Co-Managed IT vs Fully Managed IT: Which Model Fits Your Business

Fully managed IT means an outside provider runs your whole IT function. Co-managed means you keep internal IT staff and hand a provider defined pieces of the work. What decides it is who you already employ, not price.

Owners ask me which one costs less. Every time. That is the wrong opening question and I usually say so on the call. What actually settles it is who is already on your payroll, what those people spend their day doing, and whether a regulator or an insurer expects a name on your side of the table. That is the whole framework.

If the co-managed idea is new to you, read our explainer on what co-managed IT actually is first, then come back here. This post assumes you already know both models exist, and that what you are really trying to settle is what shape your own company is, given the people you employ, the tickets those people field every week, and whatever an insurance renewal is going to ask you to prove next year. VJNetworks runs both, fully managed IT and co-managed IT. The framework below is the one I walk owners through before anybody quotes anything.

The Deciding Input Is Scope, Not Budget

Sit with your internal IT person for one week and write down every ticket. One week. Every ticket. The top of that list barely moves between companies. Passwords first, always. Printers second. Ask any IT person what the single most annoying thing to troubleshoot is and they will say printers, one hundred percent. Then things that vanished, an email or a folder that was there an hour ago and is not now. Then Outlook. Then QuickBooks, which along with Outlook throws more application problems than anything else people run. That is the list.

None of that work needs a specialist. Not one item on it. What it needs is somebody who knows your office, your history, your vendors, and which user reports the computer as broken when the monitor is switched off at the wall.

Now look at what did not make the list. Patch verification. Restore testing that proves a backup comes back and not just that a job finished green. Microsoft 365 security settings that ship switched off and stay off. Documentation of why the firewall is configured the way it is, sitting somewhere other than one person’s memory. Those items lose to the printer every single day, and not because your IT person is bad at the job, but because any human being with a ticket queue triages toward whoever is standing at their desk looking upset. The printer wins. It always wins.

That gap is the entire argument for co-managed. Its absence is the entire argument for fully managed. Everything else is detail.

What Each Model Is Actually Built For

Eight inputs decide this in practice. Run your own company down the left column and see which side you land on more often. Nobody scores eight for eight. Nobody needs to.

Six or more on one side and the answer is obvious. Four to four is the interesting case. The tiebreaker there is almost always the person, and if you have somebody internal worth keeping, keep them and build the arrangement around them rather than choosing a model on paper first and then asking a real employee to fit inside it.

Compliance Can Overrule the Headcount Answer

Every compliance framework I have worked through is built on the same handful of things. The names change, the controls underneath barely do. There is one place where two of them converge so precisely that it is worth reading the actual text before you choose a model, because between them they quietly rule out one very popular version of the fully managed pitch.

The FTC Safeguards Rule requires a covered business to designate a Qualified Individual to oversee its information security program. That person is allowed to work for a service provider. Read the rest of the sentence though. 16 CFR 314.4(a) says that when you use one, you retain responsibility for compliance, you designate a senior member of your own personnel responsible for direction and oversight of that individual, and you require the provider to maintain a program that protects you to the same standard.

New York wrote it almost identically. 23 NYCRR 500.4 lets a third-party service provider hold the CISO role, then makes the covered entity retain responsibility, designate a senior member of its own personnel for direction and oversight of that provider, and require the provider to run a cybersecurity program that protects the entity to the same standard. Two different regulators, near-identical wording, same conclusion. Read that twice.

So here is the rule of thumb nobody prints in a sales deck. A regulated company never gets to fully vacate the seat. You can outsource the work. The accountability does not travel with it.

That does not automatically mean co-managed. Far from it. A single-office accounting firm with no technical staff can satisfy the requirement by naming its managing partner as the senior person responsible for oversight and buying fully managed underneath, which is an ordinary arrangement and a compliant one, provided that partner actually reads what comes back. What it rules out is the version of fully managed where you hand everything over and stop thinking about it, whatever a proposal promises. If your firm is working through the Safeguards Rule specifically, our Safeguards Rule checklist goes through the control side of it.

The Money Question, Answered Honestly

Fully managed carries a published floor because the scope is broadly the same for everybody who buys it. VJNetworks publishes $995 a month as the fully managed starting point. Co-managed gets scoped instead. What you need there depends completely on what already exists in the building.

A firm with solid help desk coverage and nothing on security needs close to the opposite engagement from a firm that has security handled and nobody available after five. Your starting point drives it. What is already implemented, what is genuinely missing, how many people you have. Our full breakdown of what managed IT costs across Rockland, Westchester, and Bergen covers the fully managed side in detail.

Run the in-house math too, because owners rarely do it out loud. The Bureau of Labor Statistics put the May 2025 median wage for computer user support specialists at $61,860. Network and computer systems administrators came in at $99,130, against a $50,980 median across all occupations. So your first IT hire, the generalist who resets passwords and fights the printer, is affordable for a lot of twenty-person companies. The second hire, the one who actually understands firewalls and identity, roughly doubles that line and usually is not affordable at all.

