Smarter tech spending in uncertain times

David Zey Gerry Pitt

June 1, 2026

For small- and mid-sized businesses (SMBs), the pressure is coming from all directions. 

Leadership teams are being told they need to adopt AI to stay competitive.

At the same time, their core systems are aging, becoming harder to maintain and integrate.

Meanwhile, cybersecurity threats continue to escalate, bringing real financial and operational risk. 

The challenge isn’t recognizing these priorities – it’s funding them. 

Unlike large enterprises, SMBs don’t have the luxury of separate budgets for innovation, infrastructure and security.

Every dollar has to work harder.

The companies navigating this well aren’t treating these as competing investments – they’re treating them as parts of the same strategy. 

That shift is defining the difference between organizations that are making progress and those that are spinning their wheels. 

In working alongside several Midwestern manufacturers on budgeting and developing three-year IT roadmaps, these tensions surface quickly.

Leadership teams aren’t debating whether AI matters – they’re trying to figure out how to move forward without solving every infrastructure and security problem first.

The real opportunity, though, is rarely about doing everything in sequence.

Smart technology planning creates moments where the right investment lifts multiple problems at once, where modernizing one system also reduces a security exposure or where an automation project quietly eliminates the need to migrate an aging tool entirely.

What separates organizations making real progress from those spinning their wheels isn’t budget size.

It’s experienced, objective leadership and the discipline to trust a well-built plan. 

The end of siloed IT spending 

Over the past few years, many organizations approached technology in waves. 

First came cloud adoption and SaaS expansion.

Then cybersecurity tools were layered in, often reactively.

Now AI has entered the picture, bringing both opportunity and noise. 

The result in many organizations is a fragmented environment: overlapping tools, inconsistent data and rising costs without a clear connection to business outcomes or risk reduction. 

Economic pressure is forcing a reset. 

Technology investments are no longer evaluated in isolation.

Leadership is asking tougher questions: 

• Does this reduce cost or drive revenue? 
• Does it introduce risk or reduce it? 
• Does it work with what we already have? 

AI isn’t getting a blank check.

Infrastructure upgrades are being challenged.

Even cybersecurity, long treated as a necessary expense, is being pushed to demonstrate measurable impact and strategically apply discerning investment in prevention versus recovery plans. 

This is not a slowdown in technology adoption.

It’s a shift toward disciplined, cross-functional strategy and discernment. 

AI without the foundation is a dead end 

There’s no shortage of enthusiasm around AI.

But for many organizations, the results haven’t matched expectations. 

The issue isn’t the technology.

It’s the environment it’s being dropped into. 

AI depends on predictability.

Predictably clean or dirty data, connected systems and people and definable manual and automated processes.

Without those, even the best tools struggle to deliver meaningful outcomes and can introduce new risk through inconsistent or exposed data. 

It’s common to see companies layering AI onto disconnected CRM and ERP systems, manual or inconsistent workflow or data that hasn’t been standardized, governed or well understood. 

The negative result is also predictable.

Outputs are unreliable, adoption stalls and what was expected to be a productivity gain becomes shelfware. 

This is especially visible in manufacturing.

In more than one case, AI initiatives are being discussed while core production or inventory systems still require manual intervention or lack real-time visibility.

Until those gaps are addressed, AI shifts bottlenecks somewhere else at best and can increase operational risk rather than reduce it. 

The companies seeing traction aren’t starting with AI tools.

They’re starting with use cases and building the foundation to support them. 

AI works best as an amplifier.

If the underlying environment is weak, it amplifies inefficiencies and exposure. 

Infrastructure: The quiet constraint on growth and stability 

Infrastructure rarely gets executive attention until something breaks.

But it’s often the biggest constraint on both efficiency and risk. 

Many companies are operating with a mix of legacy systems and newer SaaS tools that don’t fully align.

Over time, this creates friction: 

• Employees re-entering data across systems 
• Limited operational visibility 
• Difficulty integrating new capabilities 

It also introduces risk: 

• Single points of failure 
• Weak recovery capabilities 
• Inconsistent data impacting decisions 

In roadmap discussions, this often surfaces as a trade-off: Do we modernize the core or add new capabilities?

