You have outgrown your IT provider when your business changed and their model did not, which is a different problem from bad service. New headcount, a second site, a regulation, or one piece of software can do it.
Two very different conversations get filed under the same heading, and they need opposite answers.
The first one is “my IT company is letting me down.” Tickets sit. Nobody documented anything. The same printer that died in November dies again in March, and the person who fixed it the first time never wrote down what he did. If that is the conversation you are actually having, we have already written it twice, once as eight signs it is time to switch IT providers and once as five signs you need a new IT company. Go read whichever one matches your mood.
The second conversation sounds nothing like that. Your provider is fine. They were fine last year, they are fine now, and if you called them this afternoon somebody would pick up and be helpful about it. You like them. The trouble is that in the last eighteen months you added eleven people, signed a lease on a second suite across the river, and won a client whose contract has a two-page security addendum stapled to the back of it. None of that existed when the current arrangement was priced. Nobody dropped a ball. The fit just quietly stopped being a fit.
That second one is what this is about. Twenty-two years of running managed IT services across Rockland, Westchester, and Bergen, and I would put the fit conversation at least as common as the failure conversation. It is harder to name, though, because there is no villain in it. Firing a company that has been decent to you feels lousy, and owners put the conversation off for a long time on that basis alone. Understandable.
Outgrowing Is Not the Same Thing as Being Let Down
Outgrowing an IT provider means your requirements moved past their delivery model, not that their delivery got worse. Direction is the tell. A provider who is failing hands you the same problem back over and over. A provider you have outgrown meets problems for the first time, one after another, faster than anybody in that building can learn them.
Both feel identical from where you sit. Frustration does not come with a label on it. Owners routinely arrive with a long list of grievances that, once you sort them by date, trace back almost entirely to things the business itself started doing after the contract was signed. The list reads like evidence against the provider. Usually it is evidence of change.
So the question worth asking is narrow. Was the thing annoying you today inside the scope you signed, or did it turn up afterward while nobody redrew anything?
What Actually Changes When You Grow
Most owners assume a new obligation arrives in an envelope. It does not. It shows up the moment a number on your own books crosses a line somebody wrote into a rule years ago. Nobody sends a notice. You just cross it. Here are the lines that matter most for businesses our size in New York and New Jersey.
| What You Crossed | The Line | What It Switches On |
|---|---|---|
| Microsoft 365 Business seats | 300 across the whole Business family | Forced move to Enterprise licensing |
| Employees, holding NY private information | 50 staff, or $3M revenue, or $5M assets | SHIELD Act small-business scaling stops applying |
| Consumer records under the FTC Safeguards Rule | 5,000 consumers | Four written and tested controls, all at once |
| DFS covered entity thresholds | Passing all three at once, 20 staff and $7.5M revenue and $15M assets | Ten sections of Part 500 you were exempt from |
| Protected health information | No line at all | Applies at any size, scaled by size |
Microsoft is blunt about the first one. Business Basic, Business Standard, and Business Premium share a single tenant cap of 300 provisioned seats between them, and Microsoft’s own FAQ says organizations past that number “should consider subscribing to Microsoft 365 for enterprise plans.” Hire your 301st person and the licensing model you have run since the beginning is simply no longer available to you. That is not a service failure. That is arithmetic.
The regulatory lines are stranger, because two of them run backwards from what people expect. Under New York’s SHIELD Act, you count as a small business on any one of three tests, headcount under fifty, gross annual revenue under three million dollars in each of the last three fiscal years, or year-end total assets under five million. Any one of those keeps you in the scaled version of the standard, where safeguards get judged against your size and complexity rather than against a large bank’s. Grow past all three and that argument goes away. Nobody rings a bell.
New York’s Department of Financial Services rule works the same way, and it catches a lot of insurance agencies by surprise. A covered entity keeps its limited exemption if it meets any one of the three thresholds in section 500.19, fewer than twenty employees and independent contractors, under $7.5 million in gross annual revenue in each of the last three fiscal years, or under $15 million in year-end total assets. You only lose that exemption when all three stop being true at the same time. Ten sections of Part 500 that never applied to you before switch on the day it happens. Go check your own numbers.
Accounting and tax practices have the sharpest line of the lot. The FTC Safeguards Rule’s exceptions section says a firm holding customer information on fewer than five thousand consumers does not have to do four specific things. A written risk assessment. Continuous monitoring, or annual penetration testing paired with vulnerability assessments twice a year. A written incident response plan. An annual written report to the board or governing body. Buy a retiring colleague’s book of business, cross five thousand, and all four land in your lap in the same week. Your provider did not change. Your file count did.
HIPAA is the exception that proves the whole point. The Security Rule has no floor. Two people or two hundred. It scales formally, by “the size, complexity, and capabilities” of the entity, but it never switches off, which means a two-person practice and a forty-person practice owe the same duty at different depths. Growth does not create that obligation. It just makes the shallow version stop being defensible.
A Second Location Is a Different Business, Not a Bigger One
Adding a site does not multiply your IT. It changes the shape of it, which is a much harder thing for a provider to absorb quietly. The animal changes.
One office is one network, one internet circuit, one set of physical keys, and one place where every problem lives. A second office means somebody has to answer questions that genuinely never came up before. Which site holds the file server, or whether either of them should. What happens at site two on the morning site one’s circuit goes down. Whether the phone system follows people or follows desks. Who gets in the car when something needs hands on it, and how long that drive takes in traffic at four in the afternoon. That last one matters.
