When businesses look at IT support, most assume there is one standard way managed service providers operate. In reality, there are three fairly distinct models (excluding variations of each), and understanding the differences can save you money and headaches. Here is a breakdown of each, along with the honest pros and cons.
Model One: Full Service, or All You Can Eat
This is the traditional managed services model, and it is the most common approach among mature providers. For a fixed monthly fee, nearly everything is covered.
On the labor side, this typically includes:
- Unlimited support for things that should work but are not, such as email issues, printer problems, slow computers, or network drive access.
- Moves, adds, and changes, meaning onboarding new employees, terminating departing ones, and everything in between.
- Virus and malware remediation, including follow-up review to confirm systems are clean.
On the product side, full service agreements usually bundle in a required security stack, things like endpoint detection and response, managed detection and response, and privileged access management. There is a real reason providers push this. Tighter security dramatically reduces support demand. Well secured environments often need fifteen minutes or less of support per user per month, compared to thirty minutes to an hour for looser environments. Since every support call reduces the provider’s margin on a fixed fee contract, strong security is a win for both sides.
A few honest caveats worth knowing:
- Full service agreements almost never cover new computer deployments or major projects, and that is intentional. You want to retain control over those expenses rather than having your provider assume utilization for you or require a set schedule that may not be budget friendly.
- Billing structures vary. Some providers charge a flat fee based on an employee range, which can leave you overpaying if your headcount drops. Others, like us, adjust billing up or down based on actual users and devices, which we believe is the fairer approach.
Model Two: Co-Managed
Co-managed support means responsibilities are split between your internal team and the provider, often on a service-by-service basis. For example, you might have your provider manage endpoint detection and response while your in-house IT person or power user handles other day-to-day needs.
This model, when managed properly can see significant savings over a full service/AYCE type model. It does require some skills and discernment on services you want and need along with a reliable and adequately skilled in-house employee willing and able to do the necessary work (gets IT, want’s IT, and ability to do IT)
As I said, this model can work, but it can come with real friction points:
- Accountability can get blurry. When something breaks, it is not always clear whether it falls under the provider’s responsibility or your internal team’s.
- Overlap is common, and it often leads internal staff to question the value of the outsourced or in-house piece.
- It requires more active management to keep the lines clear, which is why we generally steer clients away from a hybrid of full service plus co-managed.
- Know what you are getting, what you are not getting, and what that means. Don’t sign up for a co-managed model just to save money. It is NOT the same as a full service/AYCE model. There will be gaps that must be filled by your internal technical liason.
Model Three: Light Touch, or Alert-Based Support
This model is a newer option, and it is only viable because of how much cybersecurity has improved over the last five to ten years. In the past, businesses spent significant time chasing viruses and malware. Today, enterprise-grade antivirus, smart firewalls, and zero-trust platforms handle most threats automatically.
Under this model, you get:
- You select the security agents and monitoring on your systems.
- Very basic labor tasks included like automated handling of routine issues like Windows updates and vulnerability patching.
- Like co-managed there is a requirement for someone on your team to monitor alerts when something needs a decision. This is far less critical today due to the power of modern security solutions which identify, stop, and remediate threats with little or zero intervention.
Again, the tradeoff is that someone internally needs to watch for and triage alerts, deciding whether to resolve something in-house or escalate it to your provider. Support beyond the automated baseline is typically billed as needed, often through a retainer model, similar to how you would work with an attorney. You put down a set amount, and work is deducted from it as needed, giving you control over exactly what you use and when.
Which Model Is Right for You
Each model fits a different kind of organization.
- Full service suits businesses that want predictable costs and minimal internal IT involvement. Typically organizations with deep pockets and rapid growth where IT headaches cost far more in lost opportunity than the monthly bill.
- Co-managed suits businesses with meaningful in-house IT capability that want to selectively outsource specific pieces.
- Light touch suits businesses with low IT demand that are comfortable having someone internally triage alerts and only calling in outside help when truly needed.
There is no universally right answer. It comes down to your organization’s risk tolerance, internal capability, and how much control you want to retain over decisions versus how much you want handled for you.
Brian Largent
Father to five, husband to one, founder, CEO, and all around swell fella (or so I'm told)
