A web platform budget is easier to defend when finance can see what every line is for. Some costs keep the platform running. Others are tied to a deadline or an obligation. The rest are things the business can choose to fund or leave for later, and each figure should have a stated assumption behind it. Budget season makes that discipline necessary. In Forrester's 2027 planning survey of more than 2,600 business and technology decision-makers, 82 percent of technology decision-makers expect budget increases in 2027, so your request lands next to many others asking for more. A request that arrives as one line, "web platform, plus a percentage", gives a CFO little to approve beyond a level of trust. This approach is designed for the September-to-November planning cycle. It starts with the 2026 baseline and ends with the people who need to agree to the budget.
It is written for the CTO, head of digital, IT director, or technical founder who owns a customer-facing web platform. That means the site or application, the CMS or framework underneath it, the hosting, the integrations, and the people or agency who change it. It assumes no particular stack, and every step can be run with the team you already have or taken to any reputable agency, including Keroberos. The goal is a budget you can explain in one meeting, with numbers a finance partner can trace back to an invoice or a date.
Key takeaways
- Start with 2026 actuals and rebuild them into a single baseline. Simply adding a percentage to last year's budget is not enough.
- Separate operational costs, mandatory work, and discretionary projects. This makes it clear which parts of the budget can be negotiated and which can only be deferred.
- Every number that did not come from an invoice belongs in an assumptions register with a source, an owner, and a range.
- Explain the return line by line in terms finance already uses, and show the consequence of each possible cut before anyone asks for one.
Why a platform budget gets challenged in 2027
The 2027 planning cycle has two competing pressures. Budgets are expected to grow, and Forrester found that as many as one quarter of leaders anticipate growth of 10 percent or more. Deloitte's 2026 Global Technology Leadership Study describes the counter-pressure: tech spending projected to rise only modestly and leaders forced into difficult trade-offs.
Web platforms sit in the middle of both pressures, partly because their costs are spread across several budgets. Hosting may sit in an infrastructure line, licenses in a software line, agency hours in a marketing or project line, and internal time in no budget at all. No single owner sees the total, so the platform is rarely reviewed as one object. The first step is to bring those costs together.
Step 1: rebuild 2026 as one platform baseline
Start with twelve months of invoices and payroll allocations, and leave last year's budget aside. The budget shows what you planned to spend; the ledger shows what you actually spent. Start with the latter. Ask for actuals by supplier and cost center, list every supplier that touches the platform, and assign each to a category. Shared costs, such as a cloud account that also hosts other systems or a developer who splits time across products, need an allocation rule written next to the number.
| Category | What sits in it | The question finance will ask |
|---|---|---|
| Hosting and infrastructure | Servers or cloud accounts, CDN, backups, DNS, certificates, staging environments | What drives this line, and how much capacity sits idle? |
| Licenses and subscriptions | CMS or platform licenses, search, analytics, consent tooling, monitoring, e-mail delivery | Which renewals fall in 2027, and at what price change? |
| Third-party services and integrations | Payment, CRM, ERP and marketing connectors, APIs billed by usage | Which of these grow with volume? |
| Development and change | Internal engineering time and agency hours spent on new work | What did we ship for it? |
| Maintenance and support | Updates, monitoring, incident response, hosting administration, support hours | What is included, and what is billed on top? |
| Security and compliance | Testing, audits, accessibility work, privacy requirements, vulnerability fixes | Which obligations carry a date? |
| Tooling, including AI | Developer tools, AI assistants, automation seats, usage fees | Who owns it, and what is the cap? |
| Contingency | Unplanned work and price movement | How was the amount set? |
Once the baseline is rebuilt, two figures matter: the total spend and how it breaks down across categories. If the ledger total differs from last year's budget, call out the difference and explain it in the final document. For the maintenance line, the checklist in our guide to what a proper support contract covers helps you see what is included and what is billed on top. Size it from the tasks and hours in your own contract, since the percentage-of-build rules of thumb have no primary source.
