You already have somebody. They are good, they are busy, and they cannot be awake at three in the morning or on a beach in July. Co-managed is the arrangement that fills those gaps without taking their job away.
The internal IT person at a firm of forty is expected to cover a help desk, a network, a security program, a project schedule and a vendor list. That is four jobs in one calendar, and the first one to slip is always the one with no deadline attached.
The hours nobody covers
Overnight, weekends, the two weeks in August. An internal team of one or two has no rotation, and everyone quietly hopes nothing happens while they are away.
The tooling bill
Monitoring, patching, backup, phishing training and a security operations center priced for one firm are hard to justify. Priced across a portfolio they are ordinary.
The second opinion
A capable person working alone has nobody to check their plan against. That is a professional problem before it is a technical one, and most of them feel it.
The split
Eight places the line has to be drawn
Co-managed goes wrong when nobody wrote down who owns what. Each of these is agreed before we start and put in the agreement, so the answer at 2 AM is already decided.
Who answers the phone
Usually your person, because they are down the hall and they know whose spreadsheet matters. We take overflow, the tickets nobody has time for, and everything outside working hours. Some firms invert it and send all first-line to us so their person is never interrupted. Both work, as long as it is written down.
Who is authorized to pull the plug
The single most important line in the agreement. When a machine starts encrypting files at midnight, somebody has to isolate it without waiting for a meeting. We ask for that authority in writing, with a named list of who gets called immediately afterward. A firm that will not grant it should say so up front, and we will plan around a slower answer.
Whose tools, and who can see them
We bring the monitoring, patching, backup and security stack, and your person gets a login to all of it. They see the same console we do, live. If they can only see what we choose to show them, you have hired a supplier, whatever the agreement calls it.
Who holds the administrator accounts
You do. The tenant, the domain name and the top-level accounts stay in the firm's name with your person holding them, and our access is granted rather than owned. That is how it should work with any provider, and it is worth checking against whoever you use today.
Projects, and who runs them
A server replacement or an office move eats a quarter of an internal calendar and stops everything else. We take the project so your person keeps the day running, or we work under them if they would rather lead it. Either way the plan is written and the hours are quoted, so a project never quietly becomes overtime.
Documentation, and where it lives
One record of the environment that both sides write into, held somewhere the firm owns. Two half-complete sets is the usual failure, and it shows up during an incident or an audit. This is also the answer to what happens if your person leaves, and it is worth having even if you engage nobody.
Vendors, and who chases them
Circuits, phone systems, the design or accounting package your work depends on. Sitting on hold is the lowest value hour in your internal person's week, so it usually comes to us. They keep the relationships worth keeping, particularly with the application vendors who know your configuration.
Strategy, and who sits with the owner
Both of you, in the same room. Your adviser brings what we see across other firms of your size and the budget shape for the next two years; your person brings what they know about your business that no outsider can. Be wary of a provider who books that meeting without your internal person in it.
Common shapes
Three arrangements that work
Most firms land on one of these. You can start at the first and move along it, and plenty do.
Lightest
Cover the gaps
Nights, weekends, vacations and sick days. Your person owns everything else. The cheapest way to stop a firm depending on one human being's calendar, and the usual starting point.
Most common
Security and tooling to us
We carry monitoring, patching, backup, the security operations center and the overnight response. Your person keeps the help desk, the applications and the relationships. Two roles inside one environment, with a written plan covering both.
Fullest
Their team, our bench
For firms with two or three internal staff who want depth behind them: an adviser, project engineers, and specialists for the work that comes up twice a year. Their people lead, ours are on call.
The conversation worth having
What your IT person gets out of this
If they think this is the first step toward replacing them, it will not work, and they will be right to be wary. So we say the following to them directly, on the first call, with you in the room.
A vacation where the phone stays off
This lands harder than anything else on the list. Being the only IT person at a firm means never taking a week off without a laptop. Cover with a documented handover means the week is actually a week, and the firm stops carrying a risk it never priced.
Tools they could never get signed off alone
A security operations center, proper endpoint detection, immutable backup, phishing simulation, a password platform. Every internal person has asked for some of this and been told the number is too big for one firm. It arrives with the arrangement, and they get the console.
Somebody to check their thinking
Working alone means every design decision goes unreviewed until it fails. Our engineers see the same problem across a lot of firms in a year, and that is worth something to a capable person with no colleague to argue with.
The boring work off their desk
Patch chasing, warranty lookups, hold music, the leaver checklist. None of it is why they took the job, and all of it fills a week. They keep the part that needs somebody who knows your business, and that is the part that gets them promoted.
In practice
What it looks like when it is working
Taylor Engineers, end of life servers
Their IT lead had the replacement on his list for two years and no quarter free to do it. We ran the project alongside him. It finished without taking over his calendar, and he kept the environment he is accountable for. No dramatic number attached to this one, which is the point: the work was overdue rather than on fire.
When co-managed is the wrong answer
When the internal person is leaving inside six months, since you are buying a handover and not a partnership. When nobody internally has authority to agree the split, because the arrangement then has no owner on your side. When the real problem is that the person is not up to the job, that is a management conversation and not something a provider should be hired to have for you. We would rather know that on the first call than deep into an agreement.
Common questions
Is this a step toward replacing our IT person?
Not from our side, and we will say so with them in the room. If you are considering it, have that conversation before you call us, because an arrangement built on an unspoken plan poisons quickly and your person will sense it long before anybody admits it. Where a firm does eventually move to fully managed, it is usually because the person moved on for their own reasons.
How is it priced against fully managed?
A monthly figure, lower than fully managed because you keep the help desk, and driven by which of the eight splits above come to us. Projects are quoted on their own. The saving is smaller than people expect, because the tooling and the overnight cover are most of the cost and neither gets cheaper when you keep the day shift.
Our IT person already has tools they like. Do those go?
Some stay, some go, and the test is simple: can we be accountable for a result while looking at somebody else's console. Monitoring and endpoint security generally have to be ours, because we are the ones answering at three in the morning. Ticketing, documentation and application tools are theirs to keep if they work.
What happens when the two of you disagree?
We write down both positions and the risk each one carries, and you decide. It is your firm and your money. We will not go around your person to an owner. That is how these arrangements die. If a disagreement is about something we consider unsafe, we put that in writing and you still decide.
Can you cover a maternity leave or a gap between hires?
Yes, and it is a common way firms start with us. A fixed term with a defined scope and a handover pack at the end, so the returning or incoming person inherits a documented environment. Several of those have turned into longer arrangements, and a few have ended there, which is a fine outcome.
How fast do you respond, and to whom?
The same arrangement that applies to every agreement. A critical security alert is picked up overnight and at weekends by the partner security operations center. Tickets carry a fifteen-minute first-response commitment during weekday hours from our help desk, and that one is written into the agreement. In a co-managed arrangement the security one usually reaches your person and us at the same time, with the escalation list agreed in advance. The managed IT page sets both out in full.
Bring your IT person to the first call
Fifteen minutes with both of you. They will have sharper questions than you do, and how a provider answers those in front of you tells you most of what you need to know.
