Are you spending enough on your business IT?

Most businesses know roughly what they spend on wages, rent, vehicles and insurance. IT is different. Technology costs are scattered across software subscriptions, computers, internet connections, cloud services, mobile phones, security, backupA spare copy of your data kept somewhere safe so you can recover it if something goes wrong. and support. New costs get added one at a time, which makes a simple question surprisingly hard to answer: are we spending the right amount?

This article gives you a way to answer it yourself, using published research, with sources linked so you can check them. It is not an argument for spending more. Some businesses overspend on the wrong things. It is an argument for spending deliberately instead of by accident.

The principle: run the numbers, then test the outcomes

If you take nothing else from this article, take this two-part principle:

First, measure your total annual IT spend as a percentage of turnover and compare it with the benchmark ranges below. Then test whether that spending is actually delivering reliability, security, recoverability and productivity. The number tells you whether to look closer. The outcomes tell you whether the money is doing its job.

The calculation takes five minutes:

Total annual IT spend ÷ annual turnover × 100 = your IT spend percentage

Total IT spend means everything: hardware, subscriptions, internet and phones, cloud services, support, security and backup. Most businesses undercount, because these costs hide across expense categories and credit cards.

Why both steps? Because the percentage alone cannot tell you whether you are spending well. A business can spend 5 per cent of turnover and have unreliable, insecure IT. Another can spend 2.5 per cent and run beautifully because its systems are simple, standardised and cloud-based. A 30-person accounting firm, a 30-person plumbing company and a 30-person manufacturer have similar headcounts but completely different dependence on technology.

What the research says businesses spend

A note about these benchmarks. Different research organisations define "IT spending" differently, and most large benchmark studies survey medium and large organisations rather than Australian small businesses, because that is where the data is. There is no perfect published benchmark for a 10-person Perth business. Treat the figures below as comparison points that promptThe instruction or question you give an AI tool to get the result you want. questions, not as targets.

Deloitte's 2023 Global Technology Leadership Study found average technology budgets equivalent to 5.49 per cent of revenue in 2022, up from 4.25 per cent in 2020. Source: Deloitte Insights

Avasant's Computer Economics IT Spending and Staffing Benchmarks covers more than 25 industry sectors, though participants must have at least US$50 million in revenue or an IT budget above US$1 million, so it describes businesses much larger than a typical Australian SMB. Its most transferable finding is directional: IT spending varies primarily by industry, and smaller organisations consistently spend a higher percentage of revenue than larger ones, because fixed costs are spread across fewer people. Source: Avasant

Synthesising the published studies, the indicative ranges look like this:

Industry type

Indicative IT spend (% of turnover)

Construction and trades:

around 1.5% to 3%

Manufacturing, logistics, wholesale:

around 2% to 5%

Retail:

around 2% to 4%

Professional services:

around 4% to 7%

Healthcare:

around 4% to 6%

These are indicative ranges synthesised from multiple benchmark studies, not directly published bands and not spending targets. Smaller businesses often sit toward the higher end, because a 15-person business still needs security, backup, connectivity and support spread across far fewer people than a 500-person organisation.

A second check: spend per employee. Two companies each turning over $3 million and spending $60,000 a year on IT sit at the same 2 per cent. But if one has 15 employees and the other 50, one spends $4,000 per person and the other $1,200. Those are completely different technology positions. Run both calculations.

A worked example. A trades business turning over $3 million, using an indicative range of 1.5 to 3 per cent, lands at roughly $45,000 to $90,000 in total annual IT costs. That does not mean the business should spend that amount. It means a materially different result deserves investigation. If it is spending $15,000, the useful question is not "we need to spend more". It is "are we genuinely simpler and more efficient, or are important costs, controls and replacements quietly missing?"

That question is what the rest of this article helps you answer. Here are six tests.

Test 1: Is your technology keeping people productive?

Think about what would happen if your technology stopped working tomorrow morning. Could your staff access email, answer customers, create quotes and invoices, use your accounting or job management software, retrieve customer information and take payments? For most businesses, technology is no longer an administrative tool. It is operating infrastructure.

Then ask how often staff lose productive time to technology now. Slow computers, unreliable Wi-FiThe wireless way your devices connect to the network without cables., repeated software problems and manual workarounds seem minor individually. Across a workforce, they add up.