Step 2: separate operational, mandatory, and discretionary spend
Start by separating operational costs, mandatory work, and discretionary projects. The distinction tells finance which parts of the platform budget can be negotiated and which can only be deferred. Operational spend keeps the platform running at its current level of service, such as hosting, support, and licenses at today's volume. Mandatory spend is tied to a deadline or obligation, such as a version leaving support, a regulation taking effect, or a contract renewing at a higher price. Discretionary spend covers work the business can choose to defer without putting the existing platform at risk: new capability, a redesign, debt paydown, or experiments.
The distinction is similar to the run, grow, and transform framing used in enterprise technology budgets. Deloitte's 2026 study recalls that tech executives reported spending 48 percent of their budget on run activities in 2023, 31 percent on grow, and 21 percent on transform, a figure from Deloitte's 2023 research, and reports that 2026 marks the first shift toward a more even distribution. Percentage splits such as 60/25/15 or 70/20/10 circulate in budget templates without a primary source, so track your own ratio from one year to the next instead.
The mandatory-spend calendar
Deal with mandatory costs first. They establish the minimum amount the platform needs before you decide what else to fund. Most of these costs come from three places: end-of-support dates, regulatory requirements, and contracts. A framework or runtime reaching end of support does not suddenly stop your site from working. The problem is that security fixes stop coming from the project maintainers, so any vulnerability found afterwards becomes yours to handle. The dates below come from each project's own documentation, and the work they require grows with the number of versions you are behind.
Several widely used components reach the end of their support window before the end of 2026. Python 3.10 is scheduled for October, .NET 8 (LTS) and .NET 9 follow in November, and Drupal 10 reaches end of life on December 9, a case our migration guide covers in full. PHP 8.2 leaves security support on December 31. The 2027 dates are Node.js 22 on April 30, Python 3.11 in October (scheduled), and PHP 8.3 on December 31.
Take an invented site that runs Drupal 10 on PHP 8.2 with a Node.js 22 frontend: three end-of-support dates fall just before or inside the 2027 budget year. Each one becomes a mandatory line with its date next to it and an estimate from the team that will do the work. Together, those dates establish the minimum spend before you have chosen a single improvement.
Check every version you run, including the ones under your CMS, against these dates, and add the ones that apply to your stack. A platform with no fixed calendar still needs a line, because an unsupported plugin or theme creates the same obligation without a published date.
Regulation adds obligations with dates of their own. According to the European Commission, the EU Cyber Resilience Act applies its reporting obligations from September 11, 2026 and its main obligations from December 11, 2027. It covers products with digital elements. If your platform sells or serves the EU market, ask legal which of these reach you and put the answer on the line, with the date.
Contracts are the third source. List every 2027 renewal with its notice period and its price mechanism, taken from the contract itself. A renewal you miss the notice window for becomes mandatory spend by default.
Step 3: write an assumptions register
An assumption is any number in the budget that you did not read from an invoice. A register lists each one with a baseline value, a low and a high case, a source, an owner, and a date for its next review. That gives finance something concrete to challenge: the input itself, rather than whether the number simply looks reasonable.
A few assumptions tend to account for most of the uncertainty in a web platform budget. For traffic and request volume, use twelve months of CDN or server logs, split into human and automated requests, because hosting, CDN, and security-service costs follow requests. On Cloudflare's network, human traffic generated 47 percent of HTML requests as of December 2, 2025, and non-AI bots 44 percent, so a log that counts every request as a visitor overstates demand.
For vendor prices, read your renewal quotes and contract clauses, since prices rarely stay flat from one renewal to the next. People and agency rates come from current rate cards and finance's salary planning. Cloud efficiency needs your own utilization and billing data, and in Flexera's 2026 State of the Cloud report, a survey of more than 750 cloud decision-makers and users, wasted cloud spend rose to 29 percent, the first increase in five years. Take currency and general inflation from finance, which keeps the CFO from arguing with a figure you invented. Usage-based AI and API fees get the widest range, because their cost follows adoption.
