Cutting the maintenance contract is the most visible saving in any technology budget. The system runs fine in month one, month two, month six. The problem is that the cost of this decision does not arrive in monthly instalments. It accumulates and then arrives all at once.
Four hidden costs
1. Security holes accumulate
Hundreds of new vulnerabilities are published every month for common software. An unpatched system does not stand still — it gets progressively easier to compromise, because the vulnerability is public and the exploit tooling already exists.
The concern is not that attackers are targeting your company. Most attacks today are automated: scanners sweep entire address ranges looking for unpatched systems, indifferent to who you are. Small businesses get breached not because they hold something valuable, but because the door was unlocked.
2. Technical debt compounds
Skip one update and the next upgrade is easy. Skip twelve and the upgrade may require rewriting part of the system, because the libraries have changed how they work. Upgrade cost does not rise linearly with neglect. It rises faster than that.
3. Knowledge leaves with people
A system nobody has touched in two years is a system nobody remembers. The developer has moved on, the documentation was never updated. When something breaks, the first task is reading the code to understand it again — while the clock runs and the system is down.
4. Downtime arrives at the worst possible moment
Unmonitored systems tend to fail at peak load, because that is when weaknesses surface. Which means they fail during peak season, at month-end close, during a promotion — precisely when an hour of downtime is most expensive.
Working out the number for your business
Do not argue about this qualitatively. Calculate it and compare.
| What you need | How to estimate it |
|---|---|
| Cost of one hour of downtime | Daily revenue divided by working hours, plus salaries of staff who cannot work |
| Downtime hours per year without maintenance | Common range for unmonitored systems: 8 to 40 hours a year |
| Cost of recovering from a major incident | Emergency response, data restoration, and the downtime that goes with it |
| Probability of a serious incident | Rises with time since the last patch |
Multiply these to get expected annual loss. Compare to annual maintenance cost. For most businesses whose systems touch revenue directly, the answer is not close.
When maintenance is not worth it
This case is real. An internal system with few users, no sensitive data, no internet connection, and where a week of downtime would leave the company functioning manually. For that system, fixing it when it breaks is economically sound. What matters is knowing which case you are in.
What minimum maintenance means
If budget is tight, this is the priority order — do as much as you can afford:
- Automated backups and periodic restore tests. A backup that has never been restored is not a backup. This is the single most important item, and the one most often done halfway.
- Security patches. You do not need to upgrade everything, only close the serious holes.
- Monitoring and alerting. Know there is a problem before a customer calls to tell you.
- Current operational documentation. Somebody other than the original developer must be able to restart the system.
- Periodic dependency updates. Once a quarter, so it never becomes a mountain.
Signs a system is being neglected
- Nobody knows when a backup was last restored successfully
- Only one person in the company knows how to restart the system
- The most recent technical documentation is over a year old
- The standard response to an incident is to restart it and hope
- Nobody can say which version is currently running
If you nod at three or more of these, the maintenance cost you are saving is a loan that has not yet come due.
Written from the team's hands-on experience delivering infrastructure and software. No sponsorship, no product placement.