The Australian Bureau of Statistics puts numbers on how disruptive technology failure can be. In its Characteristics of Australian Business survey, 21 per cent of Australian businesses reported experiencing a cyber security incident during 2024-25. Among businesses adversely affected, the most commonly reported impacts were lost time (36 per cent), financial losses (18 per cent), downtime of service (17 per cent) and loss of staff productivity (16 per cent). Source: ABS

Cyber incidents are only one source of disruption, but the pattern applies to all of them: technology problems cost more than the invoice required to fix them. The cost includes everyone who cannot work while the problem is resolved.

Test 2: Could your business recover?

There is a major difference between having a backup and knowing your business can recover. A proper recovery discussion answers questions like: What is being backed up, and how often? Are your cloud systems included? Has anyone actually tested a restore? How quickly could critical systems come back? Who makes decisions during a major incident?

If nobody can answer those confidently, there is a gap in the technology plan. Backup should not be viewed as a subscription. You are paying for recoverability, which means backup plus monitoring, testing, documentation and a plan for the day recovery is actually required. An untested backup is a hope, not a plan.

Test 3: Are you spending enough on security?

This is where the Australian evidence is strongest. The Australian Signals Directorate's Australian Cyber Security CentreThe Australian government body that issues cyber security advice, alerts and guidance for businesses. received more than 84,700 cybercrime reports in 2024-25, roughly one every six minutes, and notes that much cybercrime goes unreported. The average self-reported cost of cybercrime per report was around $56,600 for small businesses (up 14 per cent) and around $97,200 for medium businesses (up 55 per cent). Source: ASD Annual Cyber Threat Report 2024-25

Those figures are not the guaranteed cost of an attack. They do show that a single incident can create losses large enough to matter materially to an Australian SMB, against a security budget that is typically a few thousand dollars a year.

How much is enough? As a reference point, IANS Research and Artico Search's 2025 survey of 587 security leaders found security averaging 10.9 per cent of total IT spend. The organisations surveyed are generally much larger than a typical Australian SMB, so treat it as a comparison point rather than a rule. Source: IANS Research In practice the boundary is blurry anyway, because modern platforms and managed servicesOngoing IT support, monitoring and maintenance for a predictable monthly cost. bundle security with broader IT. The useful question is whether the necessary controls are funded, not which line they sit on.

For most SMBs the fundamentals are: multi-factor authenticationA second check on top of your password, such as a code on your phone, that stops most account break ins., managed updates and patching, email protection, endpointAny device that connects to your network, such as a laptop, phone or desktop. Each one is a possible way in for attackers. security, backup, secure account management when staff join and leave, and staff awareness. That last one matters more than most owners expect. PhishingFake emails or messages that trick you into giving up passwords or clicking dangerous links by pretending to be someone you trust. was recorded in 60 per cent of incidents reported to ASD's ACSC in 2024-25, and the top self-reported cybercrimes for business were email compromise (19 per cent of reports), business email compromiseA scam where criminals impersonate a boss or supplier by email to trick staff into paying a fake invoice or changing bank details. fraud with financial loss (15 per cent) and identity fraud (11 per cent). Yet COSBOA research surveying almost 2,100 small businesses found 45 per cent regard cyber security as a low or non-existent risk, and 61 per cent are not talking about it with staff regularly. Source: COSBOA Cyber Wardens research

Security is also becoming a customer trust issue. The Office of the Australian Information Commissioner received 1,205 data breachWhen private information is accessed, stolen or leaked without permission. notifications in 2025, the highest annual number since the Notifiable Data BreachesAn Australian scheme requiring businesses to report serious data breaches to those affected and the regulator. scheme began in 2018 and an 8 per cent increase on 2024, with the majority attributed to malicious or criminal activity. Source: OAIC Not every SMB carries the same privacy obligations, but every business that holds information about other people has a commercial reason to protect it. Technology investment protects trust, not just systems.

Test 4: Are you replacing technology before it becomes a problem?

Many businesses do not have a hardware budget. They have a hardware emergency fund. Computers are replaced when they fail, and network equipment stays in place until someone discovers it is no longer supported. That makes IT spending unpredictable and concentrates it at the worst possible moments.

A better approach is an inventory of important equipment (computers, servers, networking, Wi-Fi, firewalls, mobile devices, battery backup) with a view on age, support status and expected replacement. ASD specifically identifies replacing legacy technology as a priority action for organisations, because unsupported and ageing systems introduce security risk. Source: ASD business fact sheet Planned replacement does not mean replacing everything often. It means knowing what you have and when it will need to go.

