Ask a chief financial officer to name the line items that survive a hostile budget review untouched, and the answer is consistent across industries: external audit fees, the directors-and-officers premium, the systems that run payroll and billing, the cost of keeping a licence current. None is bought for delight. Each is the price of remaining a going concern, and each is the last thing a finance function cuts, because cutting it does not save money so much as convert a known cost into an unbounded one.

That list is where we want a software company’s revenue to sit. The single most important thing to understand about a software business is not its growth rate or its multiple but where, in the customer’s cost hierarchy, its invoice lives. Spend that competes with collaboration tools and analytics platforms is evaluated as software, and software loses budget reviews. Spend that has migrated into the protected tier — the operating cost of keeping the business running — is evaluated as overhead the firm cannot do without. Where a budget sits determines how it behaves under pressure, and the durable companies are the ones whose spend has crossed into the part of the cost base that does not get cut.

What moves a line item out of the discretionary tier

A software invoice escapes the discretionary budget when it stops being a tool the business chose and becomes a cost the business owes. Three things do that work, and the strongest businesses combine them.

The first is operational necessity: the software is on the critical path of how value is produced or money is collected. A warehouse-management system, a billing engine, a clearing platform — remove it and the operation stops, so the spend is defended the way the lights and the lease are. There is no value judgement at renewal because there is no alternative that keeps the business running.

The second is an obligation owed to someone else. This is where one corner of our market — the software regulated industries depend on — earns its particular conviction, and it is worth being concrete about why. When spend discharges a duty owed to a supervisor rather than a preference held by a manager, it leaves the discretionary budget entirely. The clearest recent example is the EU Digital Operational Resilience Act, Regulation (EU) 2022/2554, in application since 17 January 2025: under Article 5 the management body of a financial entity must itself define, approve and bear responsibility for the ICT risk-management framework. When the obligation attaches to a named person rather than a department, the spend that discharges it stops being departmental — it answers to the audit committee, not the product owner.

A budget defended by the audit committee behaves nothing like a budget defended by a product owner, and the durable software businesses have changed which committee their invoice answers to.

The third is a cost that scales with the magnitude of what it prevents, not the convenience it adds. Software priced against a downside — a fine, a personal liability, an operational outage, a disclosure a board does not want to make — can sustain pricing that tools sold on convenience cannot, because the buyer’s comparison is not the cost of the software but the cost of being without it. The regulated corner sharpens this to a point: NIS2 sets fine ceilings of at least 2% of worldwide turnover for essential entities, and that number, not the licence fee, is what the buyer is really weighing.

The economics that follow

Once spend belongs to the protected tier, the unit economics improve for reasons that have little to do with the product and everything to do with the buyer’s incentives.

  • Renewal ceases to be a value judgement and becomes a continuity decision, because the alternative to renewing is re-opening a problem the software had closed.
  • Pricing references the magnitude of what is being managed, not the marginal cost of the software, which is why these budgets tolerate escalation that discretionary tools cannot.
  • New requirements layer onto the same function rather than replacing the old, so the line item widens over time rather than churning.

Used carefully, the market data on the regulated corner is consistent with this: MarketsandMarkets projects enterprise GRC software expanding from 20.56 billion dollars in 2025 to 39.99 billion by 2030, a compound annual rate of 14.2 per cent — double-digit growth in a category whose customers are buying obligation rather than advantage. But the principle generalises well beyond it. We underwrite software businesses on the assumption that their revenue is as durable as the reason their customers pay for it, and the most durable reason is always the same: the customer cannot defer the spend without re-opening a problem they had already paid to close. That is the budget we want to own.