your buyers seek information - analyst reports, industry publications, peer communities, and conferences - and building a presence in those channels.
ABM campaigns: Account-based marketing is especially well-suited to cybersecurity because the total addressable market is often concentrated. Instead of casting a wide net, ABM programs target specific high-value accounts with personalized outreach, relevant content, and coordinated sales and marketing motions. This approach generates fewer but far more qualified conversations.
Analyst relations: A placement in a Gartner Magic Quadrant or a Forrester Wave is worth more than most paid media campaigns combined. Building an analyst relations program from scratch - or improving an existing one - is one of the highest-ROI activities a fractional CMO can drive for a growing security company.
Content strategy: Threat intelligence reports, technical white papers, CISO roundtables, and executive briefings. Security content that earns trust by being genuinely useful to practitioners - not content that exists only to generate leads.
Partner and channel marketing: Most enterprise security deals involve channel partners. Building co-marketing programs, partner enablement content, and deal registration structures for MSSPs, VARs, and resellers is a core part of scaling a security company's revenue engine.
Conference strategy: RSA Conference, Black Hat, Gartner Security Summit, and regional events each serve a different function in the buyer's journey. A fractional CMO ensures your conference presence is strategic, not just a booth rental - from speaking submissions to pre-event account outreach to post-event follow-up sequences.
Content is the foundation of trust-led cybersecurity marketing, but not all content is created equal. The content that moves enterprise security buyers is original, data-driven, and technically credible. Generic blog posts and recycled vendor content get ignored. Original threat research, data reports, and benchmark studies get read, shared, cited, and linked to - which compounds into SEO authority and brand credibility over time.
Original research and data reports are the highest-earning link assets in cybersecurity marketing. An annual State of [Category] report, built around proprietary data from your customer base or a commissioned survey, can generate press coverage, analyst attention, and inbound links that no amount of paid promotion can replicate.
Security-specific SEO requires understanding both technical search intent (practitioners looking for how-to guidance) and informational intent (executives researching vendors and categories). A fractional CMO builds a content architecture that captures both - ranking for the terms buyers use early in their research process and converting that traffic into qualified pipeline.
CISO-targeted newsletters and executive briefings build an owned audience of senior security leaders. When your content lands in a CISO's inbox every week and earns a read, you have a distribution advantage that no competitor can easily replicate.
Community strategy matters in security. ISAC participation, active presence in LinkedIn security communities, and engagement in Slack communities frequented by practitioners puts your brand in front of buyers in a context where they are actively discussing problems you solve.
Video content - product demos, explainer videos, and analyst interviews - converts well for security buyers who are evaluating solutions. A short, well-produced demo video that shows your product solving a real problem is more persuasive than a 20-page technical white paper for most mid-level buyers.
The right time to bring in a fractional CMO is when you have a real business need for senior marketing leadership but hiring a full-time CMO at $250K+ per year is not yet justified by your revenue or growth stage. The scenarios below map common situations to what they actually mean for your marketing needs.
| Scenario | What It Means |
|---|---|
| Revenue $3M-$30M, no CMO | Perfect timing for fractional - you need strategic leadership without the full-time cost |
| Series A or B just closed | Need to build the GTM engine now - investors expect pipeline metrics within 12 months |
| Preparing for acquisition | Need pipeline and brand proof that makes the business more attractive to strategic buyers |
| Losing deals to better-marketed competitors | Need strategic positioning and messaging that wins the credibility battle before the demo |
| Marketing team exists but lacks direction | Need CMO leadership layer to align team efforts to revenue outcomes |
"Cybersecurity marketing" is not one motion. The right first move changes with the category you sell into, because the buyer, the sales cycle, and the credibility bar are different for an EDR vendor than for a GRC platform or an MSSP. The table below maps the six categories a fractional CMO sees most often to their primary buyer, their hardest marketing challenge, and the first move that moves pipeline. It is a positioning framework, not a pricing table.
| Security category | Primary buyer | Hardest marketing challenge | First fractional-CMO move |
|---|---|---|---|
| Endpoint / EDR / XDR | CISO, SecOps lead | Crowded field, feature parity with entrenched incumbents | Sharpen category positioning and proof-of-detection content that survives a POC bake-off |
| Cloud security / CNAPP | Cloud security architect, DevSecOps | Buyer vocabulary shifts fast (CSPM to CNAPP to ASPM) | Rebuild messaging around the buyer's current stack and workflow, not the acronym of the quarter |
| Identity / IAM / ITDR | IAM lead, IT security director | Long, committee-heavy deals with compliance overlap | ABM plus analyst relations to reach the full buying committee before the RFP |
| GRC / compliance / risk | CISO, compliance and audit lead | Buyers frame it as a cost center, not growth | Reframe around audit-hours saved and framework coverage (SOC 2, ISO 27001, FedRAMP) |
| MSSP / MDR services | Mid-market IT owner, vCISO buyer | Undifferentiated "we watch your logs" pitch | Partner and channel enablement plus outcome positioning (mean-time-to-respond, coverage) |
| Application / API security | AppSec lead, engineering director | Reaching developers who distrust vendor marketing | Developer-first content and community, not gated-whitepaper demand gen |
Buyer roles and category challenges reflect typical US cybersecurity go-to-market patterns as of August 2026. This is a strategic framework for prioritizing marketing investment by category, not a pricing or performance guarantee.
Security buyers trust proof and peers, not promises, and each seat on the buying committee trusts a different kind of proof. The table below maps the four audiences a fractional CMO has to reach in a security deal to what each one actually trusts, where they look, the move that reaches them, and the spend that gets ignored.
| Audience | What they trust | Where they look | Move that reaches them | What wastes budget |
|---|---|---|---|---|
| CISO / security leader | Analyst validation and peer references | Private CISO communities, analyst reports, peer forums, board decks | Third-party validation (Gartner, Forrester positioning), named customer proof, quantified risk reduction | Fear-based ads and feature-list email blasts |
| Practitioner / security engineer | Technical depth and hands-on proof | Docs, GitHub, Reddit, technical blogs, BSides and DEF CON talks | Deep technical content, open tooling, transparent docs, real community presence | Gated whitepapers and buzzword campaigns |
| Economic buyer / CFO / board | Business risk and financial outcome | Board reports, compliance mandates, cyber-insurance and audit requirements | Quantified risk reduction, compliance coverage (SOC 2, ISO 27001), total-cost framing | Product-feature messaging with no business tie |
| Procurement / GRC reviewer | Documentation, references, and paperwork | Vendor questionnaires, reference calls, third-party-risk portals | Ready security documentation, references, standards mapping, fast questionnaire turnaround | Slow or missing trust and security collateral |
Reflects typical US cybersecurity buying-committee behavior as of August 2026. A fractional CMO sets the buyer-specific message first, then builds the channel mix around what each audience trusts. This is a positioning framework, not a performance guarantee.
In cybersecurity, compliance is not a legal footnote to the go-to-market plan. It is the plan. Each framework below is a commercial gate: until you can answer it, an entire buyer segment is closed to you no matter how good the product or the positioning is. The most common and most expensive mistake a security vendor makes is treating these as security work that marketing will describe later, then discovering mid-quarter that the pipeline it forecast was never addressable. A fractional CMO earns the retainer here by sequencing the certification roadmap against the revenue plan, and by making sure that the moment a gate clears there is already a page, a proof asset and a sales answer waiting for it.
This table asserts no costs and no timelines, because both vary enormously by scope, auditor and starting posture. What it does fix is the commercial consequence of each gate and the specific marketing artifact that has to exist before a buyer in that segment will move.
| Compliance gate | Who demands it | What it blocks if missing | What marketing must have ready |
|---|---|---|---|
| SOC 2 Type II | Mid-market and enterprise SaaS buyers; nearly every procurement team | Deals stall in the security questionnaire and never reach legal | A public trust center, the current report available under NDA, a subprocessor list, and a plain-language security overview a non-technical champion can forward |
| ISO/IEC 27001 | International buyers, and EU and UK enterprises in particular | Vendor onboarding outside North America | The certificate and its scope statement published, plus a mapping document showing which SOC 2 controls already satisfy the ISO annex |
| HIPAA and a signed BAA | Providers, payers and health technology buyers | Any deal that touches protected health information | A standing BAA template, a HIPAA posture page, and a data-flow diagram that shows where PHI does and does not travel |
| PCI DSS | Payments, retail and anyone in the cardholder data path | Merchant, processor and acquirer deals | Attestation of compliance available on request, a scope statement, and a segmentation narrative that explains what is out of scope and why |
| FedRAMP | US federal agencies and their prime contractors | Essentially all federal procurement | A named sponsoring agency story, a marketplace listing, public-sector case studies, and a crosswalk to StateRAMP for reuse |
| StateRAMP | US state and local government, and public education | SLED procurement in participating states | The listing itself plus a reciprocity narrative that lets a FedRAMP effort carry over |
| CMMC | US Department of Defense contractors and their supply chain | Defense industrial base deals | The target level published, current assessment status, and an explainer that translates the DFARS clause for a non-compliance buyer |
| GDPR and a DPA | EU and UK buyers, and any customer with EU data subjects | European expansion, and increasingly UK enterprise | A DPA template, a stated position on standard contractual clauses, a data-residency page, and a public subprocessor register |
Framework names and scopes are public standards; the commercial consequences and marketing artifacts in the last two columns are our own practitioner read from cybersecurity go-to-market engagements, not a claim published by any certifying body. Verify your own scope with your auditor before committing a revenue forecast to it.
If you sell to public companies, your buyer has four business days to file a Form 8-K once it determines a cybersecurity incident is material, and an annual obligation to describe how it manages cybersecurity risk in its 10-K. Neither of those is a marketing problem on paper. Both of them become marketing problems the moment they happen, because the filing is public, the press reads it the same day, and the company has to say something coherent to customers while its own investigation is still open.
