Co-Managed IT Explained: How It Works, What It Costs and When It Fits

Co-managed IT is an arrangement in which your own IT employee or small team works alongside an outside managed service provider (MSP) that supplies tools, extra staff, security monitoring and after-hours coverage. It fits companies that already employ one to several IT people but cannot afford to build a full security and operations team themselves. Pricing is usually lower per user than fully managed IT because your staff handles the first line of support, but the contract must say clearly who is responsible for what.

How co-managed IT works

In a fully managed model, the provider is your IT department. In a co-managed model, the provider is a partner to the department you already have. The division of labor varies, but common patterns include:

• Internal staff handle: employee requests, onboarding and offboarding, hardware setup, vendor relationships, and knowledge of line-of-business software.
• Provider handles: remote monitoring and management tooling, patch automation, security monitoring and response, backup management, after-hours alerts, advanced troubleshooting and project capacity.

The goal is to avoid paying for the same work twice while filling the gaps that a small internal team cannot cover: nights, weekends, vacations and deep specialist skills.

Typical reasons companies choose it

1. The IT person is overloaded or a single point of failure. One employee cannot cover every shift or every technology.
2. Security needs have outgrown internal tools. Detection, response and compliance reporting need software and expertise that are costly to build alone.
3. Growth. A company going from 50 to 150 employees may need more capacity quickly without hiring multiple people.
4. Project spikes. A cloud migration or office move needs extra hands for a few months.
5. Cost control. The company wants to keep a skilled internal person and avoid the cost of a full provider package.

What pricing looks like

Co-managed agreements are often priced per user or per device at a lower rate than fully managed plans because the provider is not running the help desk. Commonly the fee covers a tool stack plus access to the provider's engineers, with separate pricing for projects or for security operations.

Illustrative arithmetic: assume an organization with 80 users.

On those assumptions the combined co-managed cost (about $15,400 per month) is higher than fully managed ($11,200), which is the reason co-managed is not automatically cheaper. It is justified when the internal person delivers value the provider cannot, such as on-site presence, institutional knowledge and quick response, or when workload would overwhelm a purely outsourced setup. Test numbers with the estimator, choosing the co-managed range.

The responsibility matrix

The most important document in a co-managed agreement is a written split of tasks, often called a RACI or responsibility matrix. Ask for one that lists, for each activity, who is responsible, who is accountable and who must be consulted. Items to include:

• User account creation and removal.
• Patch approval and scheduling.
• Backup configuration, monitoring and restore testing.
• Security alert triage and incident response.
• Firewall and network changes.
• Software licensing and renewals.
• After-hours escalation: who is called, in what order, within what time.
• Documentation updates after changes.
• Vendor contact for internet, phone and line-of-business software.

Advantages

• Keeps institutional knowledge in your company.
• Gives your IT person tools and backup they could not buy alone.
• Adds security depth and after-hours coverage.
• Scales up or down more flexibly than hiring.

Drawbacks

• Paying for both an employee and a provider.
• Friction if your staff see the provider as a threat; involve them in selecting it.
• Risk of duplicated or missed work without a clear matrix.
• Tool and access complexity: the provider needs administrative access, which should be controlled and logged.

Questions to ask a provider offering co-managed IT

• Will you integrate with our existing tools or require yours?
• What access do you need, and how do you secure and audit it?
• What happens if our IT person leaves? Can you step up to full management, and at what price?
• How are escalations handled at night and on weekends?
• Can you supply a sample responsibility matrix and a sample monthly report?
• What does onboarding involve for a team that already has documentation?

Frequently asked questions

Is co-managed IT only for large companies?

No. It works for companies with as few as one internal technician, though the arrangement is most common between roughly 30 and 500 employees.

Can co-managed IT become fully managed later?

Often yes, and some providers structure contracts to allow it. Ask for the conversion pricing in writing before you sign.

Who is liable if something goes wrong?

Liability depends on the contract and who owned the task. This is another reason for a clear matrix and for reading the limitation-of-liability clause, ideally with an attorney.

Does co-managed IT include security operations?

Sometimes. Many co-managed plans sell security monitoring separately. Confirm what tools are included and whether people monitor alerts around the clock.

Sources and further reading

• Cybersecurity and Infrastructure Security Agency — guidance on roles and responsibilities in cyber risk management.
• NIST — Cybersecurity Framework, which helps divide security functions between teams.
• Small Business Administration — resources on staffing and operating a growing business.