What Every CEO, CFO, and CIO Should Be Funding Before They Fund the Next Big Thing
By: Marc Schwartz, President of Ozone IT Services
Every year, companies build an IT budget the same way they build most budgets: look at what they spent last year, add the new things leadership wants, negotiate the number down, and call it a plan.
That approach worked reasonably well when IT was mostly about keeping computers running. It doesn’t work anymore.
Today, your IT environment is your business. It runs production, stores financial information, connects/manages/pays employees, manages customer relationships, integrates orders/billing/shipments, controls access to intellectual property, supports supply chains, and increasingly interacts with AI systems that can make decisions or take actions on your company’s behalf.
Your IT budget is not simply a technology budget. It is a risk budget.
The question every CEO, CFO, and CIO should be asking before approving next year’s spend is simple: If something goes seriously wrong, have we funded our ability to prevent it, contain it, and recover from it? Because buying another piece of software, hardware, or AI tool doesn’t answer that question.
Start with the Business, Not the Technology
One of the biggest mistakes I see in IT budgeting is starting with the technology wish list: new ERP, new laptops, AI licenses, cloud migration, security platforms, network refresh, etc.
While these are all legitimate investments, the first conversation should be about the business.
- What systems absolutely have to work for the company to operate?
- What data can never be lost?
- How long can production be down before the financial impact becomes unacceptable?
- Which systems are connected to the internet?
- Which employees have privileged access?
- What happens if your primary cloud provider is unavailable?
- What happens if ransomware encrypts your production environment?
- What happens if the person who knows how everything works leaves the company?
- And increasingly: What happens when an employee connects an AI tool to company data without understanding where that data goes?
Those answers should determine the budget, not the other way around.
Build the Budget Around Five Risk Areas
I recommend that executives examine and determine their IT budget across five categories:
- Infrastructure
- Security
- Recovery
- People and expertise
- Innovation and AI
The order matters. You cannot responsibly accelerate innovation if the foundation underneath it is unstable.
1. Infrastructure: Fund the Foundation
Hardware isn’t exciting. Neither is replacing an aging server, upgrading a firewall, refreshing network equipment, or fixing storage capacity. Until one fails. Then everyone suddenly discovers that the infrastructure budget was actually a business continuity budget. Your annual plan should account for the lifecycle of:
- Servers and storage
- Network switches and routers
- Firewalls and VPN infrastructure
- Wireless infrastructure
- Employee computers and mobile devices
- Printers and connected peripherals
- Industrial and operational technology
- Cloud infrastructure
- Internet connectivity and redundancy
- UPS and power protection
- Physical security systems
- Backup infrastructure
Don’t budget only for replacement when something breaks. Build a predictable lifecycle so you’re not making six-figure decisions during an outage. And don’t overlook infrastructure created by new technology.
AI workloads can drive additional requirements for compute, storage, networking, data management, cloud capacity, and security. Gartner’s 2026 forecasts show how dramatically AI and data-center infrastructure are influencing overall technology spending.
The point isn’t to buy more infrastructure. It’s to make sure the infrastructure you already depend on—and the infrastructure you’re about to introduce—can support the business.
2. Security: Budget for Every Door into the Company
The days when cybersecurity meant buying antivirus software and putting a firewall at the edge of the network are long gone. Your attack surface now includes:
- Employees and contractors
- Laptops and mobile devices
- Servers
- Cloud applications
- SaaS platforms
- VPNs
- Remote access
- Identity and privileged accounts
- Internet-facing devices
- Third-party vendors
- Connected equipment
- Operational technology
- APIs
- AI applications and agents
- Data repositories
- Legacy systems nobody wants to touch
Every one of those is a potential entry point. Attackers don’t care whether the vulnerability came from a sophisticated zero-day or an employee clicking the wrong link.
Verizon’s 2025 Data Breach Investigations Report (DBIR) found that human involvement remained a significant factor in breaches, while vulnerability exploitation has become the leading initial access vector.
IBM’s 2025 X-Force research also found an 84% increase in emails delivering infostealers in 2024, underscoring how aggressively attackers are targeting identities and credentials.
Your security budget should therefore cover more than security software. It should include:
- Identity and access management
- Multifactor authentication
- Endpoint protection
- Email security
- Vulnerability management
- Patch management
- Network security
- Cloud security
- Security monitoring
- Employee security awareness
- Privileged access controls
- Third-party risk
- Penetration testing
- Incident response
- Security assessments
And don’t forget the human risk. Most employees aren’t trying to create a security problem. They’re trying to get their jobs done.
Some will click something they shouldn’t. Some will reuse a password. Some will upload company information to an AI tool because it makes their job easier and more efficient. Occasionally, someone will leave the company angry. Your security program has to account for all of them.
3. Recovery: Assume Something Will Eventually Go Wrong
One of the most complicated sentences in IT is: “We have backups.”
The next question is: “Have you successfully restored from them and how frequently do you determine if your backups are still a match for the scaling business?”
A backup that has never been tested or is assumed to adequately cover a business is a theory. Every IT budget should include money for recovery, not just backup storage. That means funding:
- Immutable or otherwise protected backups
- Offsite recovery
- Backup monitoring
- Restore testing
- Disaster recovery planning
- Recovery Time Objective (RTO) testing
- Recovery Point Objective (RPO) testing
- System recovery sequencing
- Disaster recovery exercises
- Documentation
- Incident response planning
- Recovery personnel and expertise
CISA specifically recommends maintaining offline, encrypted backups and regularly testing their availability and integrity as part of ransomware preparedness.