An entry can be short. For an invented monthly CDN line, that means using a baseline taken from twelve months of provider invoices, adjusted for the automated share of requests, along with a low case and a high case, the infrastructure lead as owner, and a review date. The high case sits further out because request volume can jump when a campaign or a crawler arrives, and a finance partner can challenge either the range or the source.
Two practices are particularly useful here. Use ranges rather than a single value, because a single figure implies a certainty nobody has. Also record which assumptions you control and which you do not. The second group is where you need finance's input before the meeting.
Step 4: defend the return in finance's language
The return needs to be explained differently depending on what the spending is meant to achieve. Cost avoided is easiest to defend when it attaches to the mandatory bucket: the upgrade you fund now against the emergency you would fund later. Revenue protected or enabled needs a traceable link between the platform and a revenue line, and the owner of that line is the person to make the claim. Capacity released means counting hours, and it only convinces when someone commits to what those hours will be used for. Risk reduced is harder to quantify, so if you lack incident history and exposure figures, describe the exposure in plain terms and leave out an invented probability.
Avoid a single ROI percentage for the whole request. A single figure can hide which parts of the request actually create value, while a return stated per line, or per group of lines, can be checked. Where a benefit cannot be measured yet, say so and state what you will measure and by when.
If the discretionary bucket includes paying down debt, a technical debt assessment supplies the evidence: signals the business already tracks, ranked by cost. Bring that ranking into this budget as the case for specific items.
Ask finance early how development spend is treated in your books, because the split between capitalized and expensed costs changes how the same request looks. Under US GAAP, FASB's Accounting Standards Update 2025-06 removes the project-stage model for internal-use software and folds the separate guidance for website development costs into it, effective for annual periods beginning after December 15, 2027. Companies reporting under IFRS apply IAS 38. Treatment depends on jurisdiction and on your auditors, so treat this as a question to bring to finance and not as a conclusion to draw yourself.
Give AI tooling its own line with a named owner, a spending cap, and a review date. Deloitte's 2026 study found that 42 percent of surveyed technology leaders report low or no return on AI investments, which is the starting assumption a finance partner brings to any new AI request. The platform risks that come with AI features are covered in our guide to website security in the AI era, and the visibility side in our guide to making your website ready for AI agents.
Step 5: show what a cut would cost
At some point, someone will ask where the budget can be reduced. A cut scenario table prepares the answer in advance: for each line, what stops, when the consequence appears, and what it costs to undo. That keeps the discussion focused on what actually changes when a line is cut, rather than on an arbitrary percentage. It also makes mandatory items visibly different from discretionary ones.
| Line | If it is cut | When it shows up | Cost to reverse |
|---|---|---|---|
| Support and maintenance hours (operational) | Slower response, updates postponed | Early, in incident handling and the update backlog | Moderate, because the backlog must be worked off |
| Version upgrade (mandatory) | The version leaves support and stops receiving security fixes | On the end-of-support date, and at every later vulnerability | High, because the upgrade grows with each version skipped |
| Compliance work (mandatory) | An obligation date passes without the work | At the obligation date, or at a customer or auditor request | High, because the work then happens against a deadline |
| Improvement backlog (discretionary) | Planned capabilities slip | On the roadmap dates the business set | Low, because the work can resume once funded |
| Debt paydown (discretionary) | Delivery drag continues in the areas you flagged | Gradually, in lead time and rework | Grows with time in those areas |
From there, you can present the budget at three levels. Start with the minimum required spend: operational costs plus mandatory work. Add the discretionary items to show the proposed budget. If the total has to come down, list the specific items that would be removed and the consequence of each one. Mandatory items add to the total, so a request to hold the budget flat means discretionary items have to leave by name. This gives the CFO a specific trade-off to consider rather than an arbitrary number to remove.
Step 6: map who has to agree
A budget usually passes through several people, and each person will look at it from a different angle. Decision rights vary between organizations, so start by asking, for each line, who can say yes, who can say no, and who only needs to be told. Talk to them in an order that lets each discussion resolve questions before the next one.
