Budgeting for managed IT services at a manufacturer usually starts from the wrong number. The sector benchmark, 2 to 5 percent of revenue, is the lowest of any major industry and gets quoted as though it were a target rather than a description of what manufacturers have historically underspent. Set against an average unplanned downtime cost near 50,000 dollars per hour, a plant budgeting to the benchmark is sizing its IT spend against sales while its actual exposure scales with hours of production at risk. Those are different quantities, and only one of them appears in the budget.
The 5 Points That Shape a Plant IT Budget
Five points decide whether a manufacturing IT budget holds up. Each is expanded below.
- Revenue share is the wrong denominator. Exposure tracks production hours at risk, not sales.
- Security should hold 15 to 20 percent of IT spend. OT convergence raised the requirement faster than budgets moved.
- Plant network gear is a capital line nobody funds. Switches and access points age out on a schedule, like everything else.
- ERP is a production dependency. Its support, licensing, and recovery belong in the operations conversation.
- Legacy machines need compensating controls, not patches. That work is labor, and labor is a budget line.
Why the Revenue Benchmark Understates the Requirement
The 2 to 5 percent of revenue figure describes what manufacturers spend rather than what production risk warrants, and treating it as a ceiling produces the exact underinvestment the number was measuring. Manufacturing sits at 2.1 to 3.8 percent while financial services sits near 8.4 and healthcare near 5.7, which reflects a sector historically built on machines rather than systems.
That history no longer describes the plants we work in. A modern facility runs scheduling, quality, inventory, and shipping through software, and a network fault stops physical production as surely as a bearing failure. The denominator that matters is production hours at risk, and a plant can calculate it: output value per hour, multiplied by the hours a given failure would cost, weighted by how likely that failure is over a year.
Run that calculation and the budget conversation changes shape. A plant discovering that an unmonitored switch stack sits between it and 40,000 dollars an hour of output stops arguing about a monitoring line item. Our fuller treatment of the underlying arithmetic is in the cost of managed IT services, budgeting and ROI.
The Six Lines a Manufacturing Budget Needs
Six lines cover a plant’s technology spend, and naming them separately is most of the discipline.
Managed support. Helpdesk, monitoring, patching, and response for the business network and office endpoints, quoted per user or per device.
ERP and application licensing. The ERP, warehouse management, quality, and any MES layer, plus Microsoft. Usually billed direct, so it goes missing from a budget built off one provider invoice.
Plant network refresh. Industrial switches, wireless access points, cabinet gear, and cabling. This is the line most plants never fund, and it ages out like everything else.
OT and cybersecurity. Segmentation maintenance, monitored egress, brokered vendor remote access, and incident response readiness. Guidance puts this at 15 to 20 percent of IT spend.
Business continuity. Tested restores for ERP and warehouse databases, plus whatever redundancy the plant needs for connectivity between sites.
Projects. A new cell, a line expansion, an ERP upgrade, a second facility. Every plant runs one a year and almost none budget for it in advance.
What the Security Allocation Actually Buys
Allocating 15 to 20 percent of the IT budget to cybersecurity and OT protection buys staffed attention rather than more software, and that distinction explains why the number looks high to plants that have never funded it. Firewalls and endpoint tools are comparatively cheap. Maintaining segmentation between business and control networks as machines are added, brokering and logging vendor remote access, monitoring traffic leaving the plant, and keeping an incident response plan current are all human work.
Manufacturing has ranked among the most attacked sectors globally for several consecutive years, and the reason is commercial rather than technical: attackers understand that a plant cannot tolerate downtime, which raises the probability of payment. That is a business fact, and it belongs in a budget conversation rather than a technical one.
The counterview is worth holding. A small shop with standalone machines, no networked controls, and a hosted accounting package does not need a 20 percent security allocation, and a provider quoting one has not looked at the floor. The allocation scales with connectivity, so a plant that has not yet converged OT and IT should budget for the convergence project rather than for the steady-state security spend it does not yet require. Our breakdown of where these gaps hide is in six hidden risks for manufacturers.
The Line Most Plants Never Fund
Plant network hardware is the line most manufacturers leave out entirely, and it is the one that fails at the least convenient moment. Industrial switches, access points, and cabinet gear have a service life like anything else, typically five to seven years, and a plant that installed a cabinet during a line commissioning eight years ago is running past it without a plan.
The reason it goes unfunded is organizational rather than financial. Office IT hardware belongs to a budget somebody owns. Plant network gear was usually installed by an integrator as part of a capital project, so it lives in nobody’s operating budget afterward and reappears only when it fails.
The fix is an inventory. Walk the cabinets, record what is in each one with its install year, assign a service life, and fund the replacements coming due across the next twelve months. Plants doing this for the first time routinely find consumer-grade equipment bridging critical segments, unmanaged switches nobody can monitor, and at least one device still running its shipping firmware. Each of those is a finding rather than a failure, and together they usually explain outages nobody could account for. Guidance on evaluating who should own this sits in managed IT services for manufacturers: what to look for.
Budgeting for Legacy Machines Honestly
Legacy control systems need a budget line even though they cannot be patched, and pretending otherwise is how they stay exposed for another decade. A machine builder certifies a controller on a fixed software version, patching voids support, and the machine will outlive several generations of operating system. That is a real constraint rather than negligence.
What the constraint requires is compensating controls: isolating the device on its own segment, restricting what it can reach, monitoring its traffic, and documenting the decision so it can be reviewed rather than forgotten. All of that is labor, and labor belongs in a budget.