Providers who are excellent at one office often have no model at all for the second one, and the honest ones will tell you so if you ask directly. The answer to listen for is “we will figure it out when it comes up.” Nobody is bluffing when they say that. What they are telling you, accurately, is that multi-location IT support was never in the scope either of you signed, and it is the moment to decide whether you are re-scoping or shopping.
When You Hire Your Own IT Person, the Job Description Changes
This one blindsides owners more than any other trigger on the list. You finally hire an internal IT person, everybody is relieved, and within six months the relationship with your provider has gone tense for reasons nobody can quite articulate.
The mechanism is not mysterious. The provider’s job changed the day that person started and nobody rewrote it. An outsourced team that used to own everything is now sharing a queue with someone who sits in your building, hears about problems first, and has already tried three things before the ticket gets opened. Either the split gets written down, meaning who owns identity, who owns backups, who takes after-hours escalations, who is allowed to touch the firewall, or both sides start guessing and stepping on each other. A co-managed IT arrangement is the contract that exists for exactly this. Sometimes the same provider. Always a different agreement.
The Application That Quietly Became the Business
Somewhere along the way one piece of software stopped being a tool and became the place where the work actually happens. A practice management platform. An ERP. A scheduling system the whole field crew lives inside all day.
General IT support and that application’s care and feeding are two different jobs, and most providers were only ever hired for the first one. The question worth asking is not whether they support it, because everyone says yes to that. Ask who they call at the vendor when it breaks. Get a name. Ask what happened the last time an update broke an integration. If the honest answer is that you ended up on the phone with the vendor yourself while your IT company waited to hear how it went, you already know where this is going.
Three Things I Watch For
When an owner asks me how they would know, these are the three I actually name, and each of them can be either conversation depending on which way it points.
How long a ticket sits. If you open one and wait, there are only three explanations, and it is worth working out which. They are too busy for you. They do not care. Or they do not have the staff for it. The middle one is a failure problem and you should go read the other two articles. The first and the third are outgrowing problems, because both of them mean the same thing underneath: you have become a larger account than their model was built to carry.
The same problems, over and over, with nothing structural behind the fix. Recurring incidents are not the signal on their own. The signal is whether anybody is putting something in place so it stops recurring, or whether each one just gets patched as it comes along. A provider fixing things as they arrive and never implementing anything to change the pattern is telling you where the ceiling is. That is time to move on.
Friction that does not attach to any one incident. This is the vaguest one and the most reliable. Frustration with the way a company does things adds up, and it is often nobody’s fault at all, just a culture or a process that stopped matching yours. If the fit is wrong and there is always friction, that is worth acting on even when you cannot point at a single thing that went badly. Especially then.
Fit or Failure? A Short Test
Five questions. Answer them honestly, nobody is watching.
- Is the thing bothering you something they were hired to do, or something that appeared after they were hired?
- When you describe a new requirement, do they push back on the requirement itself, or only on the timeline?
- Has anything material about the business changed since the last time anyone actually re-read the contract?
- Would a bigger version of the same provider solve this, or do you need a different kind of provider entirely?
- If every open ticket got closed tonight, would tomorrow’s problem still be sitting there waiting?
Mostly “appeared after they were hired” and “still sitting there waiting”? That is fit, and switching for the sake of switching will land you in the same spot with a new logo on the invoice. Mostly the other way around and it is service quality, which is a different repair with a different guide, linked at the top of this page.
Three Honest Ways This Ends
Only one of the three ends with you hiring somebody new. The other two are cheaper, and the first one gets skipped more than the other two combined.
Re-scope with the provider you already have. Put every change in front of them in one sitting. The headcount, the second suite, the client contract with the security language, the application that ate your operations, all of it at once rather than dribbled out one at a time across eighteen months, because a provider hearing about the fifth change in isolation has no way to see the shape of the first four. Then ask flatly whether their model covers it. Some will say yes and mean it. Others will go quiet, which is also an answer. A real vCIO and strategic IT planning conversation, done on an annual rhythm rather than never, catches most of this well before it turns into a crisis.
Add a layer instead of replacing one. Co-managed exists for the awkward middle, where the provider is good and simply is not enough on their own anymore. You keep the institutional memory. You buy the depth. Nobody gets fired for being adequate.
Move. Some models genuinely cannot stretch, and another year of dragging it out costs more than the transition would have. Do it deliberately if you go that way. Switching without a painful transition is a discipline of its own, and the businesses that get burned are almost always the ones who treated the handoff as an afterthought rather than as the actual project it is.
For whatever it is worth as a data point, VJNetworks has held a 97% client retention rate over more than 20 years, managed IT starts at $995 a month for the 5 to 60 employee range we work in, and my team responds within 15 minutes during business hours. None of which decides your answer. The argument is that “have we outgrown them” is a real question with three real answers, and only one of them involves a phone call to somebody like me.
What Owners Ask Me About This
Can you outgrow a provider who has never actually done anything wrong?
Is there a headcount where this becomes real?
Our provider says they can handle the second location. How do I check?
Is co-managed just a polite way of firing half your provider?
We got acquired. Does that settle it for us?
What does it cost to figure out whether this is fit or failure?
A free assessment from VJNetworks maps what your business needs now against what your current setup was built for. You keep the findings either way, and there is nothing to sign.