Co-managed IT is an arrangement where your own technical staff keep running the environment and an outside team carries the parts that do not fit inside one calendar. It makes sense when a firm has one or two capable people and a workload that outgrew them, which is most firms between twenty and a hundred staff. The ten advantages below are the reasons it holds up, but the sections before them are the ones worth reading first, because the arrangement only works where the split is written down.
What are co-managed IT services?
Your internal person, or small team, stays in place and stays accountable for the environment. An outside team takes named pieces of the work and a written agreement says which pieces those are. Nobody is replaced and nothing is handed over wholesale.
In practice the outside team usually carries the things that need either a rotation or a portfolio behind them: overnight and weekend cover, security monitoring, patching, backup, and the tooling that costs too much for a single firm to carry alone. The internal person usually holds the help desk, the applications, the vendor relationships and the institutional knowledge that no agreement can transfer.
That is the usual shape and not the only one. On some accounts the help desk comes to the outside team and the internal person keeps the project work and the vendors. The line can sit in several places. It has to sit there on purpose, and it has to be written down.
When does co-managed IT make sense?
Four situations account for most of it.
The work has outgrown the person. One technical employee at a company of forty ends up owning support, infrastructure, security and every project at once. Something has to wait, and what waits is whatever carries no date. What that costs is set out below.
A growth year. Headcount rising faster than the onboarding process was built for, a second office, an acquisition. Growth breaks informal arrangements before it breaks formal ones, which is the pattern behind scaling IT for growth.
A project with a date on it. A server replacement, a cloud migration, an audit, a compliance deadline. These are the jobs that sit on an internal list for two years because no quarter is ever free.
A skill nobody on staff has. Not a gap in competence, a gap in coverage. A capable generalist is not also a security analyst, and hiring one for a firm of forty is difficult to justify.
There is a fifth situation worth naming because it is the one people get wrong: co-managed is not a soft way to begin replacing somebody. If that is the plan, have the conversation first. People work out what is coming well ahead of the announcement, and an arrangement that starts there never recovers.
What does it cost to leave one person carrying it?
Most of the risk sits in one head. Admin credentials, how the network was put together and why, which fixes were tried last time: when one person holds all of it, a vacation, an illness or a resignation becomes an outage nobody else can diagnose.
The second cost is the work that never starts. A week spent resetting passwords and fixing printer drivers is a week nobody looks at the server due for replacement or the process that could be automated. The hours stay fixed while the environment keeps growing.
The third is wear. One person cannot be on call around the clock for long, and a tired technician is more likely to miss something in a security log.
The fourth is shadow IT. When requests queue up, staff find their own tools: unapproved apps, company files in personal cloud accounts. Leadership believes the environment is under control while the data spreads out of view.
Hiring a second senior person is the obvious answer, and often the unaffordable one. Senior IT salaries in the Bay Area are high before benefits and overhead are added, and for a company of forty a second full-time hire is rarely in the budget. That is the gap co-managed IT is built to fill.
Internal-only, co-managed or fully managed?
Start from what your internal technical staff spend their week on, and from what happens during the weeks they are not there.
| Internal only | Co-managed | Fully managed | |
|---|---|---|---|
| Who answers at 7pm | Your person, on their phone, at home. | Whoever the agreement says, with the escalation list settled in advance. | The outside team, every time. |
| What the week looks like | Tickets first, projects last. The work with no deadline waits. | Your person keeps the work that needs to know your business, and hands off the work that does not. | There is no internal week to plan. |
| Adding capacity means | A hire, a search, and several months before it helps. | Moving a line in the agreement, usually inside a month. | A change of scope with the same provider. |
| Two weeks in August | Nobody is covering. Everyone hopes it stays quiet. | Covered by the half of the split that does not take leave at the same time. | Covered. |
The co-managed IT services page compares the same three arrangements from the buying side, including where each one stops working.
How are responsibilities actually split?
Badly drawn splits fail in a predictable way. Both sides assume the other has something, and the thing nobody owns is discovered during an incident. Three examples of a line drawn properly:
Monitoring and response. The outside team runs the monitoring and holds the first response on a critical security alert at any hour. Your person is on the same notification, and the escalation order is agreed before anything fires. Both know at 2am who is already awake.
