Home › Blog › Why cutting IT costs more
For owners · 23 September 2026 · 10 min read
When cash is tight, IT is the line owners reach for first: it is large, it is technical, and nothing visibly breaks the month after it is cut. This is what actually gets cut — the company’s value at sale, its insurability, and the one thing that stands between a phishing email and the bank account — with four cases of what the saving looked like a year later.
The argument, in one table
| What the owner sees | What it actually is |
|---|---|
| A monthly licence bill | The mail, files, identities and devices of every employee, and the controls that keep them from walking out of the door |
| An IT person who is never busy | The backups that have never been needed, the patches nobody noticed, the sign-in policy that turned a stolen password into nothing |
| A cost to trim before the year-end | The first thing a buyer’s due-diligence team, an insurer’s underwriter and a regulator’s auditor look at |
| Overhead | An asset that changes the multiple the company sells for |
Every year we watch the same conversation happen in a few of the companies we look after. Revenue softens, the owner asks every department for ten percent, and IT’s ten percent is the easiest to find: downgrade the licences, skip the hardware refresh, let the security add-ons lapse, stretch the one IT person across two jobs. Nothing breaks in October. Nothing breaks in November. The saving is real and it is on the management accounts.
What was actually cut does not appear on the management accounts, because it was never a cost. It was three things: the value of the company when it is sold, the company’s ability to be insured and to pass an audit, and the controls that decide whether a bad email is an anecdote or a crisis. This article is about those three, and then about four companies where the saving came due.
Ask anyone who has sold a company what the buyer’s advisers asked for. After the accounts comes the technology questionnaire: where the data lives, who has admin rights, whether multi-factor authentication is enforced, when the last restore test was, which systems are out of support, whether the licences match the users. A clean answer takes an afternoon and adds nothing to the price. A messy one does one of three things: it delays completion while it is fixed, it becomes a price chip, or it becomes an indemnity the seller carries for years.
The same questionnaire arrives from the cyber-insurer every renewal, and the premium and the excess move with the answers. It arrives, in a different form, from every corporate customer’s procurement team, and from the auditor under ISO 27001 or NIS2. An organisation with its identities managed, its devices encrypted, its data backed up and its old systems retired is cheaper to insure, easier to sell to and quicker to sell. That is what the licence bill buys. It is not overhead; it is the maintenance of an asset that other people price.
Twenty years ago a company’s value was in a building, a customer book in a filing cabinet and the people who knew where things were. Today the customer book is a CRM, the contracts are in SharePoint, the drawings are in OneDrive, the money moves on the strength of emails, and the people who know where things are can be reached only through Teams. The document, the personal data, the payment instruction and the audit trail are the same thing: a record in a Microsoft 365 tenant, protected by whatever the company chose to pay for.
That is why the security add-ons are not optional extras. Conditional Access decides whether a stolen password works. Intune decides whether a lost laptop is an incident or a Tuesday. Defender decides whether the invoice from the “supplier” with new bank details reaches the finance inbox. Backup decides whether ransomware is a weekend or a wind-down. Each is a few euros per person a month. Each is the first thing an owner cuts, because none of them has ever visibly done anything — which is precisely what they are for.
A trading company of forty people moved from Business Premium to Business Standard to save what was, on our list, €6.93 per user a month — about €3,300 a year. With Premium went Conditional Access and Defender for Office 365. Eight months later a bookkeeper’s password, reused from a breached website, let someone into her mailbox; there was no policy to challenge the sign-in from a new country. The attacker read three months of mail, learned which supplier was owed €48,000, and sent the “updated bank details” from her own account. The payment went out on a Friday. The bank recovered nothing. The saving was €3,300.
A manufacturer of a hundred and twenty people let a third-party Microsoft 365 backup lapse at renewal: “Microsoft keeps our data anyway.” Microsoft keeps deleted items for a while and does not promise a point-in-time restore. Ransomware arrived through a contractor’s laptop, encrypted the file server and, through synchronised OneDrive folders, a large part of SharePoint. Retention got some of it back; a week of manual reconstruction from email attachments got some more; the production schedules for the quarter were rebuilt from printouts. Eleven days of disrupted production, and an insurer that pointed to the questionnaire answer about backups before paying a reduced claim. The renewal that lapsed was under €4,000.
A logistics group kept its dispatch application on Windows Server 2012 R2 and SQL Server 2014 past their end of support because “it works and nobody touches it”. Nobody did, including the patches, because there were none. The vulnerability that got in was two years old and had a public exploit. The application was down for four days while the hosts were rebuilt on Windows Server 2025 — the same migration that had been quoted, and declined, twice. Then came the audit finding, and the insurer’s letter asking why the renewal questionnaire had said no systems were out of support. The migration cost the same as it had the first time it was quoted, plus four days of trucks not moving.
A software services company of sixty people went to market. The buyer’s technical due diligence found shared administrator accounts, multi-factor authentication switched off for “convenience”, twenty-two more Office users than licences, and a customer database on a developer’s laptop. None of it had ever caused an incident. All of it went into the report, and the report went into the price: a reduction the seller’s advisers put at roughly a tenth of the headline, plus an indemnity for licence compliance. The tidy-up was a six-week project the company had postponed for three years because it was not urgent. On the day it became urgent, it cost more than every year of the IT budget the owner had trimmed.
Cutting is sometimes necessary. The point is to cut the right things. If the budget has to shrink, this is the order we would defend, priced from our September list for Europe:
The floor, per person, at Microsoft list price
| Keep | List price | What it prevents |
|---|---|---|
| Business Premium instead of Standardunder three hundred seats | +€6.93per user a month | The stolen password that works, the lost laptop that leaks, the phishing link that lands |
| Entra ID P1 with Conditional Accessfor users on any other plan | €6.10per user a month | Sign-ins from anywhere with anything |
| Defender for Businessfor users on Basic or Standard | €2.60per user a month | Ransomware spreading from one PC to all of them |
| A backup with a tested restoreMicrosoft 365 and any server | low single eurosper user a month, by product | The eleven-day week |
| Nothing out of supportor ESU with an end date | €65 to €261per Windows 10 device a year | The two-year-old exploit, the audit finding, the insurer’s letter |
Above that floor there is a real conversation about what to trim: unused licences, duplicated tools, hardware refreshed early, projects with no owner. That conversation starts with a licensing review, which we do for nothing.
What should be cut, in almost every company we review: the licences assigned to people who left, the two products doing one job, the premium tier nobody uses, the server that exists because nobody switched it off. That is typically a tenth to a fifth of the bill, found in an afternoon, with no risk attached. An owner who wants to save on IT should save there, and spend some of it on the floor above.
Not “find ten percent” but three questions. What happens to the company if we lose access to everything for a week? Which controls stand between a bad email and our money, and are they on for everyone? What would a buyer’s due-diligence team find tomorrow? An IT lead who can answer all three in writing is running an asset. One who cannot is running a cost centre, and the fix for that is not a smaller budget.
More, not less: a small company has no security team to notice, and the same Business Premium controls cost the same per person. The four cases above range from forty to a hundred and twenty people.
For most organisations under three hundred seats it is the floor: Conditional Access, Intune, Defender for Business and Defender for Office 365 in one licence. What matters is that the controls are switched on, which is configuration, not licensing.
A licensing review: licences against users, products against jobs, servers against purpose. We run it for nothing and put the findings in writing; the average estate has a tenth to a fifth of its bill to give back.
In the technical due diligence report and, through it, in the price, the warranties and the indemnities. A clean tenant is not a premium; a messy one is a discount.