Most cybersecurity marketing plans have a crisis communications line item and no crisis communications assets. Four business days is not enough time to write a holding statement, get it through legal, brief the sales team and answer forty inbound customer emails. It is barely enough time to send things that already exist.
| Obligation | Where it lives | What starts it | Deadline | What the marketing function actually owns |
|---|---|---|---|---|
| Material incident disclosure | Item 1.05 of Form 8-K (Form 6-K for foreign private issuers) | A determination that a cybersecurity incident is material | Four business days from the determination, not from discovery | The holding statement, the customer notification, the press and analyst response, and the sales talk track, all pre-written and legal-approved before an incident, because four business days is not enough time to write them. |
| Annual risk management and governance disclosure | Item 106 of Regulation S-K, in the annual report on Form 10-K (Item 16K of Form 20-F for foreign private issuers) | The annual reporting cycle | Filed with the 10-K | The evidence your buyer cites when describing their processes for assessing, identifying and managing material risks from cybersecurity threats. If your product is part of that process, your documentation is an input to their filing. |
The rule is quoted wrongly more often than it is quoted correctly, including by vendors selling against it. If you publish content on this, these are the six places to be careful, because a buyer's general counsel will notice.
| What gets repeated | What the rule says |
|---|---|
| You have four business days from the breach | The clock is tied not to discovery but to the registrant's determination that the incident is material. Discovery starts an investigation, not the filing clock. |
| So a company can simply avoid deciding | The rule instructs registrants to make the materiality determination without unreasonable delay. Slow-walking the determination is itself the exposure. |
| Materiality is a technical severity rating | It is an investor test. Information is material if there is a substantial likelihood that a reasonable shareholder would consider it important in making an investment decision. Your CVSS score is not the standard. |
| The filing forces you to publish your technical details | It does not. A registrant need not disclose specific technical information about its planned response or its vulnerabilities in such detail as would impede its response or remediation of the incident. |
| Disclosure can be delayed if it would be commercially damaging | Only in one narrow case. Item 1.05 allows for limited delay if the United States Attorney General determines that disclosure poses a substantial risk to national security or public safety and notifies the Commission of such determination in writing. |
| It only affects the largest filers | It applies to domestic registrants generally. Smaller reporting companies were given a longer compliance period for incident reporting, not an exemption, and all registrants were required to provide the annual disclosures. |
Source: US Securities and Exchange Commission, small-entity compliance guide to Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, sec.gov, read 2026-09-05. This is a description of a disclosure framework for marketing planning purposes and it is not legal advice. Materiality determinations and filing decisions belong with your securities counsel.
Worth saying plainly, because the rule is being oversold as a marketing opportunity. It binds registrants reporting under the Securities Exchange Act of 1934. If your buyers are private mid-market companies, none of this lands on them, and a campaign built on their imaginary filing deadline will be seen through immediately by the one person in the room who knows.
It also does not make anyone buy anything. A disclosure obligation creates a reporting duty, not a budget line. The honest version of this angle is narrow: it gives you a real reason to have your incident communications written before you need them, and it hands you a public, structured corpus of how your buyers describe their own risk processes. Those are both worth having. Neither is a demand generation strategy on its own, and treating a compliance deadline as a demand trigger is how cybersecurity marketing earns the reputation it has.
Yes, in two concrete ways. First, it puts a four business day clock on external communication after a material incident is determined to be material, which means the holding statement, customer notification, analyst response and sales talk track have to exist before the incident, not after. Second, Item 106 of Regulation S-K requires your public-company buyers to describe their processes for assessing, identifying and managing material risks from cybersecurity threats in their annual report on Form 10-K, so your security documentation becomes an input to a filing rather than a sales asset.
Four business days, but not from the breach. The deadline for filing an Item 1.05 Form 8-K is tied not to discovery but to the registrant determining that the incident is material, and the rule instructs registrants to make that materiality determination without unreasonable delay. That distinction is the single most misquoted part of the rule and it is worth getting right in any content you publish about it.
It is an investor standard, not a technical one. Information is material if there is a substantial likelihood that a reasonable shareholder would consider it important in making an investment decision, or if it would significantly alter the total mix of information available. That evaluation takes in all relevant facts and circumstances and can involve both quantitative and qualitative factors, which is why a low-severity incident at a critical customer can be material while a high-severity incident in a test environment may not be.
No. These rules sit on registrants reporting under the Securities Exchange Act of 1934. If you are a private security vendor, Item 1.05 does not apply to you at all. It still shapes your market, because your public-company customers are subject to it and will push their obligations down to you through contracts and questionnaires, but building a campaign on the premise that your private mid-market buyer has a filing deadline is building on something that is not true.
Yes, and almost nobody does. The annual Item 106 disclosures are public and the rules require the new disclosures to be tagged with Inline XBRL, so cybersecurity governance disclosure across the public market is a structured, machine-readable, free dataset. It tells you how your buyers describe their own risk processes, in their own words, on the record. That is better positioning research than a survey you paid for.
If you sell security software into the defense industrial base, the thing that changes on 10 November 2026 is not who needs CMMC. It is who has to prove it to somebody else. Phase 1, which began on 10 November 2025, lets an affected contractor reach CMMC Status of Level 2 by assessing itself and affirming the result in SPRS. From Phase 2, the Department of Defense adds CMMC Status of Level 2 (C3PAO) as a condition of contract award for applicable solicitations, and a certified third party assesses the same 110 requirements. Self-attested evidence stops clearing the bar on those contracts.
That date is 61 days after this section was last updated on 10 September 2026. The schedule is not a forecast. 32 CFR 170.3(e) sets out four implementation phases, starts Phase 1 on the effective date of the complementary 48 CFR acquisition rule, and spaces each later phase one calendar year after the one before it. The Federal Register records that acquisition rule, DFARS Case 2019-D041, as published on 10 September 2025 and effective on 10 November 2025. The program rule itself, 32 CFR part 170, was published on 15 October 2024 and took effect on 16 December 2024. Every date below follows from those two facts and the phase text.
| Phase | Begins | What DoD includes in solicitations | What changes for your buyer | What marketing owns in this window |
|---|---|---|---|---|
| Phase 1 | 10 November 2025 | CMMC Status of Level 1 (Self) or Level 2 (Self) as a condition of contract award. DoD may at its discretion require Level 2 (C3PAO) instead. | Your buyer can self-assess and self-affirm. The evidence they need from you is whatever supports their own score. | Requirement-level mapping. Which of the 110 your product touches, stated precisely, with nothing claimed that an assessor would not accept. |
| Phase 2 | 10 November 2026 | Adds CMMC Status of Level 2 (C3PAO) as a condition of award. DoD may at its discretion add Level 3 (DIBCAC). | A third party now inspects the claim. Self-attested evidence stops being sufficient for affected contracts. | Assessor-grade artifacts. Evidence a C3PAO will accept, written for the assessment record rather than for a buyer's slide. |
| Phase 3 | 10 November 2027 | Level 2 (C3PAO) for all applicable solicitations and as a condition to exercise an option period. Level 3 (DIBCAC) as a condition of award. | Option-period exercises start carrying the requirement, so existing contracts are in scope, not only new ones. | Renewal and reassessment motion. The three-year cadence means your install base re-enters assessment on a predictable clock. |
| Phase 4 | 10 November 2028 | Full implementation. CMMC requirements in all applicable solicitations and contracts, including option periods on contracts awarded before Phase 4. | The requirement is universal across applicable DoD work. It stops being a differentiator and becomes table stakes. | Positioning past compliance. When everyone clears the bar, the bar is no longer the story and the category resets. |
Phase dates are derived, not quoted: the rule fixes Phase 1 to the 48 CFR effective date and spaces the rest one calendar year apart, so the arithmetic is ours and the inputs are the rule text and the Federal Register effective date. DoD retains discretion within every phase, including discretion to require a higher status earlier or to waive requirements for a procurement, so treat the table as the default path rather than a guarantee for any specific solicitation.
CMMC applies to your customer's information systems, not to your product, and no purchase confers a CMMC Status. 32 CFR 170.3 applies the requirements to DoD contract and subcontract awardees that process, store or transmit FCI or CUI on contractor information systems. The assessed thing is the contractor's environment within a defined assessment scope. A product can help satisfy specific requirements inside that scope and can generate evidence an assessor will accept. It cannot hand anyone a status.
This matters more than it sounds, because "makes you CMMC compliant" is the most common claim in this corner of the market and it is unsupportable on the face of the regulation. It also fails in the worst possible place. The claim is tested during an assessment, in front of the buyer, by an assessor whose job is to reject evidence that does not conform. The narrower claim is both defensible and more useful to the buyer: name the requirements your product helps satisfy, say exactly what evidence it produces, and let the assessor reach the conclusion.
This section is deliberately not an argument that a deadline creates demand. Elsewhere on this page we argue that treating a compliance deadline as a demand trigger is how cybersecurity marketing earns the reputation it has, and that still holds. A phase schedule is useful for a different reason: it tells you when the buying population changes shape and what kind of proof procurement will start asking for. That is market structure, and it belongs in a plan. It is not a reason for anyone to buy anything, and a campaign built on the countdown rather than on the buyer's actual problem will read exactly as cynical as it is.
Most published summaries collapse the levels into self-assessment or certification and lose the details that decide whether a deal can close. The cadence, the affirmation obligation and the POA&M rules differ by status, and the differences are where marketing commitments get made that the assessment later refuses.
| CMMC Status | Security requirements | Who assesses | Reassessment cadence | Affirmation | POA&M permitted |
|---|---|---|---|---|---|
| Level 1 (Self) | The 15 requirements at 48 CFR 52.204-21(b)(1) | The contractor, itself | Annual self-assessment | Required, submitted into SPRS | Never. No POA&M is permitted at any time. |
| Level 2 (Self) | The 110 requirements from NIST SP 800-171 R2 | The contractor, itself | Every three years | At each assessment and annually thereafter | Yes, within limits. Score ratio must be 0.8 or better and six requirements are excluded. |
| Level 2 (C3PAO) | The same 110 requirements | An authorised or accredited C3PAO | Every three years | At each assessment and annually thereafter | Yes, on the same limits, but closeout must be done by a C3PAO. |
| Level 3 (DIBCAC) | Selected NIST SP 800-172 requirements, on top of a Final Level 2 (C3PAO) | DCMA DIBCAC | Every three years, and the Level 2 certification every three years too | At each assessment and annually thereafter | Yes at 0.8 or better, with seven named requirements excluded. |
Requirement counts are the rule's own. 32 CFR 170.4 defines Requirements as "the 15 Level 1 requirements listed in the 48 CFR 52.204-21(b)(1), the 110 Level 2 requirements from NIST SP 800-171 R2". Level 3 layers selected NIST SP 800-172 requirements on top and, under 32 CFR 170.24(c)(3), requires a maximum score on the Level 2 certification assessment before a Level 3 assessment can even be initiated, so there is no partial-credit path into Level 3.
The Level 2 threshold is a ratio of 0.8, applied to a weighted score, and that is not the same as implementing 88 of the 110 requirements. 32 CFR 170.21(a)(2)(i) requires the assessment score divided by the total number of Level 2 security requirements to be greater than or equal to 0.8. With 110 requirements, 0.8 gives 88, which is where the familiar figure comes from. The figure is right. The reading most people attach to it is not.
