Ask most business owners what keeps them up at night and you’ll hear the same answers: cash flow, sales pipeline, staffing. Rarely IT.
Which is understandable. When IT is working, it’s invisible. Nobody sends a thank-you email because they opened Outlook without issue this morning. Nobody notices that the backup ran cleanly at 2am, or that a suspicious login attempt was blocked before it became a breach. It just works, and because it just works, it gets forgotten about.
Until it doesn’t.
The closest parallel is cash flow
Cash flow is brutal in its clarity. The money is either there or it isn’t. If it isn’t, the business stops. It doesn’t matter how good your product is, how loyal your customers are, or how hard your team works. Without cash, the engine cuts out.
IT failure works the same way, and yet it rarely gets treated with the same urgency.
When your systems go down, people can’t work. Not slowed down, stopped. Your sales team can’t access CRM. Finance can’t process invoices. Staff are sitting on their hands while the clock runs. Depending on the size of your business and how long the outage lasts, you’re looking at hundreds or thousands of pounds in lost productivity per hour, before you’ve even factored in recovery costs, reputational damage, or the very real possibility that your data is gone.
A ransomware attack on an unprepared business doesn’t just cause a bad week. It can end the business entirely. Around 60% of small businesses that suffer a significant cyber incident close within six months. That’s not a scare statistic. It’s the reality of what happens when there’s no plan, no backup, and no security posture worth the name.
Where IT investment actually goes and why it’s hard to see
Part of the problem is that good IT spend is almost entirely defensive. You’re paying to prevent things that haven’t happened yet, and when those things don’t happen, it looks like nothing happened at all.
Break it down and the spend sits across a few key areas.
Infrastructure and reliability. The hardware, software licences, cloud services, and monitoring that keep everything running. This isn’t glamorous, but it’s the foundation. Underinvest here and you’re running on borrowed time.
Security. This one has become non-negotiable. Cyber attacks aren’t something that only happens to big corporations. SMEs are targeted precisely because they’re assumed to have weaker defences. MFA, endpoint protection, email filtering, patch management, access controls. Each one is a layer. Remove layers to save money and you’re opening doors you don’t know are open.
Training. Consistently the most underfunded piece. Your technical controls are only as good as the people using them. The majority of breaches involve human error. A staff member clicking a convincing phishing email at 9am on a Monday can undo every technical safeguard you have. Regular, practical training isn’t a nice-to-have. It’s part of the security stack.
Disaster recovery and business continuity. Knowing what happens if the worst occurs. Not just having a backup, but knowing it works, knowing how long recovery takes, and having a plan everyone understands.
The squeeze cycle and who ends up carrying the blame
Here’s where it gets uncomfortable.
When budgets tighten, IT is often one of the first places businesses look to cut. Headcount is harder to reduce. Marketing cuts hurt visibility. But IT? The servers are still on. The emails are still going. Surely we can defer that upgrade, reduce the support contract, hold off on the training budget.
Then something goes wrong.
A breach. An outage. A system failure that costs real time and real money. And suddenly the IT team, who have spent months flagging the risks of doing exactly this, who’ve been asked to do more with less, who’ve watched the decisions being made above them, are the ones in the frame.
It’s one of the most demoralising dynamics in business. An underfunded, under-resourced IT function is set up to fail, and then held responsible for failing.
If your IT team has been raising concerns that haven’t been acted on, the problem probably isn’t your IT team.
Rethinking what IT actually costs you
The question businesses usually ask is: what is IT costing us?
The better question is: what would it cost us if IT failed?
Add up the hours of lost productivity across your team. Factor in the potential regulatory fines if personal data is compromised. Under GDPR, a breach can carry significant penalties. Consider the cost of emergency recovery versus planned maintenance. Think about what a week offline would do to your client relationships.
When you run those numbers, the monthly IT budget looks different.
The floor, not the ceiling
IT isn’t about growth, and that’s why it gets deprioritised. It doesn’t generate a lead or close a deal. It doesn’t show up on a P&L in a way that feels tangible.
But it is the floor that everything else stands on. Sales can only happen because people can access the systems they need. Finance can only function because the data is there and accurate. Operations can only run because the tools work.
Get the floor wrong and nothing built on top of it is safe, no matter how good everything else looks.
It’s worth treating it that way.