Software Maintenance Cost: What to Budget, What It Covers and How to Structure Support

Most companies budget carefully for building software and barely at all for keeping it alive. That is backwards. Software maintenance cost is the part of ownership that never stops: security patches, dependency upgrades, hosting, bug fixes and the small changes the business keeps asking for. This guide explains what maintenance actually covers, how much to plan for, and how to structure support so a launch does not turn into an unowned liability.

What software maintenance actually includes

“Maintenance” is not one activity. It is four, and they behave differently on a budget:

• Corrective: fixing bugs and incidents. Unpredictable in timing, but usually small if the system is monitored.
• Preventive and security: updating frameworks, plugins and libraries, renewing certificates, testing backups. Boring, scheduled and the cheapest insurance you can buy.
• Adaptive: keeping up with the outside world: a new PHP or Node version, a payment provider changing its API, new browser behaviour, a regulation such as the European Accessibility Act.
• Perfective: improvements and small features requested by users. This is where most of the “extra” spend ends up, and where a monthly hours budget helps.

How much should you budget?

There is no universal number, but there is a useful rule of thumb. Engineering consultancy Edana describes a common rule of 15–25% of the initial development cost per year, and notes that maintenance can reach 70–80% of total lifecycle investment for long-lived systems. Treat both as starting points, not quotes: the article cites no underlying study, and your own figure depends on how critical the system is and how fast its technology moves.

As an illustration only: an application that cost €40,000 to build would suggest roughly €6,000–€10,000 a year to keep healthy, before any major new features. If a vendor quotes far below that for a business-critical system, ask what is not being covered. If the quote is far above, ask what the hours are spent on.

Four factors push the number up or down:

1. Criticality: a system that stops your orders needs faster response than an internal report.
2. Code health: undocumented, untested code makes every change slower. See our guide to legacy system modernization for when to refactor instead.
3. Integrations: each external API (payments, fiscalization, ERP, WhatsApp) is something that can change without asking you.
4. Rate of change: a growing product needs more perfective work than a stable one.

Why skipping maintenance is the expensive option

Security is the clearest case. Verizon’s 2025 Data Breach Investigations Report found exploitation of vulnerabilities was the starting point for around 20% of breaches, second only to stolen credentials. The same coverage reports that fixing known flaws in edge devices took about 32 days on average, and that only a little over half were ever fully remediated. Attackers do not need anything clever when the patch has been sitting unapplied for months.

The quieter cost is key-person risk. When the developer who built the system leaves and nobody has touched it since, the first incident becomes an archaeology project: no one knows how deployment works, where backups go, or which plugin is holding the site together. The same applies to AI-built code that has never been reviewed; we covered those risks in vibe coding to production and AI agent security.

Maintenance models compared

What a good maintenance agreement should contain

• A named person or team who knows the codebase, not a ticket queue.
• Scheduled updates for framework, plugins and dependencies, tested on a copy before production.
• Backups that are restored on a schedule, not just taken.
• Uptime monitoring and error tracking, with an agreed response time per severity.
• A monthly hours budget for small changes, and a clear rule for anything bigger.
• A short monthly report: what was updated, what was fixed, what to plan next.
• Full ownership of code, repositories, hosting and domain on your side.

Example: a booking platform two years after launch

A tour operator launches a custom booking system. In year one nothing happens, which feels like success. In year two the payment provider deprecates an API version, the PHP version on the server reaches end of life, and a plugin the site depends on is abandoned. Without maintenance, all three arrive as emergencies in the busiest month. With a retainer, they are three scheduled tasks across a quarter, tested before the season starts. The cost difference is small; the difference in stress and lost bookings is not.

FAQ

How much does software maintenance cost per year?

A common planning figure is 15–25% of the original build cost per year, adjusted for how critical the system is and how many integrations it has. Ask for a written scope after a short review of the system instead of relying on a generic percentage.

Can someone maintain software they did not build?

Yes. Most maintenance relationships start that way. A good provider begins with an onboarding review of code, hosting, backups and risks, and tells you what must be fixed before taking over.

What is the difference between maintenance and support?

Maintenance is proactive work that keeps the system healthy: updates, backups, monitoring. Support is reactive: answering questions and fixing issues when they appear. Good agreements cover both.

Is a maintenance contract worth it for a small website?

If the site brings in enquiries or orders, a day offline or a hacked page usually costs more than a year of upkeep. If it is a static brochure page, lighter arrangements may be enough.

Get someone responsible for what you have live

Shkulaku maintains WordPress, Laravel, Symfony and React systems, including our own products, on monthly maintenance retainers with an agreed response time and a short monthly report. If something of yours is live and nobody owns it, contact us and we will review it, list the risks in plain language and propose a fixed monthly scope. For new builds, our guide to custom software development cost shows what to plan up front.