Building the 2027 IT budget: what to fund first when everything looks urgent

Sometime this month, a spreadsheet opens. Next year’s budget wants numbers by department, and the IT line is staring back at whoever owns it: last year’s figure, plus or minus whatever the year’s pain suggested. The temptation runs in 2 directions. Companies that had a quiet year trim the line, because nothing happened, so apparently nothing was needed. Companies that had a bad year gold-plate it, funding 3 tools for the wound that is freshest. Both are budgeting by anecdote.

There is a better order of operations, and it does not start with products. It starts with the obligations the business already has and works outward from there.

First dollar: what you are contractually and insurably required to do

Before anything discretionary, fund the floor the outside world has already set:

• Cyber insurance requirements. Your carrier’s application was a list of controls you attested to, MFA, EDR, backups, and next year’s renewal will test them again, usually harder. Budget the gap between what you attested and what is actually true, because that gap is the difference between a paid claim and a dispute. The renewal arc is in the cyber insurance renewal walkthrough
• Customer commitments. Security questionnaires you have answered, supplier mandates you have signed and any flow-down requirements attached to contracts. Promises already made are not optional line items
• Lifecycle debts with dates. Operating systems and hardware leaving support next year, certificates and renewals with known expiries, the server that is 7 years old. These costs do not negotiate. The laptop and hardware lifecycle math belongs here, boring and non-deferrable

This first tranche is usually not the expensive part. It is the part where underfunding converts directly into denied claims, failed audits and emergency purchases at the worst prices.

Second dollar: the controls with the best return per dollar

If the floor is funded, the next money goes to whatever most reduces the odds of the expensive bad day. For most 20-to-200-person companies the ranked list is stable year to year:

1. Identity. MFA everywhere it is missing, phishing-resistant methods for admins and executives, offboarding that actually runs. Credential attacks remain the front door, and identity money buys more risk reduction per dollar than anything else on the sheet
2. Detection someone watches. EDR with a human (yours or a managed detection service) behind the alerts. An unwatched console is a receipt, not a control
3. Recovery you have proven. Immutable backups and the restore tests that make them real. If the budget funds tests nobody runs, cut the tests and admit it, or run them. The standard is tested restores
4. The human layer. Awareness training and the payment-verification habits that blunt the frauds no tool catches

Notice what is absent: nothing exotic. The mid-market breaches that matter keep starting in the same 4 places, so the money keeps belonging in the same 4 places until they are genuinely solved.

Third dollar: the projects that change the slope

Only after the floor and the fundamentals does project money make sense, and the right projects are the ones that make every later year cheaper: the network segmentation that has been deferred twice, the server-to-cloud migration that ends a hardware cycle, consolidating the 3 overlapping tools bought during 3 different emergencies. One well-chosen project a year, finished, beats 3 started. If AI figures in next year’s plans, budget the governance alongside the licenses, the acceptable-use groundwork costs little and prevents the expensive version of the lesson.

The two numbers that make the conversation go well

Benchmark percentages (“spend N% of revenue on IT”) mostly generate arguments. Two different numbers move the room:

• The cost of a bad day. One day of downtime, estimated honestly, revenue, payroll, recovery, customer penalties where they apply. Every security line in the budget is priced against that figure, and the figure is usually a multiple of the whole IT budget. The arithmetic is the one from the true cost of ransomware
• The cost of the status quo. What the current environment spends on firefighting, ad hoc fixes and renewal surprises. Proposals that replace chaotic spend with planned spend are the easiest yes in the meeting

Presenting it this way also changes who owns the decision. The budget stops being “IT wants money” and becomes “here is the risk the business is choosing to carry at each funding level.” Leadership can mark the line wherever they judge right, but they mark it knowingly, which is the actual job of a budget.

If the numbers will not stretch

Smaller budgets prioritize harder, they do not skip stages. The floor gets funded first even if the project column reads zero, identity beats new tools, and the fractional leadership model, a vCIO at the hours you need, beats a headcount the budget cannot carry. A deliberately sequenced modest budget outperforms a generous one spent on anecdotes.

Atticus Rowan builds these budgets with clients every fall, with the quarterly review cadence that keeps January’s plan honest in August. If your spreadsheet is open and the IT line is still last year plus a guess, start a conversation while there is still time to plan rather than react.