Start with finance. The rest of the discussion depends on having an agreed baseline. The finance partner reads for traceability: a total that ties to the ledger, assumptions with sources, and the operational, mandatory, and discretionary split. The owners of the revenue lines the platform serves, such as marketing, sales, or product, come next. Their job is to state, in their own words, how a discretionary item connects to a target they answer for, because that claim weighs more coming from the owner of the number.
Security, legal, and data protection review the mandatory items, since they hold the obligations and the dates. Procurement holds the renewal calendar and the room to renegotiate terms. The engineering lead and any agency partners stand behind the estimates by saying how firm each one is. The CEO or the board comes last and needs the least: the minimum required spend, the proposed budget, and the specific options between them, each with the outcome it protects or enables.
In an invented case, a regional retailer's platform budget splits into operational spend, mandatory spend for a framework version leaving support and a payment contract that renews, and one discretionary item, a checkout redesign. Finance accepts the baseline and the ranges. The e-commerce director links the redesign to the conversion target. Procurement then points out that the payment contract's notice window closes before the budget year starts, so the renegotiation needs to begin early. The board can then see the minimum required spend, the proposed budget, and the specific choice between them: the redesign, with its owner and target attached.
Take your finance partner through the baseline and the assumptions register before the formal meeting, so the meeting itself is spent on choices. Work backward from finance's submission date, and book the first finance read early enough to revise.
Keep the budget current after approval
Approval is not the end of the planning process. Decide in advance which changes in your assumptions should trigger a reforecast if they move outside their range, and review the register on the cadence finance already uses. Track actuals against the baseline by category through the year, so next year's baseline is a matter of updating a table rather than reconstructing it from scratch.
Frequently asked questions
What should a web platform budget include?
A web platform budget should cover hosting and infrastructure, licenses, third-party services, development, maintenance and support, security and compliance, content operations, AI tooling, and a contingency. Each line should show its 2026 actual, its 2027 figure, and whether it is operational, mandatory, or discretionary spend, with a written allocation rule for shared costs. A missing category understates the total and returns later as an unplanned request.
How do you defend a web platform budget to a CFO?
Bring a baseline tied to the ledger, separate operational, mandatory, and discretionary spend, and attach a source, an owner, and a range to every assumption. State the return per line in terms finance already uses: cost avoided, revenue protected or enabled, capacity released, and risk reduced. Arrive with a cut scenario table so the conversation moves from a percentage to specific consequences, and review the baseline with finance before the formal meeting.
What percentage of revenue should a company spend on technology?
No verified benchmark exists for web platforms specifically. Deloitte's 2026 Global Technology Leadership Study, a survey of 662 senior technology leaders at organizations with revenue of at least $1 billion, reports technology investment of approximately 6 percent of revenue in 2026, projected to rise to about 8 percent over the next two years. That population is large enterprises, so a smaller company should read the figure as context and use its own year-over-year ratio as the benchmark.
How do you handle a flat or reduced budget?
Mandatory spend adds to the total, so a flat budget leaves less room for discretionary work. List the discretionary items that would have to be removed, show what each removal costs using the cut scenario table, and let finance choose among specific options. If a mandatory item cannot be funded, record the date it becomes exposed and who accepted the risk.
Which web platform costs are not optional in 2027?
Costs with a date or an obligation attached: software versions leaving support, such as Drupal 10 on December 9, 2026 or PHP 8.2 on December 31, 2026, contract renewals with notice periods, and regulatory duties where a product is in scope. Check your own versions and contracts against the dates in this article, and put everything else in the discretionary bucket.
From line items to a decision
This approach gives finance a traceable baseline, makes mandatory costs visible, and shows exactly what can be added or removed from the proposed budget. The platform choice itself is covered in our platform audit guide. A good brief for the work you decide to fund is covered in how to prepare your web project for an agency. If you want an independent read on your numbers before the meeting, our consulting and advisory service is built for that. To talk it through, contact us.
Keroberos is a web technology consultancy that advises businesses on platform selection, commissions and delivers WordPress and Drupal builds, and provides staff augmentation for development teams. To discuss your web platform budget, contact us.