Managed IT Services Without the Contract

What “managed” actually covers on an ordinary Tuesday

The confusing thing about managed IT is that when it is working, you see almost none of it. The visible part — someone answering a ticket about a printer — is maybe a fifth of the labour. The rest happens on machines nobody is sitting at, usually between 1am and 5am, and its whole purpose is to stop tickets from being created.

Patch management on a defined cycle

Microsoft ships security updates on the second Tuesday of every month. Third-party software — Chrome, Adobe Reader, Java, Zoom, QuickBooks, the browser plugins nobody remembers installing — ships on no schedule at all, and that is where most real-world exploitation happens. Under a managed agreement, patches are tested against a pilot group, deployed in a ring over the following week, and verified. Machines that failed to apply an update show up on a report rather than sitting quietly unpatched for eleven months. The gap this closes is measurable: the majority of successful breaches at small companies exploit a vulnerability that had a patch available well before the attack.

Monitoring alerts that fire before anyone notices

An RMM agent on each endpoint and server reports a stream of health signals. The ones worth acting on are unglamorous: a C: drive crossing 85% full, S.M.A.R.T. attributes on a disk showing reallocated sectors, a server that has rebooted three times unexpectedly in a week, antivirus definitions more than 48 hours stale, a critical Windows service that stopped and did not restart, a UPS reporting a failing battery. Each of these has a window — usually days — between the first warning sign and the outage. Managed IT lives inside that window.

Backup verification, not just backup software

Backup jobs fail silently more often than anyone expects — a changed password, a full destination, a VSS writer error. Verification means someone reads the job results every morning, confirms the restore point exists, and periodically performs an actual test restore of a real file or a whole system image. A backup nobody has restored from is a hypothesis, not a safety net.

The rest of the invisible list

• Asset inventory: every device, its age, warranty expiry, specification and assigned user — so hardware refresh is budgeted rather than emergency-purchased.
• Licence management: matching Microsoft 365 and line-of-business licences to actual headcount. Companies routinely pay for 4–6 seats belonging to people who left.
• Onboarding and offboarding: a repeatable checklist so a new hire has accounts, mailbox, licences and shared-folder access ready on day one, and a leaver loses all of it within the hour.
• Vendor liaison: dealing with the ISP, the phone provider, the practice-management or POS software vendor. Somebody has to sit in that hold queue; better it is not the owner.
• Documentation: network diagram, IP scheme, admin credentials in a password vault, recovery procedures. This is what makes you portable rather than hostage to whoever set things up.
• Quarterly business review and roadmap: ticket trends, aging equipment, security posture, and what should be budgeted in the next 6–12 months — the vCIO function, scaled to a company that will never hire a CIO.

Break-fix, block hours, or fully managed — the real cost for a 10-person company

Break-fix looks cheapest right up until the year you have a bad year. Hourly rates in the US run roughly $125–$175, emergency and after-hours work bills at 1.5×, and the incentive structure is upside down — the provider earns more when things break more. Block hours (buying 10 or 20 hours up front at a discount) soften the rate but keep the same incentive, and unused hours often expire.

Two things matter more than the arithmetic. First, the flat-rate column does not move, which is the only one of the three you can put in a budget. Second, none of these figures include downtime. Ten people unable to work for a day is roughly $2,000–$4,000 of paid salary producing nothing, before you count the customers who called and got nowhere.

What an SLA should actually promise

A service level agreement that only mentions “response time” is telling you when someone will acknowledge the ticket, not when the problem goes away. Ask for both, separately: target response (a human engaged) and target resolution or workaround, per priority level. For a small business the useful shape is something like 15–60 minutes response for a whole-business outage, same business day for anything that stops one person working, and a couple of business days for requests and questions. Be equally interested in what is excluded — after-hours coverage, project work, hardware, third-party software support.

Per-user versus per-device pricing, and which one is cheaper for you

Per-device pricing charges for each workstation, laptop and server. Per-user pricing charges for each person, and covers all the devices that person uses. The difference is not marketing — it can be several thousand dollars a year, and which one wins depends entirely on your device-to-person ratio.

• Ratio near 1:1 — one desktop per person, no laptops, no remote work. Per-device is usually slightly cheaper. Think a small manufacturing office or a clinic with fixed workstations.
• Ratio 2:1 or higher — a laptop plus a desk PC, or people working from a home machine and a company laptop. Per-user wins clearly. A 12-person consultancy with 26 devices pays for 12 seats, not 26.
• Shared devices — a shop floor with three kiosks used by fifteen staff, or a restaurant POS. Per-device is dramatically cheaper here, since headcount far exceeds hardware.
• Seasonal headcount — per-user flexes down when a temp leaves; per-device does not, because the machine is still sitting there.

Flat-rate plans in the $49–$129 per user per month range generally reflect depth rather than device count: the lower band covers help desk, patching and monitoring; the upper band adds managed endpoint detection and response, backup, security awareness training and roadmap sessions. Servers, firewalls and network gear are normally priced as separate line items in either model, because one failing server can consume more attention than twenty laptops.

Whichever model you choose, insist that it is month to month. A three-year contract is a way of keeping clients who would otherwise leave, and there is no technical reason a well-run engagement needs one.

Frequently asked questions

We only have eight people. Are we too small for managed IT?

No — and eight-person companies often benefit more per dollar than fifty-person ones, because there is nobody internally who patches machines or checks backups. Below about five users the maths can favour paying hourly, but the moment you have a server, compliance obligations, or clients who notice when your email is down, flat-rate coverage costs less than a single bad week.

Is hardware included in a monthly fee?

Labour is included; physical equipment is not. You buy the laptop, firewall or server; configuring, deploying and supporting it is covered. Larger projects — a server migration, an office move, a Microsoft 365 tenant migration — are quoted separately so a big one-off does not get buried in an ongoing rate.

What happens to our documentation and passwords if we leave?

They belong to you. Admin credentials, network documentation, licence records and backup configurations should be handed over on request, without a fee and without a notice period beyond the current month. If a provider treats that information as leverage, it tells you what the relationship really is.

How is this different from just having an IT guy on call?

An on-call technician arrives after something breaks and bills for the repair. Managed IT is measured by how rarely you need to call — patching, monitoring, backup verification and documentation exist specifically to remove the calls. The commercial difference follows: a flat monthly fee means fewer incidents make the provider more profitable, not less.