The reason is 32 CFR 170.24(c)(2). The maximum score equals the number of Level 2 requirements, and each requirement assessed NOT MET subtracts its own point value, which the rule sets at 5, 3 or 1 depending on what failing it would expose. Counting the enumerated lists in that section gives 42 requirements worth five points each, 14 worth three points each, and the remainder worth one. Two requirements can earn partial credit: multi-factor authentication at IA.L2-3.5.3 costs three points if it is implemented only for remote and privileged users and five if it is not implemented at all, and FIPS-validated encryption at SC.L2-3.13.11 costs three points if encryption is employed but not FIPS-validated and five if encryption is not employed. The rule states outright that a score may go negative.
| Scenario | Requirements failed | As a share of 110 | Points lost | Score | Ratio | Conditional Level 2? |
|---|---|---|---|---|---|---|
| Everything implemented | 0 | 0% | 0 | 110 | 1.000 | Not needed. This is a Final status. |
| Four five-point requirements fail | 4 | 3.6% | 20 | 90 | 0.818 | Yes, if none are on the excluded list. |
| Five five-point requirements fail | 5 | 4.5% | 25 | 85 | 0.773 | No. Below the 0.8 ratio. |
| Twenty-two one-point requirements fail | 22 | 20.0% | 22 | 88 | 0.800 | Yes, exactly at the line, if none are on the excluded list. |
| Only the six never-waivable requirements fail | 6 | 5.5% | 6 | 104 | 0.945 | No. The ratio passes comfortably and the status is still denied. |
Scores in this table are computed from the point values enumerated at 32 CFR 170.24(c)(2)(i) and the 0.8 ratio at 32 CFR 170.21(a)(2)(i), against the 110-requirement total defined at 32 CFR 170.4. They assume the failed requirements carry the point value stated and that no other requirement is NOT MET.
32 CFR 170.21(a)(2)(iii) names six Level 2 requirements that may never appear on a POA&M, and every one of them is worth a single point. Cross-referencing that list against the enumerated five-point and three-point lists at 32 CFR 170.24(c)(2)(i) shows that none of the six appears on either, which puts each of them in the residual one-point category. Six points out of 110, and they carry absolute veto power.
The consequence is the most counter-intuitive thing in the whole framework. An organisation that fails only those six scores 104 out of 110, a ratio of 0.945, which clears the 0.8 threshold with room to spare, and it still cannot achieve Conditional Level 2, because the requirements it failed are the ones that cannot be deferred onto a plan of action. A scoring dashboard that shows a comfortable 104 and a green light is telling its owner something false.
| Requirement | Short name | Point value | Effect if NOT MET |
|---|---|---|---|
| AC.L2-3.1.20 | External Connections (CUI Data) | 1 | Conditional Level 2 is unavailable regardless of score. |
| AC.L2-3.1.22 | Control Public Information (CUI Data) | 1 | Conditional Level 2 is unavailable regardless of score. |
| CA.L2-3.12.4 | System Security Plan | 1 | Worse than the others. Without a current SSP the rule states the finding is that an assessment could not be completed due to incomplete information and noncompliance with 48 CFR 252.204-7012. |
| PE.L2-3.10.3 | Escort Visitors (CUI Data) | 1 | Conditional Level 2 is unavailable regardless of score. |
| PE.L2-3.10.4 | Physical Access Logs (CUI Data) | 1 | Conditional Level 2 is unavailable regardless of score. |
| PE.L2-3.10.5 | Manage Physical Access (CUI Data) | 1 | Conditional Level 2 is unavailable regardless of score. |
One of the six behaves differently from the rest and deserves separate attention. The System Security Plan at CA.L2-3.12.4 is not merely non-waivable. 32 CFR 170.24(c)(2)(i) states that the absence of an up to date SSP at the time of the assessment results in a finding that an assessment could not be completed due to incomplete information and noncompliance with 48 CFR 252.204-7012. That is not a low score. It is an assessment that does not conclude.
The first is flowdown. DFARS 252.204-7021 requires a contractor to insert the substance of the clause into subcontracts and other contractual instruments, including those for commercial products and commercial services and excluding commercially available off-the-shelf items, wherever the subcontract will involve FCI or CUI. Before awarding, the prime must confirm the subcontractor already holds an appropriate CMMC status. The requirement therefore propagates down the supply chain instead of stopping at a few hundred primes, and the addressable population is correspondingly larger and much less concentrated.
The second is the reassessment clock. Level 2 status, whether self-assessed or C3PAO-certified, has to be re-established every three years, with an affirmation at each assessment and annually in between. That converts a one-time scramble into a recurring, predictable cycle. An install base acquired during Phase 2 re-enters assessment during Phase 4, which is a renewal motion you can plan for rather than a surprise.
The third is a set of scoring provisions that reduce the panic and are almost never quoted. Under 32 CFR 170.24(b), a requirement assessed Not Applicable is equivalent to the same objective assessed MET. Enduring exceptions are assessed as MET when they are described, with mitigations, in the system security plan. Temporary deficiencies are assessed as MET when they are appropriately addressed in operational plans of action that show progress. A vendor whose pitch depends on the customer believing their situation is more desperate than it is will be corrected by their assessor, and will not be trusted again.
Not a countdown campaign. The useful work is unglamorous and it is mostly evidence engineering. Map your product to the specific requirement identifiers it helps satisfy, at the granularity the assessment uses, and write down what evidence it produces for each one, because the rule requires evidence in final form and explicitly rejects working papers, drafts and unapproved policies. Build the artifacts a C3PAO will accept rather than the ones a buyer's champion finds persuasive, since from Phase 2 those are different audiences with different standards. Then decide, honestly, whether the defense industrial base is a segment you serve at all.
For most cybersecurity companies the answer is no, and the correct response to all of the above is to ignore it. CMMC is a large, loud, dated requirement, which makes it magnetic to marketing teams looking for a reason to send something. If your customers are not DoD contractors or their suppliers, the deadline is noise, and the effort belongs in the segments where your buyers actually are.
Phase 2 begins on 10 November 2026, one calendar year after Phase 1, because 32 CFR 170.3(e) starts Phase 1 on the effective date of the 48 CFR acquisition rule and spaces each later phase one year apart. What changes is the evidence standard, not the requirement. In Phase 1 an affected contractor could reach Level 2 by assessing itself and affirming the result in SPRS. From Phase 2, DoD adds CMMC Status of Level 2 (C3PAO) as a condition of award for applicable solicitations, which means a third party inspects the same 110 requirements. For a security vendor the practical consequence is that self-attested marketing evidence stops being enough for those deals, because someone outside the buyer's organisation now has to accept it.
To your customer, and specifically to your customer's information systems. 32 CFR 170.3 applies the requirements to DoD contract and subcontract awardees that process, store or transmit FCI or CUI on contractor information systems. The assessment scope is the contractor's environment. A product can help satisfy particular requirements inside that scope and can produce evidence an assessor will accept, but the status attaches to the assessed organisation, never to a product you sold them.
No, and it is the single most common unsupportable claim in defense-sector security marketing. CMMC Status is granted to an assessed organisation for a defined assessment scope after a self-assessment or a C3PAO or DIBCAC assessment, and it is affirmed by a named affirming official. No purchase produces that. The defensible version of the claim is narrower and more useful anyway: name the specific requirements your product helps satisfy, say what evidence it generates, and let the assessor draw the conclusion. Vendors who overstate this get found out during the assessment, which is the worst possible moment.
88 is arithmetically correct and it is not what the rule says. 32 CFR 170.21(a)(2)(i) requires the assessment score divided by the total number of Level 2 security requirements to be 0.8 or greater, and 0.8 of 110 is 88. The reason the distinction matters is that the score is weighted. Under 32 CFR 170.24(c)(2) each requirement is worth 5, 3 or 1 points, so failing five of the forty-two five-point requirements costs 25 points and lands at 85, below the line, while failing twenty-two one-point requirements costs 22 points and lands exactly on it. Reading 88 as eighty-eight of the hundred and ten implemented will mislead you in both directions.
180 days. Under 32 CFR 170.21(b) the closing of a POA&M must be confirmed by a closeout assessment within 180 days of the Conditional CMMC Status Date, and if it is not, the Conditional CMMC Status for that information system expires. Two further limits catch people out. No POA&M is permitted at all for Level 1. And six Level 2 requirements may never appear on a POA&M, so failing any one of them denies Conditional status no matter how high the score is.
Yes, and this is the part that decides how large the addressable market actually is. DFARS 252.204-7021 requires the contractor to flow the substance of the clause down into subcontracts and other contractual instruments, including for commercial products and services and excluding commercially available off-the-shelf items, wherever the subcontract involves processing, storing or transmitting FCI or CUI. Before awarding, the prime has to make sure the subcontractor already holds the appropriate CMMC status. So the requirement propagates down the supply chain rather than stopping at the primes.
Regulatory text in this section was read directly from 32 CFR part 170 and 48 CFR 252.204-7021 on the eCFR, and publication and effective dates from the Federal Register, on 10 September 2026. Point-value counts, phase dates and score scenarios are computed from that text and are our own arithmetic. This is a description of a regulation for marketing planning purposes and it is not legal or compliance advice. Confirm your own obligations, scope and status with your assessor or counsel before relying on any of it, and check whether the rule has changed since the date above. For how engagement pricing works, see our fractional CMO cost benchmark.
In the two years and nine months since the SEC cybersecurity disclosure rule took effect on 18 December 2023, 18 of the 1,683 US public companies we measured filed a Form 8-K under Item 1.05 to report a material cybersecurity incident. That is 1.07 percent of them, from 24 filings out of the 45,908 Form 8-K filings those same companies made over the period, about one filing in 1,913. If a cybersecurity marketing plan assumes a visible stream of disclosed breaches at its target accounts generating urgency, the filings do not support it. What the filings do support is narrower and more useful to a marketing function: a quarter of the filings are amendments, two thirds arrived with no same-day public statement attached to the filing, and the rate rises with company size rather than with how much technology a company sells.
Read the headline number as a floor on disclosure and not as a measure of how often incidents happen. Companies also report cybersecurity incidents under Item 8.01, Other Events, while a materiality determination is still open, and Item 8.01 is a catch-all used for thousands of unrelated events, so its cyber share cannot be counted without reading every filing. The figures below count only the item that means one thing.
