Beyond ROI: Why the Best Technology Decisions of FY27 Won’t Look Like Efficiency Plays

By Stu Long, Chief Technology Officer, Orro

The work of EOFY is never just financial. Cleaning up the waste, scrutinising the procurement, auditing the licence estate, and honestly accounting for what has been deferred — all of that is necessary, and all of it matters. But there is a harder question that sits on the other side of that work, and most organisations do not ask it with sufficient rigour: now that you have cleared the ground, what do you actually build?

Efficiency is not a strategy. It is a precondition. Organisations that treat EOFY purely as a cost-reduction exercise will enter FY27 in a cleaner but not materially stronger position. They will have removed waste without changing trajectory. The organisations that will be in the strongest position twelve months from now are the ones that used the final quarter of this financial year to make at least one genuinely strategic technology investment — the kind that does not simply solve a current problem but compounds in their favour over time as data accumulates, integration deepens, and capability matures.

This is the argument that the rest of this article will make. Not as aspiration, but as a discipline.

The Efficiency Trap: Why Clearing the Ground Is Not Enough

There is a seductive completeness to a well-executed EOFY efficiency programme. The redundant licences are gone. The cloud waste is identified. The procurement has been validated. The deferral debt has been honestly assessed and either addressed or budgeted. At the end of that exercise, the organisation feels tighter, more rational, better governed. And it is — all of those things are real improvements.

But efficiency measures share a structural limitation: they are, by definition, backward-looking. They find waste in what has already been built and optimise the cost of what is already being done. They do not, by themselves, create new competitive capability or change an organisation’s position relative to the threats and opportunities it will face in the year ahead.

The organisations that confuse efficiency with strategy tend to discover this in retrospect. They enter FY27 with a lower cost base but the same technical constraints that were limiting them before. The constraint that was making detection slow is still slow. The visibility gap across their OT environment is still a gap. The identity sprawl that created risk eighteen months ago is still sprawling. Efficiency programmes, however well executed, do not cure structural limitations. That requires a different kind of decision.

What Compounding Technology Investment Actually Looks Like

The concept of compounding is well understood in financial terms. It is less commonly applied to technology investment decisions, but it should be. Some technology investments get more valuable over time, not less. They accumulate institutional knowledge, generate improving data sets, reduce the cost of adjacent investments, and build capability that becomes progressively harder for competitors to replicate. Others depreciate quickly — they solve a point-in-time problem, create integration debt, or become obsolete before they pay back.

The strategic technology decisions worth making at EOFY are the compounding ones. In Australian enterprise environments, the evidence for compounding returns is clearest across several specific capability areas.

Security automation and detection engineering is the most consistently evidenced. The IBM Cost of a Data Breach 2025 report (IBM, 2025) finds that organisations making extensive use of AI and automation in their security operations save, on average, USD 1.9 million per incident compared to those that do not. That cost differential is not simply the result of technology spend — it is the product of accumulated capability. Organisations with mature detection engineering know their threat landscape, have tuned their tooling to their environment, and have built institutional knowledge about how their adversaries behave. That knowledge compounds. It gets harder to breach and cheaper to defend as the data matures.

OT/IT convergence infrastructure represents a compounding opportunity of a different kind, particularly for organisations operating in critical infrastructure, utilities, mining, or manufacturing. The cost of not having converged visibility is already measurable. The Claroty Global State of CPS Security 2024 (Claroty, 2024) study of 1,100 organisations globally found that over a quarter reported financial losses of USD 1 million or more from cyber attacks affecting cyber-physical systems in the past year, with 33% experiencing a full day or more of operational downtime. For these organisations, the investment in OT/IT convergence is not simply a security play — it is the foundation on which operational efficiency, compliance readiness, and real-time decision-making all depend. Early investment accumulates advantage: the data gets richer, the models get sharper, and the compliance posture strengthens without additional cost.

Identity and access management modernisation has a compounding quality that is often underappreciated until the gap becomes acute. Identity is where most serious incidents now begin. ASD’s Annual Cyber Threat Report 2024–25 (ASD/ACSC, 2025) found that phishing, compromised accounts, and credential harvesting were the three most commonly observed techniques across both government and industry incidents — and that 39% of ransomware incidents in the same period were detected by the ACSC itself rather than the affected organisations. That last figure is the one that should concentrate executive attention. It means that four in ten serious ransomware incidents were not identified internally by the organisation being attacked. Mature identity infrastructure and the detection capability to act on it are not just risk mitigants — they are the precondition for every other security investment working as intended.

Observability and network intelligence compounds through data richness. An organisation that has invested in end-to-end visibility across its environment does not simply see more — it learns more. Anomaly detection improves. Incident response accelerates. Capacity planning becomes precise rather than approximate. And as environments grow in complexity (which they invariably do), the value of that visibility increases rather than decreases.

