The debate on licence and digital asset management has long been dominated by data from large corporations. But those truly under pressure are small and medium-sized organisations — including associations, foundations and social entities — which manage a growing number of systems, lose a significant share of their software spend and face a security risk that can threaten their survival. For their decision-makers, controlling costs and protecting the organisation are two sides of the same problem.
Software spend: small organisations, large bills
A small European company with fewer than 100 employees runs an average of 182 SaaS tools and spends around €350,000 a year. Organisations with 200 to 350 employees run 273 tools and spend around €900,000; those with 350 to 500 employees run 295 tools and spend around €2.2 million (Décision Achats). In other words, even "small" organisations have a software complexity and cost that far exceed most management's intuition.
Even more worrying is price dispersion. Spendesk's analysis of 2,568 European companies shows that the ratio between the per-seat price paid by the best-managed company and that paid by the median can reach: Figma 3.4:1, Slack 3.7:1, HubSpot 4.4:1, Atlassian 8.3:1 and Notion 9:1. By closing that price gap alone, EU companies with 50 to 250 employees overpay by €7 billion each year; eliminating duplicate purchases would save a further €3 billion. In total, the optimisation headroom in SME software purchasing approaches €10 billion.
In the field of AI tools the problem is sharper: 72% of companies buying these products pay simultaneously for at least two competing solutions. The median monthly fluctuation of AI bills can reach 61%, and the highest month can be up to eight times the lowest. For a small organisation with a tight budget, that unpredictability directly threatens budget planning.
Security: an asymmetric cost
Cost waste is a slow bleed; a security incident is a blow that can be lethal.
Spanish data offers a concrete perspective: 46% of Spanish SMEs invest less than €500 a year in cybersecurity, and only 7% exceed €2,000 (Gigas and Ipsos study). At the same time, 78% of companies claim to have some form of protection, but mainly at a basic level. That state of "high awareness, low investment" is precisely the most typical risk portrait of small organisations.
Data at European level is no more encouraging. A Mastercard survey of 1,800 European SMEs shows that one in four companies has already suffered a cyberattack, and the same proportion fears that a successful attack would force them to close. In Germany, 40.3% of SMEs have experienced a cybersecurity incident in the past three years (GlobalData).
These figures must be read in the context of resource constraints. Spanish medium-sized companies allocate only 4% of their IT budget to cybersecurity (Cylum), and 60% of IT leaders describe their own security maturity as "initial": basic measures, but no formal processes. The problem is not failing to know that risk exists, but lacking the resources and methods to turn that knowledge into action.
Action: three immediately executable steps
First, carry out a price benchmark for the same software. No platform purchase is required. Identify the five to ten per-seat tools with the highest spend in the organisation and compare them with public market prices or what similar organisations pay. Spendesk's data shows that this single step reveals the most obvious premiums: the price gaps for Atlassian and Notion reach 8.3 and 9 times respectively. For AI tools, review as a priority whether two or more paid products with overlapping functionality exist, something that occurs in 72% of companies.
Second, link the offboarding process with access recovery in a single checklist. Whether employees, volunteers or temporary collaborators, their departure from the organisation must trigger: which SaaS accounts to deactivate, which shared credentials to change and which AI tool permissions to revoke. A simple checklist tied to the HR process requires no technological investment and yet closes the most common exposure surface. When almost half of Spanish SMEs invest less than €500 a year in security, process control is the line of defence with the best cost-benefit ratio.
Third, create a separate budget line for security spending. Spanish medium-sized companies allocate only 4% of their IT budget to cybersecurity. Without a dedicated budget line, return cannot be measured, nor can the need to invest in security be justified before a board or a funder. Even if the amount is small, separating it is in itself an act of governance: it turns "security" from a diffuse concern into a decision that can be examined and held to account.