The measurement reads the item numbers the SEC itself attaches to every Form 8-K, so it does not depend on searching filing text for a phrase. Our cached map of 1,739 US registrants was the starting population. Of those, 1,683 have filing history reaching back before the rule took effect and are therefore measurable across the whole window; the remaining 56 are excluded by count rather than estimated. The window runs 18 December 2023 to 30 September 2026, 1,017 days, and every rate below uses the 1,683-company figure as its denominator.
| Measure | Value | What it means |
|---|---|---|
| Companies in the measured population | 1,739 | Every filer in our cached map of US registrants |
| Filing history reaches back before the rule took effect | 1,683 | The measurable population behind every rate here |
| Excluded because filing history does not cover the whole window | 56 | Excluded by count, not estimated |
| Companies that filed at least one Item 1.05 | 18 | 1.07% of the measurable population |
| Item 1.05 filings, Form 8-K and Form 8-K/A | 24 | Across the whole window |
| All Form 8-K and 8-K/A filings by those companies in the window | 45,908 | The denominator for how rare the item is |
| Item 1.05 as a share of all their 8-K filings | 0.0523% | About one filing in 1,913 |
Source: SEC EDGAR submissions API, structured Form 8-K item metadata, read 30 September 2026. Counts are our own arithmetic over that metadata. This describes a public filing record for marketing planning purposes and it is not legal advice.
Disclosed material incidents did not accelerate over the period. Distinct filers ran at 6, 7 and 6 across 2024, 2025 and the first nine months of 2026, and filings per 365 days ran at 9.0, 8.0 and 9.4 on raw counts of 9, 8 and 7 filings. That is noise around a flat level rather than a trend. The 2026 row covers 273 days rather than a full year, which is why the last column normalises it. Distinct filers by year sum to 19 while the total across the window is 18, because one company filed in two different years.
| Period | Days in period | Item 1.05 filings | Distinct filers | Filings per 365 days |
|---|---|---|---|---|
| 2023 (from 18 December) | 14 | 0 | 0 | 0.0 |
| 2024 | 366 | 9 | 6 | 9.0 |
| 2025 | 365 | 8 | 7 | 8.0 |
| 2026 (to 30 September) | 273 | 7 | 6 | 9.4 |
The 2023 row covers only the 14 days from the rule taking effect to year end. Per-365-day figures are filings divided by days in the row, multiplied by 365. They are a normalisation and not a forecast.
Industry does not point where a cybersecurity marketer would guess. Among groups with at least 100 companies in the population, instruments and medical devices filed at 2.75 percent against 1.23 percent for business services, the group that contains software, a ratio of 2.2 to one. Four of the six companies in the instruments group are surgical and medical instrument makers specifically: ORASURE TECHNOLOGIES INC, UFP TECHNOLOGIES INC, STRYKER CORP and WEST PHARMACEUTICAL SERVICES INC. Chemicals and pharmaceuticals, with 245 companies in the population, produced none.
| Industry group | Companies in population | Companies filing Item 1.05 | Rate |
|---|---|---|---|
| Instruments and medical devices (SIC 38) | 218 | 6 | 2.75% |
| Industrial and computer equipment (SIC 35) | 121 | 2 | 1.65% |
| Business services, includes software (SIC 73) | 406 | 5 | 1.23% |
| Electronics and electrical equipment (SIC 36) | 202 | 1 | 0.50% |
| Chemicals and pharmaceuticals (SIC 28) | 245 | 0 | 0.00% |
Groups with fewer than 100 companies are suppressed: 51 groups covering 491 companies. The 5 groups shown cover 1,192 of the 1,683 measurable companies and 14 of the 18 filers. One shown group reads zero, so the ratio of highest to lowest is quoted across the non-zero groups only, where it is 5.5 to one.
A suppression rule that removes small groups can manufacture a narrow spread, so here is the whole ladder. The ratio of the highest non-zero rate to the lowest runs 7.7x, 5.5x, 5.5x, 5.5x, 5.5x as the minimum group size relaxes from 25 companies to 200. Instruments and medical devices is the top group at every threshold from 50 upward, but not at 25: there the table is topped by Communications at 3.85 percent, which is one company out of 26. A single filing in a group of 26 is why 100 is the threshold used for the comparison above, and why the 7.7-fold figure in the first row of this table is not quoted as a finding. The honest summary is that between-industry differences here rest on counts of one to six companies and should not be read as precise rates.
| Minimum group size | Groups shown | Groups with a non-zero rate | Highest rate | Lowest non-zero rate | Ratio | Companies covered |
|---|---|---|---|---|---|---|
| At least 25 companies | 10 | 7 | 3.85% | 0.50% | 7.7x | 1,398 |
| At least 50 companies | 6 | 4 | 2.75% | 0.50% | 5.5x | 1,269 |
| At least 100 companies | 5 | 4 | 2.75% | 0.50% | 5.5x | 1,192 |
| At least 150 companies | 4 | 3 | 2.75% | 0.50% | 5.5x | 1,071 |
| At least 200 companies | 4 | 3 | 2.75% | 0.50% | 5.5x | 1,071 |
Every ratio here is computed from the rounded percentages in the same row, so a reader dividing the published cells gets the published ratio. The lowest non-zero rate is the same group at every threshold, which is why only the top of the range moves.
Incidence rises with revenue at every step: 0.65 percent under $50M, 0.92 percent from $50M to $500M, 0.99 percent from $500M to $1B, 1.48 percent from $1B to $5B and 1.79 percent above $5B, a 2.8-fold spread from the smallest band to the largest. The gradient is monotonic across all five bands. This is the harder direction for the result to run, because materiality is a relative test: a larger company needs a larger absolute incident before it becomes material to a reasonable investor, which should push its disclosure rate down. The rate rises anyway.
| Revenue band | Companies in population | Companies filing Item 1.05 | Rate |
|---|---|---|---|
| Under $50M | 461 | 3 | 0.65% |
| $50M to $500M | 437 | 4 | 0.92% |
| $500M to $1B | 202 | 2 | 0.99% |
| $1B to $5B | 337 | 5 | 1.48% |
| Over $5B | 224 | 4 | 1.79% |
Revenue is the calendar 2024 XBRL revenue figure for each company, preferring the revenue-from-contracts tag and falling back to total revenues. Companies with no usable revenue tag are excluded by count, 22 of 1,683, leaving 1,661, and all 18 Item 1.05 filers have a revenue figure.
A rate built on 18 companies is worth publishing only if the companies are named, so every one of them is here with the date of its first Item 1.05 filing. None of them is a pure-play cybersecurity vendor. The closest is F5, INC., which the SEC classifies under computer communications equipment, and the three the SEC classifies under prepackaged software are MICROSOFT CORP, DROPBOX, INC. and CareCloud, Inc., in each case under SIC 7372. That is the practical point for a security marketer: the companies filing these disclosures are the buyers, not the sellers.
| Company | Industry as SEC classifies it | Revenue band | First Item 1.05 | Item 1.05 filings | Of which amendments | Items co-filed |
|---|---|---|---|---|---|---|
| MICROSOFT CORP | Services-Prepackaged Software | Over $5B | 2024-01-19 | 2 | 1 | 7.01, 9.01 |
| Hewlett Packard Enterprise Co | Computer & office Equipment | Over $5B | 2024-01-24 | 1 | 0 | none |
| ORASURE TECHNOLOGIES INC | Surgical & Medical Instruments & Apparatus | $50M to $500M | 2024-04-12 | 1 | 0 | 7.01, 9.01 |
| DROPBOX, INC. | Services-Prepackaged Software | $1B to $5B | 2024-05-01 | 1 | 0 | 7.01, 9.01 |
| KEY TRONIC CORP | Printed Circuit Boards | $50M to $500M | 2024-05-10 | 3 | 2 | 9.01 |
| Crimson Wine Group, Ltd | Beverages | $50M to $500M | 2024-07-25 | 1 | 0 | none |
| Sensata Technologies Holding plc | Industrial Instruments For Measurement, Display, and Control | $1B to $5B | 2025-04-09 | 1 | 0 | none |
| CONDUENT Inc | Services-Business Services, NEC | $1B to $5B | 2025-04-14 | 1 | 0 | none |
| Coinbase Global, Inc. | Finance Services | Over $5B | 2025-05-15 | 1 | 0 | 9.01 |
| Zoomcar Holdings, Inc. | Services-Auto Rental & Leasing (No Drivers) | Under $50M | 2025-06-13 | 1 | 0 | none |
| DATA I/O CORP | Instruments For Meas & Testing of Electricity & Elec Signals | Under $50M | 2025-08-21 | 2 | 0 | 7.01, 9.01 |
| WYTEC INTERNATIONAL INC | Telegraph & Other Message Communications | Under $50M | 2025-08-29 | 2 | 1 | none |
| F5, INC. | Computer Communications Equipment | $1B to $5B | 2025-10-15 | 1 | 0 | 5.02, 7.01 |
| UFP TECHNOLOGIES INC | Surgical & Medical Instruments & Apparatus | $500M to $1B | 2026-02-24 | 1 | 0 | none |
| CareCloud, Inc. | Services-Prepackaged Software | $50M to $500M | 2026-03-27 | 1 | 0 | 9.01 |
| STRYKER CORP | Surgical & Medical Instruments & Apparatus | Over $5B | 2026-04-09 | 1 | 1 | 7.01 |
| WEST PHARMACEUTICAL SERVICES INC | Surgical & Medical Instruments & Apparatus | $1B to $5B | 2026-05-11 | 2 | 1 | 7.01, 9.01 |
| 8X8 INC /DE/ | Services-Computer Processing & Data Preparation | $500M to $1B | 2026-06-23 | 1 | 0 | none |
Co-filed items are the other Form 8-K items reported alongside Item 1.05 across all of that company's Item 1.05 filings. Item 7.01 is Regulation FD disclosure, Item 9.01 is financial statements and exhibits, and Item 5.02 covers departure or appointment of officers and directors.
The shape of the filings is where this turns into a marketing brief. Amendments account for 6 of 24 filings, and 5 of the 18 companies filed at least one amendment, so a material incident disclosure is a sequence rather than a single event. A second group of 5 companies, 27.8 percent, filed more than one Item 1.05 of any kind. The two groups of 5 overlap without being the same companies, because one company in the population has no original Item 1.05 at all: its only Item 1.05 filing is an amendment to an earlier report it had made under a different item. Where an original filing and a later amendment can be paired, the median gap is 42 days across 4 companies, ranging from 9 to 158 days. Only 8 of 24 filings carried Item 7.01, the item a company uses when it is publishing a statement to the market the same day, and 11 of 24 were filed under Item 1.05 with no other item and no exhibit at all.
| Measure | Filings | Share of all Item 1.05 filings |
|---|---|---|
| Item 1.05 filings in the window | 24 | 100.0% |
| Original Form 8-K | 18 | 75.0% |
| Amended Form 8-K/A | 6 | 25.0% |
| Filed with Item 7.01, a same-day Regulation FD statement | 8 | 33.3% |
| Filed with Item 9.01, financial statements and exhibits | 11 | 45.8% |
| Filed under Item 1.05 and no other item | 11 | 45.8% |
Three things follow for a cybersecurity marketing function. The holding statement has to exist before the event, because four business days from a materiality determination is not enough time to write, clear and distribute one. It needs a second and third version, because 6 of the 24 filings are amendments and the median amendment landed 42 days later, long after the news cycle has moved and the customer questions have not. And a same-day public statement is the exception rather than the norm in this record, which is an argument for preparing one rather than evidence that nobody bothers.