The CFO should know what an hour of downtime costs.
The CEO should know which systems have to come back first.
The CIO should know whether the technology can actually meet those expectations.
If those three answers don’t line up, you don’t have a recovery strategy. You have a hope strategy.
4. People: Don't Try to Hire Every Skill You Need
This is where companies can get smarter about IT budgets. You don’t necessarily need a larger IT department. You need the right combination of internal ownership and external expertise.
There are capabilities that should absolutely live inside the company. Your internal team understands the business, its people, its priorities, and its operating environment better than anyone. It’s imperative that you keep that institutional knowledge.
However, there are also areas where maintaining full-time expertise can be expensive, difficult, or unnecessary.
- Cybersecurity
- Penetration testing
- Disaster recovery engineering
- Advanced cloud architecture
- Patch management
- Backup engineering
- Incident response
- Specialized infrastructure
- AI governance, processes, and training
An external specialist in these areas can provide depth without adding another full-time salary, benefits package, training burden, and recruiting problem to the budget. The talent market makes this increasingly relevant. CIO’s 2026 State of the CIO research identifies cybersecurity and AI/ML as tied for the hardest IT skills to hire.
The smartest model isn’t internal versus external. It’s internal plus external.
Your employees own the business. Specialists extend their capabilities.
That’s often a better financial model and a better security model than expecting a small internal team to be experts at everything.
5. AI: Budget for the Technology, Training, AND the Risk
AI deserves its own line in the budget because its risk profile is different. AI introduces new considerations around:
- Data privacy
- Access permissions
- Intellectual property
- Vendor security
- Shadow AI
- API access
- AI agents
- Model governance
- Cloud consumption
- Usage-based pricing
- Security monitoring
- Operations rollout planning
- Operations and technology integration
- Employee job training for security and role integration
- Ongoing monitoring and reporting
The AI budget shouldn’t simply say, “We have $100,000 for AI.” It should answer:
- What business problem are we solving?
- What data will the system access?
- Who can use it?
- What can it do?
- What happens if it makes a mistake?
- What does it cost at scale?
- How do we shut it down?
Current CIO research shows organizations are increasing investment in AI while simultaneously facing pressure to demonstrate measurable ROI. It also highlights the need for flexible architecture as organizations scale AI initiatives.
Don’t fund AI because everyone else is using AI and you’re afraid of missing out. Fund the business outcome. Fund the security and infrastructure required to use it effectively and responsibly.
The Annual IT Budget Checklist
Before signing off on next year’s IT budget, leadership should answer these questions:
Infrastructure
- What hardware reaches end-of-life next year?
- What systems are single points of failure?
- Can our network and cloud infrastructure support planned growth?
- Are legacy systems creating security or recovery risks?
Security
- Do we know every major entry point into the business?
- Are all critical systems patched?
- Is MFA protecting every appropriate account?
- Are privileged accounts controlled and monitored?
- Are employees trained to recognize modern social engineering?
- What happens when an employee leaves unexpectedly?
Recovery
- What systems must be restored first?
- What is our actual RTO?
- What is our actual RPO?
- Have we tested both?
- Are backups protected from ransomware?
- Can we operate if our primary location or cloud environment is unavailable?
- How frequently do we backup?
- How frequently do we test successful restores from backups?
People
- What capabilities should remain internal?
- Where are we relying on one employee’s knowledge?
- Which specialized skills would be more cost-effective to access externally?
- Who provides emergency expertise if our internal team is overwhelmed?
AI
- What AI applications are employees already using?
- What company data is being exposed to them?
- Which AI projects have measurable ROI?
- Who owns AI governance?
- Have security and infrastructure requirements been included in the business case?
- Have we trained our employees on how to use AI effectively in their roles?
- Are any tools now obsolete as a result of AI integration?
The Best IT Budget Is the One That Prevents the Emergency Budget
There will always be pressure to cut IT spending. That’s normal. The mistake is cutting the spending that prevents much larger spending later.
- A deferred firewall replacement becomes an emergency purchase.
- A skipped patch becomes an incident.
- An untested backup becomes a recovery crisis.
- An understaffed IT team becomes a dependency on one person.
- An unmanaged AI application becomes a data governance problem.
- And a cybersecurity gap becomes everyone’s problem.
The goal isn’t to build the biggest IT budget. It’s to build the smartest one.
That means spending where the business is most exposed, maintaining the infrastructure that keeps it running, protecting every meaningful entry point, preparing for recovery before disaster strikes, and using internal and external resources strategically.
Year over year, the technology, platforms, threats, and AI models will change. The fundamentals won’t.
Know what matters most to the business. Know where you’re exposed. Know how you’ll recover. Make sure the people responsible for protecting the company have the resources and expertise to do it.
That is what a secure IT budget looks like.
If you’re building next year’s IT program budget and want a second set of eyes on where the risks—and the unnecessary costs—are hiding, that’s a conversation my team and I are always willing to have.
At Ozone IT Services, we work alongside internal teams as an outsourced IT support resource and embedded extension of the employees already responsible for keeping the business running. The goal isn’t to replace your team. It’s to give them the specialized expertise and additional capacity they need to protect the business without building an unnecessarily expensive IT organization.
Planning for Next Year?
Ensure you’re prioritizing spend on what makes cents/sense for both your business and security.
Ozone IT Services partners with manufacturing and mid-size organizations across the U.S. to build the secure, well-supported IT foundation company needs while acting as an integrated extension of internal IT teams.
