Google Ads reports tell Cybersecurity advertisers what they paid per click and per lead, not what share of that spend reached a real security buyer. Lunio's invalid traffic data layer fills that gap, showing exactly how much of Google Ads' Cybersecurity benchmark spend never had a chance to convert. Find out how much of your Google Ads budget is being wasted →
Cybersecurity is one of the most auction-competitive categories on Google Ads. A limited pool of CISOs, security engineers, and IT directors is chased by well-funded SIEM, EDR, MDR, and zero trust vendors, all bidding for the same high-intent keywords, which pushes Search CPCs well above most B2B averages. Device and campaign-type mix matters just as much as keyword strategy: Search captures active buying intent, while Display, Video, and Demand Gen serve very different roles in the funnel and carry very different invalid traffic profiles.
| Campaign Type | Avg CPC | IVT Rate | Avg CPA |
|---|---|---|---|
| Search | $3.540 | 4.04% | $91.01 |
| Display | $0.038 | 14.40% | $26.66 |
| Performance Max | $0.461 | 3.75% | $39.33 |
| Video | $1.603 | 6.29% | $654.42 |
| Demand Gen | $0.301 | 2.90% | $446.57 |
| Shopping | $0.784 | 3.73% | $13.94 |
Shopping (n=4 for CPC/IVT, n=2 for CPA/CVR) and Video's CPA/CVR figures (n=6) sit on small samples and should be treated as directional, not benchmark-grade. Lunio's dataset doesn't break out mobile versus desktop performance for IT & Security accounts, and no cybersecurity-specific benchmark source publishes this split either. Directionally, security decision-makers do most of their solution research at a desk during business hours, so campaigns weighted toward desktop placements are more likely to reach the buying committee than mobile inventory optimised for broad reach.
| Metric | Average | Notes |
|---|---|---|
| CTR (Search) | 2.09% | Closest available proxy, from WordStream's Technology vertical benchmark (July 2026). Lunio's IT & Security dataset doesn't track CTR directly, and elevated CTR on Display inventory often signals automated engagement rather than buyer intent. |
| CVR (Search) | 5.64% | Per Lunio's 2026 IT & Security dataset (n=22). With a 4.04% Search IVT rate sitting alongside it, some share of this conversion signal reflects invalid rather than human activity. |
| CPA/CPL (Search) | $91.01 | Per Lunio's 2026 IT & Security dataset (n=22). Display's $26.66 CPA and 0.11% CVR (n=10) sit alongside a 14.40% IVT rate and should be read as a contamination signal, not a target benchmark. |
No ROAS figure appears in this table. Cross-industry ROAS benchmarks are typically built from same-session ecommerce purchases and have no meaningful application to Cybersecurity's three-to-18-month enterprise sales cycles, where the click and the revenue event can be more than a year apart. CPA and CPL measured against a defined Sales Accepted Lead or Sales Qualified Lead stage are the more defensible efficiency metrics for this vertical.
This page's Search, Display, Performance Max, Video, Demand Gen, and Shopping figures come from Lunio's monitor-only detection engine, tracking IT & Security accounts on Google Ads between January and 7 September 2026. Lunio's data vertical mapping uses "IT & Security" as the closest available proxy for Cybersecurity, and this same category also captures broader B2B SaaS advertisers; Cybersecurity-specific and B2B SaaS-specific sub-vertical data isn't yet isolated in the 2026 report, so treat these figures as directionally representative of the security buying category rather than a Cybersecurity-only sample. For a broader view of how invalid traffic behaves across platforms and industries, see the Lunio 2026 Global Invalid Traffic Report. Calculate how much you're losing →
Every Google Ads campaign type carries a different invalid traffic profile, and for Cybersecurity advertisers that difference is stark: Display exposure is nearly four times higher than Search, while Demand Gen looks clean on IVT but converts far worse. Understanding cost and contamination together, not separately, is the only way to judge whether a campaign type is genuinely efficient or just cheap.
Search carries a 4.04% IVT rate (n=63) on a $3.540 CPC, per Lunio's 2026 IT & Security dataset. This is the core acquisition channel for Cybersecurity buyers actively evaluating SIEM, EDR, and zero trust solutions, and it's also where competitor-driven invalid clicking is most financially attractive: at $3.54+ per click, exhausting a rival's daily budget is a cheap way to win impression share. Google's AI Max feature increases IVT exposure by roughly 35% above the Search baseline, per the Lunio 2026 Global Invalid Traffic Report, which matters for any account auto-upgraded since Google's September 2026 rollout.
Display's $0.038 CPC looks negligible next to Search, but its 14.40% IVT rate (n=31) is the highest of any campaign type in the dataset. Much of this exposure sits in made-for-advertising publisher inventory built around business-software-themed content designed to attract programmatic spend rather than human attention. Combined with a 0.11% CVR and $26.66 CPA, Display's numbers look efficient on the surface but should prompt an audit of whether those "conversions" are real security buyers or fake form fills.
Performance Max shows a 3.75% IVT rate (n=35) on a $0.461 CPC, with a $39.33 CPA that appears to outperform Search. PMax's cross-channel placements are opaque by design, though, so there's no way to see whether that lower CPA reflects genuine efficiency, branded-term cannibalisation, or invalid traffic sitting in the campaign's YouTube and Display components rather than its Search inventory.
Video campaigns average a $1.603 CPC with a 6.29% IVT rate (n=20). Much of Google Video Partners' third-party inventory sits outside YouTube proper and carries meaningfully higher invalid traffic exposure than YouTube placements, which likely explains part of the elevated rate. The $654.42 CPA (n=6, directional only) reflects Video's upper-funnel role and shouldn't be optimised as a bottom-funnel conversion channel.