The clearest illustration in the record is STRYKER CORP, and it is worth walking because it shows the sequence the counts above only imply. Stryker identified an incident on 11 March 2026 and reported it the same day under Item 8.01, Other Events, describing a global disruption to its Microsoft environment. It then furnished two Regulation FD updates, on 12 and 23 March. Only on 9 April, twenty-nine days after identifying the incident, did it amend the original report to add the Item 1.05 material cybersecurity incident disclosure. Four public filings about one incident across twenty-nine days, and the item that this section counts was the last of them.
| Filing date | Form | Items reported | What that filing did |
|---|---|---|---|
| 11 March 2026 | 8-K | 8.01 | Reported the incident under Other Events: a cybersecurity incident affecting certain information technology systems, causing a global disruption to the company Microsoft environment, with the response plan activated and no indication of ransomware. |
| 12 March 2026 | 8-K | 7.01 | Furnished an update under Regulation FD. |
| 23 March 2026 | 8-K | 7.01, 9.01 | Furnished a further update under Regulation FD, with an exhibit. |
| 9 April 2026 | 8-K/A | 1.05, 7.01 | Amended the 11 March report to add the Item 1.05 material cybersecurity incident disclosure, 29 days after the incident was identified. |
Two things in that sequence matter more to a marketing function than the headline rate. The first filing went out on the day of discovery, which means the holding statement was needed within hours and not within four business days. And the communications burden was spread across four filings over a month, so a single approved statement would have covered roughly a quarter of the work. NovoCure Ltd is the same pattern caught earlier in its course: it reported under Item 8.01 on 1 September 2026 and undertook to amend under Item 1.05 once it determined materiality, which it had not yet done.
The obvious follow-up question is how many companies disclose a cyber incident without using Item 1.05, and this section does not answer it, because the available method does not support an answer. Searching Form 8-K full text over the same window returns 1,164 filings containing the phrase "cybersecurity incident", 2,240 containing "ransomware" and 6,958 containing "unauthorized access", against 94 containing "Item 1.05". Those larger figures are contaminated. The phrases appear in risk language and inside attached exhibits such as credit agreements, which is why "unauthorized access" returns thousands of hits in a population that produced 24 material incident disclosures. A number that large would be easy to publish and would be wrong, so it is not published here.
The structured count was tested against full-text search rather than merely compared with it. Full-text search returned 120 matches for "Item 1.05" across all registrants, of which 27 fall inside our population, and the structured count caught 24 of those. Every one of the remaining three is explained below rather than written off, and no filing found by the structured method was missed by full-text search. This is the audit trail for the headline number.
| Full-text search match | Why it is not an Item 1.05 filing | Verdict |
|---|---|---|
| NovoCure Ltd, Form 8-K, 1 September 2026 | Filed under Item 8.01, Other Events, describing unauthorized access discovered in mid-August 2026, and undertook to amend under Item 1.05 within four business days of determining materiality. It has not filed an Item 1.05. | Not an Item 1.05 filing |
| Vivos Therapeutics, Inc., exhibit EX-10.2, 3 August 2026 | The phrase appears in an attached exhibit, not in an item heading. Full-text search reports the exhibit's type, not the form under which the event was reported. | Exhibit text, not an item |
| CID Holdco, Inc., exhibit EX-10.1, 22 July 2026 | Same as above. The phrase appears inside an attached exhibit. | Exhibit text, not an item |
Full-text search figures were read from the EDGAR full-text search API on 30 September 2026 over the same 18 December 2023 to 30 September 2026 window. They are reported here to show the limits of phrase matching, not as measurements of incident frequency.
The commercially honest use of this data is not a campaign. It is three decisions. Do not build demand generation on a disclosure deadline, because at roughly one filing in 1,913 the trigger being waited for will not fire at your accounts. Do fund the incident communications assets, because the record shows disclosures arriving without same-day statements and being amended weeks later, and those assets are cheap before an event and impossible during one. And treat the industry pattern as a caution rather than a targeting input: instruments and medical devices leading software is a real ordering in this data and it rests on six companies against five, which is not a foundation for a territory plan. A peer rate built on counts this small is weak evidence for any budget decision, and that is as true when the number comes from us as when it comes from a vendor.
Very few. Across 1,683 US public companies whose filing history covers the whole period since the SEC rule took effect on 18 December 2023, 18 filed a Form 8-K under Item 1.05 to report a material cybersecurity incident, or 1.07 percent. Those 18 companies produced 24 Item 1.05 filings out of 45,908 Form 8-K filings in total, roughly one filing in 1,913. Treat the count as a floor on disclosure rather than a measure of how often incidents happen, because companies also report incidents under Item 8.01 while a materiality determination is still open.
Not in the way it is usually pitched. Item 1.05 filings ran at 9.0, 8.0 and 9.4 per 365 days across 2024, 2025 and the first nine months of 2026, so the disclosed-breach rate is flat rather than climbing, and on any single account the probability in a given year is close to zero. The rule is useful for a different reason. It tells you your buyer has four business days from a materiality determination, and 16 of 24 filings arrived with no same-day Regulation FD statement attached, which is what an unprepared communications function looks like in the public record.
Not the ones most people expect. Among industry groups with at least 100 companies in our population, instruments and medical devices filed at 2.75 percent, ahead of business services, the group that contains software, at 1.23 percent, a ratio of 2.2 to one. Four of the six companies in the instruments group are surgical and medical instrument makers specifically. Chemicals and pharmaceuticals, with 245 companies in the population, produced none at all. Industry is a weak predictor here, and the small counts mean none of these rates should be read as precise.
Because the Item 1.05 clock starts at the materiality determination and not at discovery, so a company that has found an incident but has not yet judged its materiality can report the facts voluntarily under Item 8.01, Other Events. NovoCure Ltd did exactly that on 1 September 2026, describing unauthorized access found in mid-August 2026 and undertaking to amend under Item 1.05 within four business days of determining materiality. This is the single biggest reason an Item 1.05 count understates incident disclosure, and it is why the figures here are described as a floor.
All counts in this section are computed from SEC EDGAR structured Form 8-K item metadata and cached calendar 2024 XBRL revenue tags, read 30 September 2026, over the window 18 December 2023 to 30 September 2026. Exclusions are stated as counts and never estimated. This is a description of a public filing record for marketing planning purposes and it is not legal advice; materiality determinations and filing decisions belong with securities counsel.
Short answer: federal agencies obligated $2,511.3M in prime contracts coded as cybersecurity in fiscal 2025. Most of it went to small businesses and to civilian agencies rather than the Pentagon, and none of the 17 well-known security product companies we checked appears as a prime contractor under those codes. The total is down 11.1 percent from the fiscal 2024 peak of $2,825.2M but 47.2 percent above fiscal 2022's $1,706.2M. Small businesses received 59.3 percent of the dollars, the Department of Defense placed 43.3 percent, and the money coded as security lands with integrators, service firms and resellers. For a cybersecurity company deciding whether and how to market to the federal government, those three facts matter more than the size of the market.
The sections above cover two ways the federal government shapes cybersecurity demand indirectly: the CMMC rule your defense-industrial customers must pass, and the SEC disclosure rule your public-company customers must follow. This one measures the federal government as a buyer in its own right, using the public contract record rather than budget documents or analyst estimates.
The federal product and service code taxonomy reserves three codes for security work: 7J20 for security and compliance products (hardware and perpetual-licence software), DJ01 for security and compliance support services delivered as labor, and DJ10 for security and compliance delivered as a service. Every prime contract action carries one code, chosen by the contracting officer. We pulled every prime contract obligation coded to those three from the USAspending.gov API by fiscal year, together with the awarding agency, the recipient and the recipient's recorded business size. The fiscal 2026 row is shown but not used for any trend claim: Department of Defense contract actions are published with a 90-day delay, so the most recent quarter is understated, most of all for the codes Defense uses most.
| Fiscal year | Products (7J20) | Services, labor (DJ01) | As a service (DJ10) | Total | Small-business share |
|---|---|---|---|---|---|
| FY2022 | $302.3M | $1,095.6M | $308.3M | $1,706.2M | 55.4% |
| FY2023 | $347.1M | $1,583.8M | $327.6M | $2,258.5M | 51.2% |
| FY2024 | $542.6M | $1,803.3M | $479.3M | $2,825.2M | 55.6% |
| FY2025 | $516.6M | $1,533.7M | $461.0M | $2,511.3M | 59.3% |
| FY2026 (incomplete, see note) | $264.3M | $1,207.4M | $588.0M | $2,059.6M | 59.7% |
Three things stand out. First, this is a services market: labor under DJ01 was 61.1 percent of fiscal 2025 obligations, and it is also the code that fell, down 15.0 percent from fiscal 2024, which accounts for most of the overall decline. Second, security delivered as a service grew 49.5 percent between fiscal 2022 and fiscal 2025, from $308.3M to $461.0M, and fiscal 2026 has already recorded $588.0M under DJ10 before the delayed Defense actions arrive, more than the whole of fiscal 2025. The largest fiscal 2026 recipient under that code is General Dynamics Information Technology at $87.8M, and the General Services Administration placed $103.8M, against $22.7M in the whole of fiscal 2025. Third, the small-business share was 59.3 percent in fiscal 2025 against 55.4 percent in fiscal 2022, after dipping to 51.2 percent in fiscal 2023.
| Awarding department | Fiscal 2025 obligations | Share |
|---|---|---|
| Department of Defense | $1,086.6M | 43.3% |
| Department of Homeland Security | $339.3M | 13.5% |
| Department of Justice | $210.6M | 8.4% |
| Department of Health and Human Services | $173.6M | 6.9% |
| Department of Veterans Affairs | $103.0M | 4.1% |
| Department of Education | $86.1M | 3.4% |
| Department of the Interior | $80.0M | 3.2% |
| Department of the Treasury | $64.5M | 2.6% |
| Department of Transportation | $56.9M | 2.3% |
| Department of Agriculture | $55.3M | 2.2% |
| All other agencies (40) | $255.4M | 10.2% |
| All civilian agencies combined | $1,424.7M | 56.7% |
| Total | $2,511.3M | 100.0% |
The Department of Defense is the largest single buyer at 43.3 percent, but civilian agencies together placed 56.7 percent of the dollars, led by Homeland Security at 13.5 percent and Justice at 8.4 percent. The split differs by code. Under the product code the largest buyer is the Department of Justice, at 34.1 percent, and Defense takes 32.3 percent. Under the labor code Defense takes 52.7 percent. Under the as-a-service code Defense is the largest buyer but takes only 24.1 percent. A security product or managed-service company with no defense practice is therefore not locked out of the federal market the way the CMMC section above might suggest; civilian departments are a majority of the security-coded spend.
