Overview
Deloitte Cyber is the cybersecurity practice within Deloitte Touche Tohmatsu Limited, the largest of the Big Four professional services networks by aggregate revenue. Deloitte reported global revenue of US$70.5 billion for the fiscal year ending 31 May 2025 across more than 470,000 staff. The Cyber practice operates as a horizontal capability across the Risk Advisory and Consulting service lines and employs more than 40,000 dedicated security professionals across delivery centres in the United States, India, Europe, and the Middle East.
For the second consecutive year, Deloitte was ranked number one by revenue in the Gartner Market Share: Security Services, Worldwide 2024 report, holding 16.6% of the global market with a 17% year-over-year growth rate. The practice spans four service families: strategy and transformation, defence and resilience, enterprise security (identity, cloud security, data protection, OT), and digital trust and privacy. Deloitte operates more than thirty cyber intelligence centres, including a flagship MDR fusion centre network anchored in Atlanta, Madrid, Toronto, and Bangalore.
Buyers typically engage Deloitte Cyber for board-level transformation programmes, regulated industry compliance work (SOX, NYDFS, DORA, NIS2), and large managed detection-and-response contracts. The practice is rarely the cheapest option and is over-indexed on advisory work; pure-play technology execution at scale is sometimes subcontracted to Indian tier-1 partners.
Services Offered
- Cyber strategy, target operating model design, and CISO advisory
- Managed detection and response (MDR) and 24/7 SOC operations
- Identity and access management programmes (SailPoint, Saviynt, Okta)
- Cloud security architecture and posture management (CSPM, CNAPP)
- Regulatory compliance — DORA, NIS2, NYDFS, HIPAA, PCI DSS
- Data privacy programmes and GDPR remediation
- OT and ICS security for manufacturing, energy, and utilities
- Cyber incident response and forensics (Deloitte CIR)
- Third-party and supply chain risk management
- Application security and DevSecOps integration
Typical Engagement
| Engagement Type | Model | Typical Range |
|---|---|---|
| Cyber maturity assessment | Fixed-fee project | $250K–$1.5M (6–12 weeks) |
| Security transformation programme | Time & materials or outcome-based | $3M–$30M (12–24 months) |
| Multi-year managed security services | Outcome contract with SLAs | $5M–$80M+ (3–5 years) |
| MDR retainer | Monthly subscription | $60K–$900K per month |
| Staff augmentation (security consultant) | Hourly bill rate | $165–$420/hour blended |
Pricing verified May 2026 from public procurement data and reference checks; ranges vary by region and engagement structure.
Strengths
- Largest cybersecurity services revenue base globally per Gartner Market Share 2024 with 16.6% share
- Deep regulatory and audit-adjacent expertise from sibling Deloitte audit practice — relevant for SOX, NYDFS, DORA, SEC disclosure
- Global fusion centre network with 24/7 follow-the-sun coverage and integrated threat intelligence
- Industry-specific cyber practices for financial services, public sector, life sciences, energy, and consumer
- Board and CISO-level access — partners typically have prior CISO or audit committee experience
- Significant US Federal capability through Deloitte Government & Public Services LLP, including FedRAMP authorised offerings
Limitations
- Premium pricing — onshore advisory rates typically $300–$500/hour, materially above Indian tier-1 and pure-play security firms
- Audit independence rules restrict Deloitte Cyber from delivering some implementation work for the firm's audit clients, creating scoping constraints
- Tooling-agnostic posture means buyers wanting deeply opinionated technology recommendations may find advice diplomatic rather than directive
- Engineering bench for product-led security automation work is thinner than dedicated MSSPs such as CrowdStrike Services or Mandiant
- Member-firm structure means delivery quality and commercial flexibility vary between Deloitte US, UK, Switzerland, India, and other geographies