Here is how the breach starts, and it starts in a spreadsheet.
No zero-day. No nation-state. A team of four with a phishing kit they rented monthly and the patience to read what came back. Total attacker cost: maybe two thousand euros. Total defender cost: substantially more than that.
The point of that story is not the phishing. It is the spreadsheet. The budget structure created the detection gap before anyone wrote a line of code. So let us talk about how to allocate the 2027 IT budget for a small-to-medium enterprise — software, AI, and security — with an attacker's arithmetic rather than a vendor's.
Italian ICT spending is going up. The Politecnico di Milano's Osservatori data, summarized by ZeroUno, shows the majority of Italian firms increasing ICT budgets, with cloud, security, and data at the top of the priority list. Meanwhile the Italian AI market is projected to reach roughly 2.5 billion euros by 2027. Security spending trends compiled by StationX put typical security allocation somewhere between 5 and 15 percent of the IT budget depending on sector and paranoia.
Those numbers are real. They are also close to useless as a planning tool, because "12 percent on security" tells you nothing about whether you can detect a compromised session token on a Tuesday. Percentages are a compliance artifact. They make good slides. They do not stop lateral movement.
What follows is a structure, not a ratio. Ratios come at the end, and reluctantly.
Most SME software budgets are archaeology. Layer upon layer of tools purchased by people who no longer work there, renewed automatically, integrated with OAuth grants nobody has audited since 2021.
Before allocating a single euro to new software in 2027, run the inventory. Not the finance inventory — the identity inventory. Every third-party application with a token into your Microsoft 365 or Google Workspace tenant is a pivot point. Attackers know this. Consent phishing works because users click "Accept" on an app requesting Mail.Read and offline_access without any idea what they just handed over, and the resulting refresh token survives password resets.
Practical software allocation for 2027:
Vendors price the renewal against your switching cost, not against the value delivered. In 2027 that gap widens because "AI features included" is the new justification for a 20 percent uplift. Ask precisely what the AI feature does, where the inference happens, what data leaves your tenant, and whether it is contractually excluded from training. If the answer arrives in a marketing deck rather than a data processing addendum, the answer is no.
I am not an AI skeptic. Generative tooling genuinely compresses work for small teams, and the adoption guidance for Italian SMEs — see the eight-step framework from Agenda Digitale — is broadly sound: start with a defined use case, measure, expand. Project's SME adoption guide covers the operational side well.
What almost none of it covers adequately is that an AI assistant is a privilege escalation engine when it inherits over-permissive access.
Think about what an enterprise LLM assistant actually is from my side of the table. It is a search interface that ignores the practical obscurity that has been protecting your badly-permissioned file shares for a decade. Nobody found that HR folder with the salary spreadsheet because nobody knew the path. The assistant knows the path. It knows all the paths. And it will summarize them in Italian, English, or Farsi, whichever you prefer.
So the AI budget has a mandatory dependency, and it is not optional:
My allocation advice: spend less on AI licenses in 2027 than you think, and spend the difference on the data hygiene that makes those licenses safe. Half the AI budget being non-AI work is not a failure of the AI budget. It is what a competent AI budget looks like.
Here is the uncomfortable part. Most SME security budgets buy products. Products generate alerts. Alerts require humans. The humans do not exist. Therefore the alerts accumulate in a console nobody has logged into since the demo.
I have run assessments where the EDR detected my initial payload correctly, raised a high-severity alert, and nobody looked at it for nine days. The product worked. The security program did not. The company was compliant. The company was also, in the operational sense, undefended.
If you cannot afford a SOC — and most Italian SMEs cannot, a point Datago makes plainly — then buy the monitoring as a service. An MDR contract with a contractual response time beats three best-of-breed products with nobody watching them. Every time. Not close.
Many Italian SMEs are now in NIS2 scope directly or through supply chain obligations. Budget for it. But be clear about what you are buying: NIS2 compliance is a documentation and governance exercise with a security component. It is not a security program. I have compromised certified organizations inside four hours. The certificate was accurate. The controls were implemented. They were implemented for the auditor's checklist, not against a live adversary, and those are different design goals.
Treat regulatory spend as a separate line from operational security spend. When they are merged, the operational half gets eaten by the compliance half, because compliance has a deadline and a fine attached, and detection engineering does not.
For a mid-market Italian company with a hundred to five hundred employees, a defensible 2027 split looks roughly like: 45–55 percent on core software and infrastructure, 10–15 percent on AI including the data preparation it demands, 15–20 percent on security operations, 5–10 percent on compliance and governance, and 10 percent unallocated. Enstep's 2027 planning guidance lands in a similar range.
That last 10 percent is the important one. It is the incident reserve. Something will break, an exploited vulnerability will demand emergency remediation, or a supplier will get compromised and drag you into their blast radius. If your budget has no slack, the response comes out of whatever project was scheduled for Q4 — and in my experience the project that gets sacrificed is always the security project, because it was the one without a revenue attribution.
Build the reserve. Defend it. And when someone asks why the budget has an unallocated line, tell them it is the only line that has ever been fully spent on time.
