Choosing a model

Managed IT, co-managed IT, or hiring someone internal?

Below about 60 users, an external team usually covers more ground for less money than a first internal hire. Above that, most companies need someone in the building. Co-managed IT is the middle: your person keeps the relationships and the priorities, and an outside team takes monitoring, security operations, and after-hours.

Who owns what in each model

Most of the disagreement about these three options disappears once you write down who is responsible for each piece of work. Below is how the responsibilities usually land.

Responsibility by model

Responsibility	One internal hire	Co-managed IT	Managed IT
Day-to-day help desk	Internal, one shift	Internal first, external for overflow and after-hours	External, with a stated response target
24/7 monitoring and alerting	Rarely covered in practice	External	External
Patching and endpoint hygiene	Internal, and the first thing to slip when tickets pile up	External, on a reported cadence	External, on a reported cadence
Backup and restore testing	Internal, often unverified	External, with restore tests on a schedule	External, with restore tests on a schedule
Security operations and incident response	Depends entirely on that one person’s background	External	External
Vacation, illness, and turnover coverage	Uncovered	External	External
Vendor management and renewals	Internal	Shared, with the split written down	External
Budget and technology strategy	Internal, usually without executive authority	Shared, or a fractional CIO seat	Fractional CIO seat
Institutional knowledge of your business	Strongest here	Kept internal on purpose	Built through a named owner on the account

When an internal hire is the right call

Somewhere past 60 or 70 users, and earlier in a manufacturing or multi-site operation, the volume of hands-on work justifies someone in the building. Physical environments need a person who can walk to the floor. Custom or line-of-business applications need someone who knows them deeply.

The two things that go wrong are predictable. One person cannot cover nights, weekends, and vacations, so the coverage gap is structural rather than a performance problem. And a generalist hired to keep things running is rarely also a security specialist, a network engineer, and a compliance analyst, which is what a cyber-insurance questionnaire now assumes you have.

When co-managed fits

Co-managed works when you already have capable internal staff and the gap is coverage, depth, or tooling. Your person stays the face of IT and keeps context on the business. The outside team brings the monitoring stack, the security operations, the after-hours rotation, and a second opinion on architecture.

The whole model depends on the split being written down. Who closes the ticket, who owns the escalation, who touches the firewall, and who is called at 2 a.m. If those are unclear, both sides assume the other has it. Co-managed IT starts from that written split.

When fully managed is the cheaper answer

Under about 60 users, and especially with a single site and standard applications, an external team covers monitoring, patching, backup, identity, security, and help desk for less than a first hire and across more hours. You also stop being one resignation away from having no IT function at all.

The concern people raise is losing institutional knowledge. That is a real risk, and it is why we put a named owner on the account instead of rotating whoever is free. Documentation of your environment belongs to you either way. Managed IT covers the ongoing side; Fractional CIO/CISO covers the seat at the table when spend and risk need an owner.

A short way to decide

Count your users and devices. Under 60 users on one site, start with fully managed.
Ask what happens now at 9 p.m. on a Friday. If the answer is nothing happens, you have a coverage problem rather than a capability problem.
Look at your last cyber-insurance questionnaire. If nobody can answer it from memory, the gap is security operations and documentation.
Ask whether your existing IT person is stuck doing password resets instead of the projects you hired them for. That is the clearest signal for co-managed.
Separate the run from the strategy. Someone keeping systems alive is not the same role as someone deciding what to spend and what to retire.

Questions we hear first

Will an outside firm try to replace our IT person?

Not in a co-managed engagement, where the point is that they stay. We take the work that does not fit one person’s schedule, which is monitoring, after-hours, security operations, and overflow. The split is agreed in writing before we start.

At what headcount should we hire internally?

There is no clean threshold, but 60 to 70 users is roughly where a full-time person starts to be busy enough to justify the cost, and it comes earlier in plants, multi-site operations, and businesses with custom applications. Many companies at that size do both rather than choosing.

What if our internal person does not want help?

That reaction usually comes from being measured on ticket volume rather than on outcomes. In practice the work we take is the work nobody enjoys owning alone: 2 a.m. alerts, patch reporting, restore tests, and insurance questionnaires. We start by agreeing the split with them in the room, not around them.

Can we move between models later?

Yes, and it happens in both directions. Companies start fully managed and add an internal hire as they grow, and companies with one internal person move to co-managed when coverage becomes the constraint. Start at Become a Client and we can work through which one fits now.