As of 13 August 2026, AI can create a cybersecurity budget for your small business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 30 minutes until you can act on the result.

   How to actually do it

   1. Open your bank, accounting and supplier records and gather the current cost, billing frequency and renewal date for every security-related product or service.
   2. Write down your staff count, devices, offices, cloud services, websites, business applications, important data and suppliers that can access your systems.
   3. List the security controls you already use, including backups, multi-factor authentication, endpoint protection, password management, staff training, monitoring, cyber insurance and incident response.
   4. Record known incidents, weaknesses, planned changes and the systems that would cause the most damage if they stopped working or were exposed.
   5. Paste the gathered information into the prompt and ask the chatbot to produce the three budget options, using unknown instead of filling gaps with estimates.
   6. Copy the resulting table into a spreadsheet and compare every amount with an invoice, renewal notice or current supplier quote, correcting the monthly and annual totals.
   7. Send the assumptions, gaps and proposed priorities to a qualified UK cybersecurity professional and ask them to check whether the planned controls match your main risks before approving the budget.

   Prompt

   Create a practical cybersecurity budget for this UK small business.
   
   Business description: [what we do, where we operate and how many people work here]
   Customers and suppliers: [who we serve and which suppliers or contractors have access]
   Devices and systems: [laptops, phones, servers, cloud services, websites, email and business applications]
   Data handled: [customer, employee, financial, health, payment or other sensitive data]
   Current controls: [backups, antivirus or endpoint protection, multi-factor authentication, password manager, firewalls, monitoring, staff training, cyber insurance and incident response]
   Current spending: [supplier, product or service, amount, billing frequency and renewal date]
   Known problems or incidents: [details or none known]
   Business changes planned: [new staff, systems, sites, customers or compliance requirements]
   Risk priorities: [the systems or outcomes that must remain available or confidential]
   Budget period: [12 months or another period]
   
   Produce:
   1. A budget table split into one-off, recurring and optional costs, showing the purpose of each item, the relevant risk, the assumption behind the cost and the information still missing.
   2. A minimum, sensible and stronger option, explaining what each option does not cover.
   3. A monthly and annual cash-flow view using only the figures I supplied.
   4. A list of duplicated, unnecessary or unexplained spend.
   5. A short implementation order based on risk and dependency.
   6. Questions I should ask suppliers before accepting a quote.
   
   Use UK terminology and pounds where I provide amounts. Do not invent prices, suppliers, legal requirements, certifications, incidents or security gaps. If a cost or fact is unknown, mark it as unknown and state how I can verify it. Separate financial planning from a technical security assessment. Do not claim that the budget makes the business secure. End with the specific points that need checking by a qualified UK cybersecurity professional.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.