"How much should we spend on IT?" is one of the most common questions owners ask, and the honest answer, "it depends," is deeply unsatisfying. But you can get to a sensible number without guessing, by thinking about it as a percentage of revenue, spending in the right order, and refusing to buy protection you do not need. The goal is not to spend the most; it is to spend enough, on the right things, and not a dollar on fear.
A rough benchmark, not a rule
As a starting point, many small businesses land somewhere around 3 to 6 percent of revenue on IT overall, with a slice of that going to security, though it varies widely by industry and how much you depend on technology. A law firm or an online retailer will and should spend more than a landscaper. Use the benchmark to sanity-check yourself, not as a target: if you are spending almost nothing, that is a flag; if you are spending a fortune with no plan, that is a different flag.
Spend in the right order
Where the money goes matters far more than the total. The highest-return spending is usually the least glamorous:
- The basics first: MFA, managed email and devices, patching, and tested backups. These prevent the incidents that actually happen and cost a small business the most.
- Then resilience: reliable backup and recovery, and the ability to keep working when something breaks.
- Then the fancy stuff: advanced monitoring and tooling, once the fundamentals are solid. Buying a shiny security product while your team has no MFA is spending back to front.
Avoid the two expensive mistakes
Owners tend to err in one of two directions. Some underspend to nothing and gamble that they are too small to be targeted, which the economics of modern attacks no longer support. Others overspend on tools sold with fear, stacking products that overlap and go unused. The cure for both is a plan: know what you are protecting and in what order, so every dollar has a job. That is also the heart of optimising IT cost without cutting capability.
Predictable beats cheap
Finally, favour predictable operating cost over surprise capital hits. A steady monthly spend on the right managed services is easier to budget, and usually cheaper over time, than lurching from crisis to crisis and paying emergency rates when something fails. Smooth and sufficient beats cheap and fragile.