What a real IT budget looks like at 25, 75 and 200 staff

The industry line is "spend 3–5% of revenue on IT". It is a fine sanity check and a poor plan. Here is how the shape of the spend actually changes.

At 25 people

You are buying reliability and avoiding surprises.

• Managed support on a flat per-user rate
• Endpoint protection, MFA, and a tested backup
• Microsoft 365 licences you actually use
• A small project budget — one meaningful improvement per quarter

At this size the biggest risk is not overspending, it is skipping the boring work because everyone is busy doing the real job.

At 75 people

You are buying structure. This is where environments drift.

• A documented asset register, because nobody knows how many laptops exist
• Firewall and network management with a real change process
• Security awareness training as an actual programme
• A vCIO rhythm: quarterly roadmap, annual budget, contract renewals tracked

This is also where a company typically discovers it has four overlapping SaaS tools doing one job.

At 200 people

You are buying governance and resilience.

• Defined recovery objectives, tested annually
• Compliance programme ownership if you're in a regulated space
• Segregation of duties for finance systems
• A named engineer or team who knows your environment
• Multi-site and remote access standardised, not improvised

At 200 people, an outage is a revenue event. Budget for the thing that prevents it rather than the thing that fixes it faster.

Three habits that matter more than the percentage

1. Separate run from change. Support and projects compete for the same hours unless you budget them separately.
2. Write down what you own. A one-page asset and contract register saves more money than any negotiation.
3. Review quarterly. An annual budget with no review is a guess you stop revisiting.

The companies with calm IT do not spend the most. They spend deliberately, on a schedule, against a written plan.