| Codes and year | Recipients | Median recipient | Top 1 | Top 5 | Top 10 | Top 25 | At least $1M | Under $100K | Small-business share |
|---|---|---|---|---|---|---|---|---|---|
| All three codes, FY2022 | 641 | $235K | 23.9% | 32.1% | 39.6% | 54.3% | 202 | 248 | 55.4% |
| All three codes, FY2025 | 688 | $380K | 11.4% | 24.2% | 33.4% | 51.2% | 258 | 251 | 59.3% |
| Security and compliance products (7J20), FY2025 | 295 | $91K | 23.8% | 50.8% | 63.7% | 80.8% | 59 | 152 | 66.9% |
| Security and compliance support services, labor (DJ01), FY2025 | 312 | $975K | 18.6% | 34.6% | 46.2% | 63.3% | 153 | 69 | 50.2% |
| Security and compliance as a service (DJ10), FY2025 | 224 | $289K | 5.5% | 21.8% | 35.2% | 63.2% | 81 | 84 | 81.5% |
Leidos was the largest recipient in both years, but its share of the security-coded dollars fell from 23.9 percent in fiscal 2022 to 11.4 percent in fiscal 2025, while the number of recipients with positive obligations rose from 641 to 688 and the median recipient's total rose from $235K to $380K. Of those fiscal 2025 recipients, 251 received less than $100,000. The labor code is where scale matters most: its median recipient took $975K, and its small-business share, 50.2 percent, is the lowest of the three. The product code moved the other way from the market as a whole. Its five largest recipients held 50.8 percent of the dollars in fiscal 2025 against 30.5 percent in fiscal 2022, and those five were Minburn Technology Group LLC, Dell Federal Systems L.P., Sealing Technologies LLC, Carahsoft Technology Corporation and Thundercat Technology LLC.
We searched every fiscal 2025 recipient under the three codes for 17 security product companies: CrowdStrike, Palo Alto Networks, Zscaler, Fortinet, Okta, Splunk, Tenable, Rapid7, SentinelOne, Cisco, Mandiant, Check Point, Proofpoint, Cloudflare, IBM, Akamai and Trend Micro. None of them appears. Microsoft Corporation appears with $2.6M and Google Public Sector with $0.2M. Carahsoft Technology, a public-sector IT distributor, received $35.4M, World Wide Technology $10.5M and Booz Allen Hamilton $33.0M. That does not mean agencies do not buy those companies' products. It means that when the purchase is coded as security, the prime contract goes to someone else: a reseller, a distributor or an integrator that bundles the product with services. Some purchases are also coded under general software or cloud codes that this measurement does not include. Either way, the party a security product company actually signs with on a federal deal is usually not the agency.
For a security product company the federal plan is a partner plan. The marketing work is equipping the resellers and integrators who hold the prime contracts: a partner page that names the contract vehicles you are available on, reseller-ready one-page briefs written in the agency's own language, and proof built for the programme office rather than the CISO. For a security services firm, the 59.3 percent small-business share is the most useful number in this section. It suggests that much of the competition for federal security work is among small firms, that a recorded small-business size status is a positioning asset to put in front of large primes looking for teaming partners, and that a civilian-agency case study can be worth as much as a defense one. For both, the growth in security delivered as a service is the trend to build content around, because it is where new money is appearing even in a year when the overall total fell.
What this data does not show
In fiscal 2025, federal agencies obligated $2,511.3M in prime contracts coded to the three cybersecurity product and service codes, according to USAspending.gov. That is down 11.1 percent from $2,825.2M in fiscal 2024 and up 47.2 percent from $1,706.2M in fiscal 2022. Labor-based support services were 61.1 percent of it. The figure counts only contracts coded as security, so it is a floor on security contracting rather than the whole federal cyber budget.
Yes, most of the dollars. Small businesses received 59.3 percent of fiscal 2025 federal prime contract dollars coded as cybersecurity, up from 55.4 percent in fiscal 2022. The share is highest for security delivered as a service, at 81.5 percent, and lowest for labor-based support services, at 50.2 percent, where large integrators such as Leidos hold the biggest contracts. The median recipient across all three codes received $380K in fiscal 2025.
Usually not as its first move. None of 17 major security product companies, including CrowdStrike, Palo Alto Networks, Zscaler and Fortinet, appears as a prime recipient of fiscal 2025 federal contracts coded as cybersecurity. Those prime contracts go to resellers, distributors and integrators. For a product company the federal plan is a partner plan: equip the firms that hold the contracts, publish the contract vehicles you are available through, and build proof for civilian agencies, which placed 56.7 percent of the security-coded dollars.
Data and analysis by Mark Gabrielli, fractional CMO, 4 October 2026. Every figure was pulled from the USAspending.gov public API on that date and can be reproduced with the same filters. This describes a public contract record for marketing planning purposes; it is not procurement or legal advice.
Short answer: the larger of the two main IT services industries stopped growing in 2022 and is now shrinking, it is split between a long tail of very small firms and a few very large ones, and it is most concentrated in Virginia, Maryland and the District of Columbia. Private computer systems design services firms (NAICS 541512) employed 1,113,755 people in 2025, 2.5% fewer than in 2022, and March 2026 employment was 3.5% lower than a year earlier while all private employment rose 0.2%. Other computer related services (NAICS 541519), a much smaller industry, grew 4.0% over the same twelve months. These are counts from state unemployment insurance records, not a survey, published by the Bureau of Labor Statistics in its Quarterly Census of Employment and Wages (QCEW).
There is no industry code for cybersecurity. Firms that sell security services, managed security and security integration are classified together with other IT services firms, in industries such as these two, so this section measures the two industries as a whole, security and non-security firms together. It matters to a cybersecurity marketer for three reasons: these firms include the managed service providers, resellers and integrators that many security products reach customers through, they are the competitive set for a security services company, and they compete with you for the same technical staff. The sections above measure demand from regulation and from federal buyers; this one measures the channel and the competition.
| Year | Systems design establishments | Systems design employees | Systems design average pay | Other computer services establishments | Other computer services employees | Other computer services average pay | All private employers, average pay |
|---|---|---|---|---|---|---|---|
| 2019 | 134,940 | 1,031,989 | $116,783 | 18,227 | 115,446 | $119,684 | $59,202 |
| 2020 | 140,432 | 1,038,187 | $122,410 | 19,422 | 116,215 | $126,434 | |
| 2021 | 151,186 | 1,079,891 | $133,654 | 22,862 | 125,769 | $141,889 | |
| 2022 | 166,068 | 1,142,553 | $132,767 | 27,862 | 140,333 | $145,174 | $70,346 |
| 2023 | 173,416 | 1,140,714 | $137,304 | 31,739 | 130,377 | $134,831 | |
| 2024 | 178,032 | 1,138,336 | $147,775 | 34,077 | 134,984 | $144,785 | |
| 2025 | 177,610 | 1,113,755 | $156,941 | 35,256 | 140,988 | $156,368 | $79,094 |
| Q1 2026 (March) | 179,455 | 1,078,408 (-3.5% y/y) | 36,371 | 144,575 (+4.0% y/y) |
Computer systems design employment grew 10.7% from 2019 to 2022, then fell in each of the three years after: by 0.2% in 2023, 0.2% in 2024 and 2.2% in 2025. It ended 2025 2.5% below 2022, though still 7.9% above 2019. The decline sped up in early 2026, with March employment 3.5% lower than a year earlier, even as the number of establishments rose 2.1%. Other computer related services, which covers work such as computer disaster recovery and software installation, followed a different path: a dip in 2023, a recovery to 140,988 in 2025, 0.5% above its 2022 level, and growth of 4.0% in March 2026.
Pay is the other half of the picture. Average pay per computer systems design employee was $156,941 in 2025, about 2.0 times the average across all private employers, and it rose 34.4% from 2019, about the same rate as private pay overall (33.6%). For a cybersecurity company hiring engineers, sales engineers or technical marketers, that is the wage level the IT services firms around you set.
| Employees at the establishment | Systems design establishments | Share | Cumulative share | Systems design employees, March 2025 | Share of employees | Other computer services establishments | Share |
|---|---|---|---|---|---|---|---|
| Fewer than 5 | 145,224 | 82.6% | 82.6% | 153,136 | 13.7% | 29,688 | 85.9% |
| 5 to 9 | 13,660 | 7.8% | 90.4% | 88,952 | 8.0% | 2,384 | 6.9% |
| 10 to 19 | 7,960 | 4.5% | 94.9% | 106,931 | 9.6% | 1,270 | 3.7% |
| 20 to 49 | 5,491 | 3.1% | 98.0% | 166,566 | 14.9% | 811 | 2.3% |
| 50 to 99 | 1,968 | 1.1% | 99.1% | 135,411 | 12.1% | 236 | 0.7% |
| 100 to 249 | 1,091 | 0.6% | 99.7% | 165,757 | 14.8% | 133 | 0.4% |
| 250 to 499 | 271 | 0.2% | 99.9% | 93,915 | 8.4% | 23 | 0.1% |
| 500 to 999 | 118 | 0.1% | 100.0% | 80,397 | 7.2% | 5 | 0.0% |
| 1,000 or more | 65 | 0.0% | 100.0% | 126,495 | 11.3% | 3 | 0.0% |
| All establishments | 175,848 | 100.0% | 1,117,560 | 100.0% | 34,553 | 100.0% |
Of 175,848 computer systems design establishments, 82.6% had fewer than five employees, yet together they held only 13.7% of the industry's jobs. At the other end, 454 establishments with 250 or more employees held 26.9%. Other computer related services is even more fragmented: 85.9% of its 34,553 establishments had fewer than five employees, and only 31 had 250 or more.
For a security product company that sells through partners, this shape is the partner program problem in numbers. The recruitable partner base is mostly very small firms, which need ready-made campaigns, co-branded content and simple deal registration because they have no marketing staff of their own. The partners with the most staff are a few hundred large establishments, which need executive relationships and proof built for their own customers. A single partner marketing program rarely serves both.