In reality, it’s about sequencing and looking for skip-level gains.

Without stabilizing the foundation, additional layers tend to increase complexity and risk. 

Modernization doesn’t always mean replacement.

Often, it’s about reducing redundant tools, improving integration and standardizing workflows. 

Done well, infrastructure improvements reduce operational risk and create the conditions where AI can actually deliver value. 

Cybersecurity: From cost center to risk management discipline 

Cybersecurity has shifted from a reactive function to a core business discipline: risk management and recoverability. 

SMB leaders are no longer just asking, “Are we secure?” – they’re asking: 

• What risks actually threaten the business? 
• What is the impact if something goes wrong? 
• Where should we invest to reduce meaningful exposure? 
• How do we create plans for resilience and recovery? 

This shift is being driven by real pressure.

Clients, insurers and regulators are raising expectations.

And the cost of downtime from ransomware or disruption is harder to absorb. 

In manufacturing, this is especially clear. 

Security is increasingly tied to customer requirements and supply chain expectations.

In recent planning engagements, it’s showing up as a business priority, not just an IT concern. 

As a result, companies are moving toward risk-based approaches: 

• Endpoint detection and response to limit breach impact 
• Email and identity protection to address common attack paths 
• Vulnerability management to prioritize fixes 
• Security awareness to reduce human-driven risk 
• Scenario-based recovery planning 

The key change is how decisions are made.

Investments are tied to specific scenarios, such as preventing production downtime, protecting sensitive data and meeting contractual obligations. 

Cybersecurity now intersects directly with infrastructure and AI: 

• AI expands data access and exposure 
• Modern systems require stronger identity controls 
• Integrated environments increase potential impact of incidents 

Handled well, cybersecurity becomes a way to quantify and reduce business risk, not just defend against threats. 

One budget, one strategy 

The most effective companies aren’t balancing three priorities – they’re aligning them under business impact and risk. 

Instead of funding AI, infrastructure and cybersecurity separately, they’re focusing on outcomes and the risks tied to them. 

Take sales efficiency.

It’s not just a productivity goal – it carries risks, such as poor data leading to missed revenue, inconsistent processes affecting forecasts and weak controls exposing customer data.

Addressing it would include: 

• Cleaning up CRM data (infrastructure) 
• Adding AI-assisted tools (AI) 
• Strengthening access controls (security) 
• Enabling legacy system to communicate with new modern processes (all three) 

This reframes budgeting.

It’s less about tools and more about reducing friction and risk within business processes. 

Most organizations aren’t increasing spend – they’re reallocating.

Eliminating redundant tools, consolidating vendors and prioritizing investments that improve performance and reduce exposure 

Dual-purpose investments are gaining traction, solutions that improve efficiency while strengthening control.

But they don’t happen by accident.

They require leaders who can see across functional silos, sequence investments for compounding benefit and have earned enough trust that when they present a plan, the organization moves. 

The goal isn’t to do more.

It’s to make each dollar work harder. 

A practical framework for decision-making 

For leadership teams, consistency is the challenge. 

A simple framework helps: 

1. Business Impact
   1. Does this drive revenue, improve efficiency or support growth? 
2. Foundation Fit
   1. Do current systems and processes support it? 
3. Risk Reduction (or exposure)
   1. Does it reduce meaningful risk or introduce new vulnerabilities? 

Strong organizations don’t just ask what they gain.

They ask what could go wrong and whether they’re prepared. 

A practical standard is emerging: If an investment doesn’t improve performance or reduce risk, it’s a distraction. 

If it does both, it’s a priority. 

Cross-functional discipline will define the winners 

AI will continue to dominate headlines, new tools will continue to emerge and the pressure to adopt them will not go away. 

But success won’t come from moving the fastest.

It will come from moving deliberately. 

The organizations getting this right are building strong foundations, aligning investments to outcomes and managing risk with intention. 

They understand that AI, infrastructure and cybersecurity are not separate conversations.

They are interconnected decisions that shape how the business operates and grows. 

In a constrained environment, that clarity matters. 

Because the advantage won’t go to the companies that spend the most.

It will go to those who invest with discipline and with a clear understanding of risk.