Patching and change. The outside team patches on a published schedule. Your person holds the veto on anything that touches the application the business cannot be without, because they are the one who knows that a Tuesday reboot lands in the middle of payroll.
Accounts and access. Whoever owns joiners and leavers owns it completely, including the checking. Split it and the leaver keeps their access, which is the single most common finding in a security review of a firm this size.
The pattern is that each line has one owner and a named person on each side who can agree to move it. An arrangement with no authority on the customer side has no owner at all, and that is the version that fails.
What do you get out of it?
Ten things, in rough order of how often they are the reason a firm calls.
1. Cover for the hours nobody is working
Nights, weekends, holidays and the two weeks somebody is away. Two people cannot run cover between them, and the cost of that stays invisible until the week it does not.
2. Tooling priced across a portfolio
Endpoint monitoring, patch management, backup, security awareness training and an analyst on call all cost less per company when they are bought across many. This is the plainest argument in favor of the arrangement and usually the first one a finance director accepts.
3. A second opinion on the plan
Someone working on their own has no one to test a decision against before it is made. It is a professional problem more than a technical one, and most good technical staff raise it themselves when asked.
4. Capacity that moves in weeks
Adding a line to an agreement takes a conversation. Adding a person takes a search, an offer, a notice period and a ramp.
5. Depth for the rare jobs
A firewall replacement, a migration, an audit response. Work that is too infrequent to hire for and too consequential to improvise.
6. Security attention that does not depend on a quiet week
Cisco’s 2024 Cybersecurity Readiness Index, which surveyed more than 8,000 security and business leaders across 30 markets, found that 73% of respondents expect a cybersecurity incident to disrupt their business in the next 12 to 24 months. Security work is the first thing to go when the ticket queue is long, because nothing on it is due on a particular day.
7. Patching and maintenance on a schedule somebody publishes
The unglamorous work that prevents the call. It gets done when it belongs to somebody whose week is not being interrupted by tickets.
8. Documentation that survives a resignation
Much of what a long-serving internal person knows exists only in their head. Writing it down is a project nobody schedules, and it is worth more than any tool on this list.
9. Your technical staff back on the work you hired them for
Most internal people were hired to improve the business, then absorbed into keeping it running. Handing off the routine is what gives that time back.
10. A plan with dates and figures on it
What is aging out, what needs replacing and roughly when. Not a report nobody reads, a short written plan you could hand a board.
How do you work out whether it fits?
Five steps, in order. None of them require you to know anything technical.
1. Count the calendar. Ask your technical staff what percentage of last month went on tickets. If it is above seventy and projects are slipping, the arrangement is already broken and you are paying for the slippage in delayed work.
2. Name what only they know. If they resigned tomorrow, what leaves with them. Write the list down. It is usually shorter than feared and more alarming than expected.
3. Ask what they would hand over. Do this before you ask anybody outside. A good internal person will name the same things every time: the overnight cover, the patching, the tooling they cannot get budget for.
4. Price both sides honestly. Add the internal salary to the co-managed quote, then set that total beside a fully managed quote standing on its own. Sometimes the second number wins, and writing both down is the only way to find out. Our IT spending benchmark gives the ranges by sector and headcount.
5. Put the split in writing before you sign. Every line assigned, with the authority to change it named on both sides. If a proposal will not be drawn to that level of detail, that is the answer.
What happens when the two sides disagree?
It comes up, and the agreement should say how it resolves before it does. In practice the person accountable for the environment holds the final call on anything affecting the applications the business runs on, and the outside team holds it on the security tooling they are answering for at 2am. Everything else is a conversation.
Two questions that come up on every first call, whether the internal person is replaced and what happens to the tools they already use, are answered on the service page rather than repeated here.
Where to start
Run the five steps above before you speak to anybody, including us. A firm that arrives with the split already sketched gets a better agreement, because the sketch is evidence of what it wants to keep.
Our own answers sit on the service page, including the three situations where we would tell you this is the wrong arrangement. If you would rather work through it with your technical staff in the room, that is the conversation we prefer to have anyway.