Texas has the most computer systems design jobs, 142,161 in 2025, followed by California with 113,633 and Virginia with 100,267. Relative to the size of each economy the picture changes: Virginia's share of computer systems design jobs is 3.38 times its share of all private jobs, the highest location quotient of any state, followed by Maryland (2.48) and the District of Columbia (2.30). Those three held 14.5% of the industry's jobs. It is the same federal contracting corridor the contract data above points to, and Virginia also leads on concentration in other computer related services among the states that publish a figure.
| State | Establishments, 2025 | Employees, 2025 | Average annual pay, 2025 | Location quotient | Change in employees, 2022 to 2025 | Other computer services employees, 2025 |
|---|---|---|---|---|---|---|
| Texas | 18,716 | 142,161 | $137,712 | 1.41 | +9.0% | 9,820 |
| California | 13,958 | 113,633 | $232,670 | 0.87 | -4.9% | 12,664 |
| Virginia | 8,160 | 100,267 | $163,934 | 3.38 | -6.8% | 12,563 |
| Florida | 8,741 | 55,573 | $148,310 | 0.78 | +2.1% | 12,230 |
| New York | 7,440 | 49,254 | $157,116 | 0.70 | -5.3% | 4,806 |
| Maryland | 5,264 | 48,904 | $141,443 | 2.48 | -9.4% | 5,210 |
| Washington | 11,206 | 44,789 | $245,018 | 1.74 | -5.1% | 3,623 |
| Colorado | 5,787 | 39,090 | $202,561 | 1.89 | -1.9% | 2,010 |
| Georgia | 6,594 | 38,575 | $126,468 | 1.10 | +4.9% | 5,729 |
| North Carolina | 7,264 | 37,263 | $135,150 | 1.05 | +8.0% | 3,551 |
Among these ten states, four had more computer systems design jobs in 2025 than in 2022. Texas grew fastest, by 9.0%, and Maryland fell the most, by 9.4%. The highest average pay in the industry is in Washington, $245,018.
Florida is fourth by computer systems design employment, 55,573 jobs across 8,741 establishments, and grew 2.1% from 2022 to 2025, but with a location quotient of 0.78 it is less concentrated in the industry than the nation as a whole. In other computer related services it stands out: Florida has 3,324 establishments, more than any other state that publishes a count, and is third by employment with 12,230, at about 3.7 employees per establishment. For a cybersecurity company selling into the Southeast, the Florida partner base is large and made up mostly of very small firms.
Payroll records do not explain why computer systems design employment has fallen since 2022, and this section does not claim a cause. They do give a cybersecurity marketing plan three working facts. The channel is shrinking in headcount while the number of establishments is still rising, so partner recruitment has to reach more, smaller partners with less capacity each. The federal corridor of Virginia, Maryland and the District of Columbia is where the industry is most concentrated, which makes it the natural place for field events, partner councils and account-based campaigns aimed at integrators. And technical staff in these industries are paid about twice the private average, so content and campaigns that a small marketing team can run without hiring specialist writers are worth more than they look.
What this data does not show
It depends on the segment. Private computer systems design services employment, the larger of the two IT services industries measured here, averaged 1,113,755 in 2025, 2.5% below its 2022 level, and March 2026 employment was 3.5% lower than a year earlier while all private employment rose 0.2%, according to the Bureau of Labor Statistics Quarterly Census of Employment and Wages. The smaller other computer related services industry grew instead, 4.0% in March 2026 from a year earlier, and its number of establishments has risen every year since 2019.
Federal payroll data does not count cybersecurity firms separately, but it does count the IT services industries they are classified in. Texas has the most computer systems design jobs, 142,161 in 2025, followed by California and Virginia. Relative to the size of each economy, Virginia, Maryland and the District of Columbia are the most concentrated of all states, and those three held 14.5% of the industry's jobs. Florida ranks fourth by employment, with 55,573 jobs, and has more other computer related services establishments than any other state that publishes a count.
Very small, with a few very large ones. In March 2025, 82.6% of the 175,848 private computer systems design establishments in the United States had fewer than five employees, but they held only 13.7% of the industry's jobs. The 454 establishments with 250 or more employees held 26.9%. For a cybersecurity company that sells through managed service providers and integrators, that means a long tail of small partners to recruit and a short list of large ones that together employ about a quarter of the industry.
Data and analysis by Mark Gabrielli, fractional CMO, 8 October 2026. Every figure was computed from the BLS public data files named above and can be reproduced from them. This describes public employment records for marketing planning purposes.
Short answer: the IT services industries that cybersecurity companies sell through are made up mostly of very small companies, but their revenue sits overwhelmingly with a small number of very large ones. In 2022 the United States had 127,147 employer firms in computer systems design and related services (NAICS 5415). Of those, 75.0% had fewer than five employees, while the 1,437 firms with annual receipts of $100 million or more, 1.1% of the total, took 62.4% of the group's $656.4 billion in receipts. For the average firm with 20 to 49 employees, one marketing manager at this industry's median wage would equal 6.0% of its payroll. These are Census Bureau counts of companies, published in the Statistics of U.S. Businesses (SUSB).
The section above counts worksites. This one counts companies. A worksite, or establishment, is a single location, and a company with offices in many states has many of them; SUSB adds all of a company's locations together into one firm and sizes it by the employees and receipts of the whole company. That is the view a partner program needs, because partners sign agreements and run marketing as companies, not as offices. SUSB also sizes these firms by revenue, which the Census Bureau collects only in Economic Census years; 2022 is the most recent.
The two sources do not count the same things and should not be combined. For computer systems design services (NAICS 541512) in 2022, the payroll records in Table 28 counted 166,068 establishments and SUSB counted 58,312, about 35% as many. The two programs build their counts differently, and this page does not attempt to reconcile them; each source is used here only against itself.
| Employees at the company | Firms | Share of firms | Locations per firm | Employees in NAICS 5415, March 2022 | Share of employment | Share of receipts | Average receipts per firm | Average annual payroll per firm | One median marketing manager as a share of payroll |
|---|---|---|---|---|---|---|---|---|---|
| Fewer than 5 | 95,382 | 75.0% | 1.00 | 125,280 | 5.9% | 5.9% | $405,687 | $118,163 | more than the whole payroll |
| 5 to 9 | 12,397 | 9.8% | 1.01 | 81,788 | 3.8% | 3.4% | $1,806,677 | $589,247 | 33.0% |
| 10 to 19 | 7,913 | 6.2% | 1.03 | 107,092 | 5.0% | 4.5% | $3,765,568 | $1,326,089 | 14.7% |
| 20 to 49 | 5,872 | 4.6% | 1.08 | 177,705 | 8.4% | 7.5% | $8,408,771 | $3,263,615 | 6.0% |
| 50 to 99 | 2,337 | 1.8% | 1.19 | 155,114 | 7.3% | 6.7% | $18,943,385 | $7,568,656 | 2.6% |
| 100 to 499 | 2,188 | 1.7% | 1.64 | 378,284 | 17.8% | 17.6% | $52,715,815 | $21,152,779 | 0.9% |
| 500 to 4,999 | 745 | 0.6% | 4.57 | 404,320 | 19.0% | 21.0% | $185,270,426 | $74,986,557 | not shown, see note |
| 5,000 or more | 313 | 0.2% | 41.55 | 696,990 | 32.8% | 33.3% | $698,196,058 | $299,169,827 | not shown, see note |
| All firms in the industry group | 127,147 | 100.0% | 1.14 | 2,126,573 | 100.0% | 100.0% | $5,162,848 | $2,058,312 |
In this industry group 91.0% of firms had fewer than 20 employees, and together they held 14.8% of its employment and 13.8% of its receipts. The 1,058 companies with 500 or more employees, 0.8% of firms, held 51.8% of employment and 54.3% of receipts. The 313 companies with 5,000 or more employees operated an average of 41.5 locations each in this industry group, against about one for every company under 20 employees.
The last column is the cost of marketing staff in a partner or competitor of each size. For the average firm with 10 to 19 employees, annual payroll was $1,326,089, and one marketing manager at this industry's median wage would be 14.7% of it. At 20 to 49 employees the share is 6.0%, at 50 to 99 it is 2.6% and at 100 to 499 it is 0.9%. Below 10 employees it is 33.0% or more. Before benefits, a dedicated marketing manager is a large share of payroll for firms under 20 employees and a small one above 50. The fully loaded cost of a marketing leader at a cybersecurity services firm, set out in the federal wage section above, is $287,700 a year.
| Annual receipts of the company | Firms | Share of firms | Cumulative share of firms | Employees in NAICS 5415, March 2022 | Average employees per firm | Share of receipts | Average receipts per firm |
|---|---|---|---|---|---|---|---|
| Under $500,000 | 78,646 | 61.9% | 61.9% | 98,265 | 1.2 | 2.2% | $181,955 |
| $500,000 to $999,999 | 15,129 | 11.9% | 73.8% | 49,426 | 3.3 | 1.6% | $707,941 |
| $1 million to $2.49 million | 14,315 | 11.3% | 85.0% | 97,112 | 6.8 | 3.5% | $1,583,798 |
| $2.5 million to $4.99 million | 7,209 | 5.7% | 90.7% | 102,647 | 14.2 | 3.9% | $3,521,782 |
| $5 million to $9.99 million | 4,703 | 3.7% | 94.4% | 124,933 | 26.6 | 5.0% | $6,932,076 |
| $10 million to $14.99 million | 1,874 | 1.5% | 95.9% | 85,419 | 45.6 | 3.4% | $11,919,750 |
| $15 million to $49.99 million | 3,034 | 2.4% | 98.2% | 257,882 | 85.0 | 11.3% | $24,460,025 |
| $50 million to $99.99 million | 800 | 0.6% | 98.9% | 147,927 | 184.9 | 6.8% | $56,144,694 |
| $100 million or more | 1,437 | 1.1% | 100.0% | 1,162,962 | 809.3 | 62.4% | $284,824,580 |
| All firms in the industry group | 127,147 | 100.0% | 2,126,573 | 16.7 | 100.0% | $5,162,848 |
Revenue is far more concentrated than headcount. The 1,437 firms with receipts of $100 million or more were 1.1% of firms and employed 54.7% of the group's workforce, but they took 62.4% of its receipts. The 78,646 firms with receipts under $500,000 were 61.9% of firms and took 2.2%. Between them, 43,230 firms had receipts between $500,000 and $15 million: 34.0% of firms, 21.6% of employment and 17.3% of receipts.