Test 5: Are you paying for technology you no longer need?

Spending too little is not the only failure mode. Software subscriptions are easy to accumulate because many are individually cheap. Over time, businesses end up paying for former employees' licences, duplicate applications, overlapping security products, unused cloud storage and tools bought for abandoned projects.

This is why a technology budget should not simply grow every year. At least annually, somebody should be able to explain what each major technology cost does, who uses it and why the business still needs it. Removing unnecessary technology can be as valuable as adding something new. If you run the percentage calculation each year and it is rising faster than the business, this is the first place to look.

Test 6: Are you investing in improvement, or only maintenance?

Good IT should not merely prevent problems. It should help people work better. The Australian Government's guidance on developing a digital strategy encourages businesses to set digital goals, budget for software, hardware, subscriptions, training and outsourced services, and review regularly whether technology still supports the objectives of the business, rather than treating technology as a collection of unrelated purchases. Source: business.gov.au, Develop your digital strategy

So ask: how much of your IT budget keeps yesterday's systems running, and how much improves how the business operates tomorrow? Sometimes the biggest opportunity is not a new serverA powerful computer that stores files or runs software for everyone in the business to share. or security product. It is automating a repetitive process, eliminating double entry between systems, giving field staff better access to information, or improving reporting.

Increasingly, it also means AISoftware that performs tasks normally needing human thinking, such as answering questions or spotting patterns.. Staff are already using AI tools for everyday work, sometimes through personal or unmanaged accounts. Businesses need to decide which tools are approved, what information may be entered into them, how accounts are managed and where AI genuinely improves productivity. Business-grade AI platforms, and the policies around them, are becoming a legitimate part of the technology budget.

The practical test

Pull it together. Instead of asking only "how much do we spend on IT?", work through these:

1. Calculate your IT spend as a percentage of turnover, and per employee, and compare against the indicative ranges above.
2. Can our people work reliably, without regular lost time to technology?
3. Are our critical systems properly protected, with the security fundamentals funded?
4. Could we recover if those systems disappeared tomorrow, and have we tested it?
5. Are our computers, network and software still supported and fit for purpose?
6. Are we paying for technology we no longer need?
7. Are we using technology to improve productivity, or only maintaining what exists?
8. Do we know what will need replacing or improving over the next 12 to 36 months, and can somebody explain why every major technology cost exists?

If the answers are yes, the exact percentage of turnover matters much less. If several answers are no, spending less than the benchmark is not a saving. It is a cost that has been deferred, and deferred technology costs have a habit of arriving all at once.

So, are you spending enough?

Perhaps. You may also be spending too much. The number by itself cannot tell you, which is why this article gave you both the number and the tests.

The objective is not to maximise the IT budget or minimise it. It is to make sure the business is spending enough to achieve four things: keep people productive, keep systems secure, make the business recoverable, and use technology to make the business better. If your technology investment consistently achieves those outcomes at a sensible cost, your IT budget is doing its job. If it does not, the question is no longer whether IT is expensive. It is what the current approach is already costing the business.

Sources: Australian Bureau of Statistics, Characteristics of Australian Business 2024-25; Australian Signals Directorate, Annual Cyber Threat Report 2024-25 and business fact sheet; Office of the Australian Information Commissioner, data breach notification statistics 2025; Australian Government business.gov.au, Develop your digital strategy; COSBOA Cyber Wardens research; Deloitte 2023 Global Technology Leadership Study; Avasant Computer Economics IT Spending and Staffing Benchmarks; IANS Research and Artico Search 2025 Security Budget Benchmark Report. Benchmark figures reflect differing definitions of IT spending across studies and are provided as comparison points only.

Sources: Australian Bureau of Statistics, Characteristics of Australian Business 2024-25; Australian Signals Directorate, Annual Cyber Threat Report 2024-25 and business fact sheet; Office of the Australian Information Commissioner, data breach notification statistics 2025; Australian Government business.gov.au, Develop your digital strategy; COSBOA Cyber Wardens research; Deloitte 2023 Global Technology Leadership Study; Avasant Computer Economics IT Spending and Staffing Benchmarks; IANS Research and Artico Search 2025 Security Budget Benchmark Report. Benchmark figures reflect differing definitions of IT spending across studies and are provided as comparison points only.