There is the real crossover, and notice that it is a crossover in skills rather than in headcount. Plenty of companies can carry one IT person and cannot carry two, and that is true at twenty people and still true well past a hundred. I would not put a number on where it flips, because I have watched it flip in both directions at the same headcount. What I would say is that a single generalist, whatever your size, is a bet on one person never getting sick, never taking a holiday and never resigning.

One more number worth sitting with. BLS projects computer support specialist employment to fall three percent from 2025 to 2035, and network and systems administrators four percent, naming outsourced services among the reasons. It still projects roughly 48,700 support specialist openings a year, almost all of them replacing people who left rather than adding jobs. Two things follow. The role is not going away. Replacing yours when they leave is not getting easier either. Plan for both.

Almost Nobody Is Actually Trying to Replace Their IT Person

Worth saying plainly, because the way this question gets written about online does not match what walks through the door. In twenty-two years the conversation about dropping a competent internal IT person and handing the whole function to a provider has come up once. Once. And in that case the person was genuinely not good at the job, which is what was really being decided.

Everywhere else, the company already has somebody internal who is good, and they have no intention of losing them. They want that person to have help. If you are reading this weighing whether to replace someone, the honest answer is that the model is not your question and you should go and settle the other one first. If you are reading it because your good person is underwater, that is what co-managed is for, and the split below is the whole of it.

Growth Moves the Answer Faster Than Anything Else

Ask what the next eighteen months look like before you sign either one. Not the last eighteen. The next.

There is a real difference between one company with five locations and five separate companies, and owners conflate them constantly. One central office, one ownership structure, spokes on a wheel. That is a management problem with a clean answer and it usually runs cheaper per site. Five independent businesses that happen to share an owner is a different animal entirely, because each one carries its own directory, its own line-of-business software, its own vendor relationships, and its own opinions about how things ought to be done.

Companies mid-expansion usually do better on fully managed for a while, because the provider absorbs the churn of new sites and new users without you hiring ahead of growth you have not banked yet. Companies that are flat in headcount with somebody good in the seat usually do better co-managed. An acquisition can flip the answer inside a few months. Pick for the org chart you are about to have. Not the current one.

The other thing growth does is expose whichever function nobody owns. Help desk load rises with headcount more or less in step, so help desk coverage tends to break first and loudly. Security and roadmapping break quietly, months later, and cost more to fix. Our vCIO strategy and roadmapping work exists mostly because the person firefighting all day has never once had a clear afternoon to plan anything.

The Chooser

Three lists. Be honest on the third one.

Pick fully managed if

• You have nobody internal. Or your only IT person just gave notice and you are not replacing them.
• A predictable monthly number matters more to you than precision. This is the model that has one.
• Everything is behind. Not one thing, everything, from patching to backups to documentation to whatever that unlabeled box in the closet does.
• You would rather hold one accountable phone number than manage a split.

Pick co-managed if

• Somebody internal is worth keeping and they know why the third-floor switch is wired the way it is.
• You can name the gaps. Security. After-hours. Restore testing. Documentation. Named gaps can be scoped. Vague dissatisfaction cannot.
• A regulator expects a named person on your side and you would rather add depth beneath them than replace them.
• Your IT person asked for this. That happens more often than owners expect, and it is the best starting condition there is.

Sign neither one yet if

• You are quietly hoping a provider will manage your IT person out for you. They will work that out inside a month and you will have bought a worse version of both models.
• Nobody has written down who owns what. Vague splits are the most common way a co-managed arrangement comes apart, and I have never seen an exception.
• Nobody has looked at what you actually have. An honest scope starts with an assessment, not a proposal.

Most Companies Do Not Stay in One Model Forever

These are not opposing teams. Businesses move between them, usually because of a person rather than a strategy. Some VJNetworks clients started co-managed and widened the scope over time, while others have stayed co-managed for years because that is genuinely the right shape for how they are staffed, and both of those are correct answers rather than stages on the way to one.

Fully managed to co-managed happens when a company grows into its first internal hire and wants to keep the depth it already has. Co-managed to fully managed happens when that internal person retires, relocates, or takes a better offer, and suddenly the split has one empty side. Both transitions go easier when the provider already knows the environment, which is a genuine argument for choosing one, letting somebody spend a year learning your setup properly, and then adjusting the split later when your staffing changes, rather than optimizing the original decision to death and switching providers every time the org chart moves.

If what actually worries you is depending on a single person, whether that person is yours or a small outside shop, we wrote about the risks of a one-man IT shop separately. That is a sharper version of the same problem and it deserves its own read.

What Owners Ask Before They Pick

One last thing worth saying plainly. Almost every owner I talk to has already decided, and what they want is somebody to check the reasoning rather than sell them the other one. If you want that check, start the conversation with our team and we will tell you honestly which way your setup points, including when the answer is that you are fine as you are. That happens. We say so.