"What percentage of my budget should go to security" is a question I get asked often enough, and I don't think it has one clean universal answer. It does have a reasonable way to think it through, based on what your specific app actually holds rather than a generic industry rule of thumb.
Why a flat percentage doesn't really work
A todo list app for a handful of friends and a fintech tool handling real account balances aren't remotely the same risk category, even if they're both technically "a small startup." A flat percentage applied to both either wastes real money on the first one or dangerously underfunds the second. The actual driver isn't your revenue or your headcount. It's what happens if the data you're holding gets exposed.
A more useful way to frame the question
Ask what the realistic cost of a bad incident actually looks like for your specific app: lost trust, direct financial liability, regulatory exposure, the cost of notifying and supporting affected users. That number varies enormously depending on what you store. Security spending is reasonably sized relative to that potential cost, not relative to your total budget as an arbitrary fraction.
What tends to be true regardless of stage
- The free, foundational checks, access control, key handling, admin route protection, cost time rather than money, and are worth doing fully regardless of budget size. This is the highest-leverage spend that exists, and it's free.
- A scoped, one-time review from someone independent is usually the first real dollar amount worth spending, once your app holds anything beyond throwaway test data.
- Ongoing monitoring or a subscription tool becomes worth its cost once your app changes often enough that a single point-in-time check goes stale quickly.
- Heavier spend, formal audits, certifications, dedicated security hires, generally makes sense once a specific customer, investor, or compliance requirement asks for it by name, not before.
The trap worth avoiding in both directions
Spending nothing because "we're too small to be a target" ignores that most real incidents this year traced back to free checks nobody ran, not sophisticated attacks nobody could afford to defend against. Spending heavily on formal certifications and expensive tooling before you have real users, while the basic access-control checks sit unverified, is money spent on the wrong layer of the problem. Both mistakes come from skipping the actual question: what do we hold, and what happens if it gets out.
There's no clean percentage to quote back. There is a real, answerable question underneath it, and it's worth answering honestly before deciding how much to spend, rather than picking a number that sounds responsible without actually being tied to your specific risk.