Every few months, someone asks me some version of this question.
Sometimes it comes from a business owner who just got hit with an unexpected bill — a server failure, a ransomware attack, an emergency repair that cost three times what a monthly IT plan would have. Sometimes it comes from someone who’s been quoted a managed IT proposal and wants to know if the number is reasonable.
It’s a good question, and the honest answer is: it depends. But not in a wishy-washy way. There are some real benchmarks, and they’re more useful than most people realize.
What the numbers actually say
Industry research consistently puts small business IT spending between 6% and 7% of annual revenue — higher than enterprises, which average around 4%, because fixed IT costs don’t scale down proportionally. For businesses in regulated industries — financial services, healthcare, legal — that number runs higher still, often 8% to 10%, because the compliance and security requirements are steeper.
In Canadian dollars, for a small business bringing in $500,000 a year, that’s roughly $20,000 to $30,000 annually — or about $1,700 to $2,500 per month.
Does every small business hit that? No. Should every small business hit that? Also no. The right number depends on how much your team depends on technology, how sensitive your data is, and how much a day of downtime would actually cost you.
But here’s the thing that trips people up: most small businesses dramatically underestimate that last part.
The real cost of cheap IT
A plumber can work with hand tools if the power goes out. Most office-based businesses can’t do much of anything when the network is down, email isn’t working, or key software is inaccessible.
If you have a ten-person office and each person earns $25 an hour, a full-day outage costs you $2,000 in lost productivity — before you count client impact, missed deadlines, or the emergency repair bill itself. Two days of downtime a year wipes out most of the savings from avoiding a proper IT budget.
That math shifts the conversation. It’s not “how little can I spend on IT?” It’s “what’s the minimum I need to spend to avoid problems that cost more than the prevention?”
What your IT budget should actually cover
However you arrive at your number, here’s what it needs to include:
Hardware lifecycle. Computers don’t last forever. A realistic budget assumes you’ll replace workstations every 4–5 years. Intel’s research shows the cost-of-ownership curve rises sharply after year three — older machines generate twice the downtime and three times the security incidents of newer ones. If your team is running 7-year-old machines held together with hope, that’s a financial liability disguised as cost savings.
Software and licensing. Microsoft 365, your line-of-business software, security tools — these are ongoing costs, not one-time purchases. Make sure they’re in your budget and not just popping up as surprise renewals.
Security. Endpoint protection, email filtering, and regular patching aren’t optional extras anymore. A single successful ransomware attack costs Canadian small businesses an average of $120,000 to $180,000 when you count downtime, recovery, and remediation. That number is from the Canadian Centre for Cyber Security’s 2025 threat report — and it’s probably conservative.
Backup. Proper, tested, off-site backup. Not just a drive sitting next to the computer it’s supposed to protect.
Support. Someone to call when things go wrong. Whether that’s a managed IT provider or a per-incident arrangement, factor in realistic support costs rather than assuming you’ll wing it.
The break-fix trap
A lot of small businesses operate on what the industry calls “break-fix” IT: call someone when something breaks, pay the bill, move on. No plan, no monitoring, no prevention.
The appeal is obvious — you only pay when you need it. The problem is that you’re optimizing for the wrong thing. Break-fix IT keeps you reactive. By the time something breaks badly enough to call for help, you’ve already absorbed the impact.
The businesses I see struggle most with IT costs aren’t the ones who invest consistently. They’re the ones who avoid spending until they can’t avoid it anymore — and then spend a lot all at once, under pressure, with fewer options.
A practical starting point
If you’re not sure where to start, here’s a simple exercise:
- List every piece of technology your team depends on to do their jobs.
- For each item, ask: how old is it, when does it need replacing, and what happens if it fails?
- Add up the recurring costs (software, licences, existing support) you’re already paying.
- Compare that to a realistic estimate of what a full day of downtime would cost you.
That four-step picture will tell you more than any benchmark percentage.
If you’d like a second set of eyes on your IT costs — or you want to know if what you’re currently spending is actually protecting you — book a call with us. We’ll give you a straight answer.