Plants handle this three ways. Some assign it to a controls engineer, which works while that person is there. Some buy it inside a managed agreement, which is cleanest and prices accordingly. Some do nothing and describe the machine as air-gapped when it demonstrably is not, which is the arrangement we find most often. Plants with strong internal engineering frequently run co-managed IT services, keeping OT under engineering while buying monitoring and after-hours depth, and a managed firewall is usually the first piece bought deliberately.
Budgeting Through Expansion
Expansion is where plant IT budgets fall furthest behind, because a new cell or a second shift changes the base faster than the plan does. A new cell is not one machine, it is network drops, a cabinet, possibly an access point, an ERP configuration change, and an increment on monitoring and licensing. A second facility is not double, it is double plus connectivity between sites and a decision about whether the ERP stays local or moves hosted.
Plants that plan a line expansion a year out generally get this right. Plants that add capacity in response to a customer commitment fund it from operating cash and absorb the shortfall quietly, then wonder why the technology line ran over.
The workable discipline is to attach a technology figure to every expansion decision at the moment it is made. Ask a provider for a per-cell and per-site increment in writing and keep it in the budget file. It is a short conversation that removes the most common budget surprise we see, and it gives operations a real number when weighing whether an expansion pencils. The wider version of this planning sits in our practical guide for manufacturers.
Pricing an Hour of Stopped Production
The number that ends most budget arguments at a plant is the cost of an hour of stopped production, and it is the one figure operations can produce faster than IT can. Cross-industry averages put unplanned downtime near 50,000 dollars per hour, but a plant should not borrow that figure when it can calculate its own.
Take output value per hour on the affected line, add the labor standing idle, add expedited freight if the stoppage threatens a customer commitment, and add the makeup shift if the schedule cannot absorb the loss. Then weight it: a four-hour stoppage twice a year is a different exposure than a rare full-day event, and the two justify different spending.
Set that against the difference between a basic support arrangement and one carrying monitored plant network gear, a written response commitment, and tested ERP restores. For most facilities a single prevented stoppage covers the difference several times over, which is a strong argument for buying monitoring, response, and recovery testing.
It is not an argument for buying everything at once, and this is where the downtime figure gets misused. Providers sometimes present it as justification for a full security and support stack in a single motion. Use the number to size the response commitment, the network monitoring, and the recovery testing, since those are the lines that directly reduce stopped hours. Price the rest on its own merits. A line that cannot be defended without invoking the downtime figure probably cannot be defended at all, and a plant that funds everything at once usually finds it has bought capability it never deploys while the plant network refresh line still sits empty.
Frequently Asked Questions
What percentage of revenue should a manufacturer spend on IT?
Sector benchmarks put manufacturing at 2 to 5 percent of revenue, the lowest of any major industry. Treat that as a description of historical spend rather than a target, and size the budget against production hours at risk, which is the quantity that actually drives exposure.
How much of the IT budget should go to security?
Common guidance is 15 to 20 percent for cybersecurity and OT protection, covering segmentation, monitoring, training, and incident response readiness. The allocation scales with connectivity, so a plant with no networked controls should budget for the convergence project rather than the steady-state figure.
Who should own the plant network hardware budget?
Somebody in operating budget, which is the whole problem. Plant network gear is usually installed by an integrator during a capital project and then belongs to no one, so it reappears only on failure. Inventory it, assign service lives, and fund replacements monthly.
How do we budget for machines that cannot be patched?
Budget the labor for compensating controls rather than pretending the machine is isolated. Segmenting the device, restricting what it can reach, monitoring its traffic, and documenting the decision are ongoing work, and that work is the line item.
What does an expansion actually add to the IT budget?
Ask your provider for a written per-cell and per-site increment covering network drops, cabinet gear, monitoring, ERP configuration, and any licensing uplift. Attach that figure to the expansion decision itself rather than discovering it after the cell is commissioned.
Who Is Behind This Advice
Mindcore builds these budgets with plants rather than for them, because the inputs that matter, output value per hour, which stoppages genuinely cannot be recovered, what the expansion plan looks like, live with operations rather than with us. What we bring is the technology side: service life on plant gear, what the security allocation actually pays for, and where the undocumented equipment usually turns out to be.
Matt Rosenthal, Mindcore’s CEO, keeps the practice focused on matching the agreement to what a business genuinely operates rather than selling the largest one a client will sign. For a manufacturer that means reading the connectivity and the production dependency honestly, including the shops where standalone machines mean the security allocation should be far smaller than the benchmark suggests.
Build the Budget Before the Next Capital Cycle
Budgeting for managed IT services at a manufacturer works when six lines exist and each carries a number somebody chose. It fails when the plant budgets managed support, treats ERP licensing as a fixed cost, leaves plant network gear to whichever capital project last touched it, and funds security only after an incident makes the case.
Before the next capital cycle, build the table. One row per line: managed support, ERP and application licensing, plant network refresh, OT and cybersecurity, business continuity, projects. Fill in this year’s actual figure, then add two columns, what it should be and who owns the decision. Most plants find the plant network row empty and the security row funded at a fraction of guidance, and that gap is the budgeting exercise.
If a second read would help, our team will walk the floor, inventory what is actually there, and say plainly where the budget is thin and where it is adequate. Book a free strategy call, or read our approach to managed IT services first.