Demand Gen has the lowest IVT rate in the dataset at 2.90% (n=32) but the weakest conversion economics: a $446.57 CPA against a 0.08% CVR (n=14). Clean traffic doesn't mean effective traffic. Gmail, YouTube, and Discover placements reach Cybersecurity audiences who simply aren't in a buying mindset, so Demand Gen should be treated as an awareness channel, not a demo-request generator.
Shopping shows a $0.784 CPC and 3.73% IVT rate, but on only 4 accounts for CPC/IVT and 2 for CPA/CVR, this row is directional at best. Shopping is more relevant to hardware, appliance, and physical security vendors than SaaS-based Cybersecurity platforms.
| Country | Avg CPC | IVT Rate |
|---|---|---|
| United States | $5.010 | 5.29% |
| United Kingdom | $3.960 | 3.33% |
| Germany | $2.770 | 8.69% |
| France | $1.650 | 5.55% |
| Australia | $3.950 | 3.50% |
| Canada | $3.870 | 3.86% |
Germany is the double-risk market in this dataset: a $2.770 CPC paired with an 8.69% IVT rate, the highest invalid traffic exposure of any country Lunio tracks for IT & Security advertisers on Google Ads. The United States combines the highest CPC, at $5.010, with a 5.29% IVT rate, so even though its IVT percentage is lower than Germany's, the absolute dollar waste per invalid click is the largest anywhere in the dataset. The UK and Australia offer the best risk-adjusted efficiency, with CPCs of $3.960 and $3.950 against IVT rates of 3.33% and 3.50%. Canada sits in the middle at $3.870 CPC and 3.86% IVT, with no significant outlier in either direction. For DACH-focused Cybersecurity campaigns specifically, this is worth cross-referencing against Lunio's ad fraud data by country, which tracks invalid traffic patterns across markets at scale.
A 4.04% IVT rate on Search sounds small until it's applied to a real media plan. Take a Cybersecurity vendor spending $50,000 a month on Google Ads, allocated roughly the way most security marketers split budget: 60% to Search, 20% to Performance Max, 10% to Display, 5% to Video, and 5% to Demand Gen. Applying Lunio's 2026 IT & Security IVT rates to each slice, Search alone loses $1,212 a month ($30,000 × 4.04%), Performance Max loses $375, Display loses $720, Video loses $157, and Demand Gen loses $73. That's $2,537 a month, or $30,444 a year, reaching no real buyer and generating no real pipeline, while still feeding Smart Bidding's learning signal. That works out to 5.07% of the entire annual budget.
For lead-gen-dependent categories like Cybersecurity, that exposure is structurally higher than transactional ecommerce: lead-gen conversion models see a 32.07% higher IVT rate than transactional models, per the Lunio 2026 Global Invalid Traffic Report, because a gated whitepaper or demo request form is far easier for a bot to fill than a checkout flow requiring payment details. This is the mechanism behind the CRM pollution problem: fake leads that consume SDR time, degrade lead scoring, and distort pipeline forecasts long before anyone realises the click was never a real prospect.
B2B SaaS advertisers, the closest available proxy category to Cybersecurity in Lunio's case study base, have already seen this play out. Canto, a B2B SaaS platform, eliminated 79.17% of its invalid traffic after deploying Lunio, saving $67,400 a month in wasted spend and generating $350,000 in new pipeline within two months, largely because Smart Bidding could finally learn from clean conversion signals instead of contaminated ones. See the Canto case study for the full breakdown.
Start your free 14-day traffic audit with Lunio →
Benchmarks tell you what the market is paying. They don't tell you what share of that spend reached a real security buyer instead of invalid traffic that bypassed Google's own filters. A $91.01 Search CPA and a 4.04% IVT rate can both be true at once, and only one of them shows up in a standard dashboard. Lunio measures the gap between the two, campaign type by campaign type, country by country, so Cybersecurity teams can defend their Google Ads numbers with evidence instead of assumptions.
Start your free 14-day traffic audit with Lunio →
Cybersecurity Search campaigns average $3.540 per click, per Lunio's 2026 IT & Security Google Ads dataset (January to 7 September 2026, 63 accounts), rising to $5.010 in the US specifically. Display, Performance Max, and Demand Gen all run far lower CPCs, between $0.038 and $0.461, but with meaningfully different conversion and invalid traffic profiles.
The closest available proxy, WordStream's Technology vertical benchmark, puts Search CTR around 2.09%, with Display CTR closer to 0.39%. A CTR that spikes well above this range on a narrow, technical keyword set is often a sign of automated or curiosity clicks inflating engagement metrics rather than genuine interest from security buyers, particularly on Display placements with heavy made-for-advertising inventory.
Every reported CPA, CVR, and CTR figure already includes whatever invalid traffic slipped past Google's native filters. On Search, that's 4.04% of clicks; on Display, it's 14.40%, per Lunio's 2026 IT & Security dataset. That contamination doesn't just waste budget directly, it also feeds Smart Bidding's learning signal, so the algorithm optimises toward some traffic patterns that were never real buyers in the first place.
In Lunio's 2026 IT & Security dataset, the US carries the highest CPC at $5.010 with a 5.29% IVT rate, while Germany carries the highest IVT rate in the group at 8.69% on a lower $2.770 CPC. The UK and France sit in between, at 3.33% and 5.55% IVT respectively, meaning the risk profile shifts meaningfully by market even within a single Cybersecurity Google Ads campaign.