EOFY Is the Starting Line, Not the Finish Line

Here is the counterintuitive argument that deserves more attention than it typically gets. The conventional framing of EOFY treats it as a period of retrenchment — a time to slow down, clean up, and get ready for the year ahead. But for organisations that arrive at June 30 knowing what they want, EOFY is one of the best moments in the calendar to make a strategic technology investment.

Budget cycles, vendor negotiations, and contract timing all converge in ways that favour a prepared buyer. Vendors who have their own EOFY targets are often willing to move on price, implementation timelines, and commercial terms in ways that are harder to achieve mid-year. Internal budget approval processes, which can be slow and politically complex at other times of year, are often more agile in the final quarter when uncommitted spend is visible and decision-makers are motivated to use it well. And the CFO who has watched the efficiency programme reduce waste is frequently more receptive to a well-framed strategic investment case in June than in October, when the memory of waste is less fresh.

The organisations that capture this advantage are the ones who arrive at EOFY already knowing what they want — and who can frame that investment clearly enough for a cross-functional conversation that includes the CFO and, where relevant, the board. That framing discipline is not a soft skill. It is a strategic competency.

The Framing That Separates a Strategic Bet from an Expensive Mistake

Not all ambitious technology investments compound. Some are vendor-led and solve problems the vendor has identified rather than constraints the organisation actually faces. Some are poorly scoped and generate integration complexity that costs more than the capability they deliver. Some are technically sponsored but not genuinely owned at executive level, which means they get under-resourced when priorities shift and under-utilised when they are complete.

The distinction between a strategic technology investment and an expensive distraction comes down to four questions, and organisations that answer them honestly before committing tend to make better decisions than those that do not.

The first is whether the investment addresses a constraint that is genuinely limiting organisational performance. Not a problem worth solving in the abstract — a bottleneck that is measurably slowing down the ability to detect, respond, operate, or grow. If the constraint cannot be named specifically, the investment is probably solving a problem the vendor defined, not one the organisation actually has.

The second is whether the investment has a compounding return profile. Will it be more valuable in two years than it is today? Will the data it generates improve its own effectiveness? Will it reduce the cost of adjacent investments by providing a foundation they can build on? If the answer to all three is no, the investment is probably tactical rather than strategic — and should be evaluated on a shorter payback horizon accordingly.

The third is whether the investment has executive ownership, not just technical sponsorship. A CISO who champions a detection engineering programme is providing sponsorship. A CEO who understands why it matters to the business and will protect the resource allocation when competing priorities emerge is providing ownership. The difference between these two things is usually visible in the investment’s outcome.

The fourth is whether the investment has a success metric that is not purely financial. Cost reduction metrics are real, but they are often lagging indicators that take years to manifest and are easily contaminated by other variables. The most reliable signals that a strategic technology investment is working are operational: detection times are shortening, incidents are being resolved faster, audit findings are reducing, capacity planning is becoming more accurate. These are the metrics that tell you the capability is maturing, not just that the budget was spent.

The View from Here

I have worked with a lot of Australian organisations through the technology decisions that define their next three years. The ones that enter each new financial year in a materially stronger position are rarely the ones who cut hardest. They are the ones who used a moment of budget discipline to make one or two decisions that they had thought through carefully, that solved a real constraint, and that would get more valuable over time rather than less. EOFY is not just about removing what should not be there. For the organisations that approach it well, it is also about placing the kind of bet that looks obvious in retrospect.

If you want to put these disciplines into practice before June 30, two resources from this edition are available to download now. The EOFY Technology Audit Checklist covers the groundwork across procurement, cloud, licensing, and deferral — and includes a strategic investment criteria domain that connects directly to the argument made here. The CFO’s Technology ROI Guide provides a structured decision-making framework for the final quarter, including the strategic investment framing approach that helps a cross-functional team align on which bets are worth making and why.

Orro partners with Australian organisations to navigate both the operational disciplines and the strategic investment decisions that define technology leadership — from procurement validation and managed security through to infrastructure strategy, cloud, and connectivity. To speak with our team about your FY27 technology roadmap, visit orro.group/contact or reach out to your Orro account manager directly.

Further Reading

• Orro Cyber Security Services — Orro’s managed security capability, including detection engineering, threat intelligence, and security operations, relevant to the compounding security investment argument in this article.
• Orro Critical Infrastructure — Services and capability for OT security, convergence infrastructure, and SOCI compliance across mining, utilities, energy, and manufacturing sectors.
• Orro Trust & Security — Orro’s own security credentials and certifications, including ISO/IEC 27001:2022 and IRAP alignment.
• Orro Salt Typhoon Threat Hunt Report — Orro’s analysis of the Salt Typhoon telecommunications infrastructure campaign, demonstrating threat intelligence capability that compounds with investment.
• Orro Insights Archive — The full May 2026 edition and previous Orro Insights series, including the April 2026 governance and privacy risk edition.