For an IT services or security services firm that is itself weighing a fractional CMO, the middle of that range is the useful comparison. The 4,703 firms with receipts of $5 million to $9.99 million averaged $6,932,076 in receipts and 26.6 employees. A marketing manager at this industry's median wage is 2.80% of that revenue, and the $8,000 to $15,000 monthly retainer this page gives as the typical figure comes to $96,000 to $180,000 a year, or 1.4% to 2.6%. At that size the two are of the same order, with the whole retainer range below the median salary alone, before benefits. The difference that matters is what the money buys: part of the week of someone with executive experience, or all of the week of a manager at the middle of the occupation.
| Industry (NAICS) | Firms | Employees, March 2022 | Receipts | Receipts per employee | Payroll per employee | Firms with fewer than 5 employees | Employment at companies with 500 or more employees | Receipts at companies with $100 million or more |
|---|---|---|---|---|---|---|---|---|
| Custom computer programming services (541511) | 62,773 | 1,044,544 | $305.3 billion | $292,242 | $127,071 | 73.2% | 46.7% | 56.5% |
| Computer systems design services (541512) | 49,252 | 815,846 | $278.3 billion | $341,141 | $120,371 | 76.9% | 58.1% | 69.3% |
| Computer facilities management services (541513) | 4,950 | 115,566 | $30.8 billion | $266,793 | $97,213 | 61.4% | 53.1% | 63.6% |
| Other computer related services (541519) | 10,650 | 150,617 | $42.0 billion | $279,051 | $129,719 | 79.7% | 52.1% | 58.4% |
| All four (NAICS 5415), each firm counted once | 127,147 | 2,126,573 | $656.4 billion | $308,685 | $123,066 | 75.0% | 51.8% | 62.4% |
Custom computer programming is the largest of the four, with 62,773 firms and 1,044,544 employees. Computer systems design, the industry that includes systems integration services, had 49,252 firms and the highest receipts per employee of the four, $341,141. Other computer related services had the highest share of very small firms, 79.7% with fewer than five employees, and computer facilities management, the smallest by firm count with 4,950, had 53.1% of its employment at companies with 500 or more employees.
Firm counts cannot say which of these companies resell security products or how well any of them market. They do settle three planning questions for a cybersecurity company with a channel. First, the revenue is in a short list: 1,437 companies take 62.4% of receipts, so partner revenue targets should be built account by account at the top, with named executive sponsors and joint business plans. Second, the company count is in the long tail: 91.0% of firms have fewer than 20 employees, and for the average firm of 10 to 19 employees a dedicated marketing manager would cost 14.7% of payroll, so a program that reaches them has to supply the marketing itself, in ready-made campaigns, co-branded content and simple deal registration. Third, these two audiences need different programs, budgets and people, and a plan that treats them as one partner tier will serve neither well.
What this data does not show
In 2022 the Census Bureau counted 127,147 employer firms in computer systems design and related services (NAICS 5415), the industry group the Census Bureau uses for IT services such as custom programming, systems design and integration, and computer facilities management. They had 2,126,573 employees and $656.4 billion in receipts. Most are very small: 75.0% had fewer than five employees. At the other end, 313 firms with 5,000 or more employees across the whole company held 32.8% of the group's employment. There is no separate industry code for cybersecurity, so security services firms are counted inside these figures.
Very concentrated. Of the 127,147 US employer firms in computer systems design and related services in 2022, the 1,437 with annual receipts of $100 million or more were 1.1% of firms but took 62.4% of the industry's $656.4 billion in receipts, according to the Census Bureau's Statistics of U.S. Businesses. Firms with receipts between $500,000 and $15 million numbered 43,230, 34.0% of all firms, and together took 17.3% of receipts. A partner program sized for the largest firms reaches most of the money but few of the companies.
It is a large commitment below about 20 employees. In 2022 the average IT services firm with 10 to 19 employees had annual payroll of $1,326,089, and one marketing manager paid the May 2025 median for this industry, $194,300, would equal 14.7% of it before benefits. At 20 to 49 employees the share falls to 6.0%, and at 50 to 99 employees to 2.6%. The figures combine Census Bureau firm data for 2022 with Bureau of Labor Statistics wage data for 2025, so the shares are somewhat higher than a same-year comparison would give.
Data and analysis by Mark Gabrielli, fractional CMO, 12 October 2026. Every figure was computed from the Census Bureau and BLS public files named above and can be reproduced from them. This describes public business statistics for marketing planning purposes.
Fractional CMO engagements in cybersecurity follow a predictable arc. The first 90 days are about establishing the foundation - messaging clarity, ICP definition, competitive positioning, and channel prioritization. This alone is often worth the investment for companies that have been marketing without a clear strategic framework.
By month 6, the focus shifts to execution and measurement. ABM programs are generating conversations with target accounts. The content engine is producing assets that are earning links and building authority. The sales team has the positioning, tools, and enablement content it needs to compete in enterprise deals. Marketing and sales are aligned around shared pipeline metrics.
By month 12, the compounding effects start to show. Predictable pipeline from target accounts. Reduced customer acquisition cost as organic and referral channels carry more weight. Measurable brand authority in your niche, reflected in analyst mentions, media coverage, and inbound from the accounts you want to win.
Learn more about hiring a fractional CMO
A fractional CMO for cybersecurity companies provides senior marketing leadership on a part-time or project basis. This includes building go-to-market strategy, leading demand generation, managing brand positioning, and overseeing the marketing team - all tailored to the specific challenges of the cybersecurity sector.
Security buyers trust proof and peers, not promises. CISOs weigh analyst validation (Gartner, Forrester), named customer references, and quantified risk reduction; practitioners want technical depth, docs, and community rather than gated whitepapers; the economic buyer wants compliance coverage and total-cost framing. A fractional CMO sets the buyer-specific message first, then builds the channel mix around what each audience actually trusts.
Fractional CMO engagements for cybersecurity companies typically range from $7,000 to $15,000 per month depending on scope and time commitment. This compares to $200,000-$350,000 per year for a full-time CMO - making fractional significantly more cost-effective for companies not yet ready for a full-time hire.
The right time is when your company is generating $2M-$30M in revenue, marketing is underperforming but a full-time CMO isn't justified yet, or you're entering a new market, launching a product, or preparing for a fundraise or acquisition.
Most engagements run 6-18 months. The first 90 days focus on audit, strategy, and quick wins. After that, the work shifts to execution, team building, and scaling what's working. Many clients continue long-term as an ongoing strategic partner.
Cybersecurity buyers - especially CISOs and security leadership teams - are deeply skeptical of fear-based messaging and vendor hype. Building trust through credible content, analyst positioning, and peer validation takes priority over urgency-driven campaigns. Sales cycles are long, buying committees are large, and compliance-aware messaging is essential to staying credible throughout the process.
A fractional CMO for cybersecurity shortens enterprise sales cycles by building the content and credibility infrastructure that security buyers require before engaging vendors. This includes ABM programs targeting specific enterprise accounts, analyst relations that build third-party validation with Gartner and Forrester, and CISO-grade thought leadership that earns trust at the top of the buying committee.
Yes. Channel and MSSP marketing is a core component of cybersecurity GTM strategy. A fractional CMO can build co-marketing programs, deal registration frameworks, and partner enablement content that drives revenue through MSSPs, VARs, and reseller networks without cannibalizing direct pipeline.
Yes. The playbook shifts by category. Endpoint and EDR vendors fight feature-parity in a crowded field and win on proof-of-detection content that survives a POC bake-off. Cloud security (CNAPP) buyers change vocabulary fast, so messaging has to track the stack and workflow, not the acronym of the quarter. Identity and GRC deals are committee-heavy and compliance-driven, rewarding ABM and audit-outcome framing (audit-hours saved, SOC 2 and FedRAMP coverage). MSSP and MDR win on channel enablement and response-time outcomes, while application and API security has to earn developer trust with community and technical content rather than gated whitepapers. A fractional CMO sets the category-specific priority first, then builds the channel mix around it. See the category breakdown table above.
Let's talk about what a fractional CMO can do for your cybersecurity business in 90 days.
Book Your Free Strategy CallEvery MarkCMO engagement is structured to protect you. You stay because the results are compounding - not because you are locked in. Cancel any time. No fees, no questions.
What does a fractional CMO do for companies in this market?
A fractional CMO acts as your Chief Marketing Officer on a part-time basis - typically 2-3 days per week - with full executive accountability for strategy, team leadership, budget, and revenue outcomes. They own your entire marketing function and are accountable for pipeline generation and revenue attribution, not just deliverables.
How quickly will I see results?
Most engagements produce measurable outputs within 30 days: a GTM strategy, ICP definition, messaging architecture, and demand generation plan. Pipeline movement typically appears in 60-90 days as campaigns launch. Long-term compounding results build over 6-12 months.
Is there a long-term contract required?
No. Every MarkCMO engagement is month-to-month. There are no long-term contracts, no cancellation fees, and no lock-in. You stay because the results justify it. We offer a free GTM diagnostic before you commit to any paid engagement.
Do I have to sign a long-term contract?
No. Every MarkCMO engagement is month-to-month. There are no long-term contracts, no cancellation fees, and no lock-in clauses. You stay because the results justify it - not because you are contractually obligated. We offer a free GTM diagnostic before you commit to any paid engagement so you can validate fit before spending a dollar.
How does the engagement start?
Step one is a free 30-minute GTM diagnostic call. We review your current situation, revenue goals, team structure, and the biggest gap between where you are and where you need to be. If there is a clear fit, we outline a 30-60-90 day plan and agree on scope. Most engagements are live within 5-7 business days of the diagnostic call.
Free Strategy Call
No pitch. No deck. A direct 30-minute conversation about your biggest commercial challenge and exactly what to do about it.
Book a free GTM diagnostic call. No pitch. No pressure. We review your current situation, identify the single biggest gap in your marketing, and give you a clear path forward - whether you hire us or not.
No long-term contracts • Month-to-month
2026 rate update (August 2026): The 2026 Fractional CMO Rate Report we just published compares 11 market sources: fractional retainers run $5,000-$22,000 a month, and every source that names a typical figure lands at $8,000-$15,000, what most Cybersecurity growth companies pay. See the full sourced breakdown by company size and industry, with methodology.
Cybersecurity is a trust-driven market with over 4,000 vendors and near-identical messaging, so superior technology is only table stakes. A fractional CMO differentiates the brand, translates technical depth into buyer language, and builds the third-party proof and reference strategy that skeptical CISOs, compliance, and risk stakeholders demand, all without the cost or ramp of a full-time executive hire.
Most engagements run $7,000 to $15,000 per month, typically 15 to 25 hours a week, versus $200,000 to $350,000 a year for a full-time cybersecurity CMO. The fit is strongest for vendors between roughly $2M and $20M ARR that need strategic marketing leadership but cannot justify a full executive salary. Pricing flexes with scope, hours, and how much team you already have in place.
They own the full go-to-market function part-time: defining the ICP, sharpening positioning against look-alike competitors, and aligning marketing with sales so activity becomes pipeline. Strong operators arrive with security-industry domain knowledge and CISO relationships on day one, so ramp is short. Deliverables usually include messaging that survives technical scrutiny, a demand-generation engine, and analyst or third-party validation that shortens trust-heavy buying cycles.