Managed IT Support vs an In-House IT Person: How a Small Business Should Decide

Sooner or later, every growing company reaches the same awkward moment. The person who quietly looked after the computers, the email accounts and the router, often the office manager, a developer or the founder’s nephew, becomes overloaded. Something breaks on a Monday morning and nobody knows whose job it is. The question follows: should we hire someone, or pay a company to take this over?

There is no universal answer, and vendors on both sides tend to oversimplify. This guide lays out what each model really provides, where the hidden costs sit, and how to choose based on your size, risk and growth. It draws on the kind of work we do every day under our IT maintenance service, and it pairs with our advice on what an IT maintenance contract should cover.

What “IT Support” Actually Includes

Much confusion arises because people use the phrase for very different jobs. Break it into layers before comparing options.

• Help desk: resetting passwords, fixing printers, setting up new laptops, answering everyday questions from staff.
• Infrastructure: networks, Wi-Fi, servers, cloud services, backups and storage.
• Security: patching, endpoint protection, access control, multi-factor authentication, email filtering and incident response.
• Administration: user accounts, licences, device inventory, vendor management and documentation.
• Strategy: planning upgrades, budgeting, choosing systems and reducing risk over time.

A single generalist can cover the first and part of the second layer well. Covering all five to a professional standard, with holiday and sickness cover, is a different proposition. Hardware failures on the desk, covered by services like computer repair, are the visible part; the invisible part is everything that prevents the failure.

The In-House Model

What you gain

• Presence and speed for local issues. Someone walks to the desk within minutes.
• Deep knowledge of your business. An employee learns your workflows, quirks and people.
• Direct control. Priorities are set by you, and the person is fully dedicated to your company.
• Cultural fit. A staff member is part of the team and builds relationships across departments.

What it really costs

The salary is only the beginning. Add employer taxes and social contributions, equipment, training, certifications, software tools for monitoring and ticketing, recruitment time and management attention. Then add the cost of unavailability: when your one IT person is on holiday, ill or resigns, the department is zero. Replacing a specialist can take months, and knowledge that lived in one head leaves with them.

Where it struggles

• Single point of failure. One person cannot be on call around the clock, all year.
• Breadth of skills. A capable generalist is rarely also a firewall specialist, a cloud architect and a security analyst.
• Career stagnation. A lone IT employee in a small company has few peers to learn from, and skilled people leave for that reason.
• Underuse. In a company of fifteen, there may not be forty hours of IT work every week, yet you pay for forty.

The Managed Service Model

A managed service provider (MSP) takes responsibility for defined IT outcomes for a monthly fee. Well-run providers monitor systems continuously, patch and back them up, run a help desk and bring a team of specialists rather than one person.

What you gain

• Predictable cost. A fixed monthly price replaces surprise repair bills, at least for what the contract covers.
• Depth and redundancy. A team means someone is always available, and different specialists handle different problems.
• Proactive work. Monitoring, patching and backup verification happen whether or not anything is visibly broken.
• Tools and process. Ticketing, remote management, documentation and reporting are already in place.
• Scalability. Adding ten new staff or a second office does not mean recruiting.

Where it struggles

• Distance. Remote support cannot swap a failed switch. Ask how and when on-site visits happen and what they cost.
• Context. A provider may treat you as one of many clients. Good ones counter this with named contacts and regular reviews.
• Contract traps. Vague scopes, long lock-ins, hidden charges for anything outside a narrow list, and unclear ownership of documentation and credentials.
• Misaligned incentives. A provider that profits from tickets has less reason to eliminate their cause than one measured on reliability. Look for contracts tied to outcomes.

A Side-by-Side Comparison

The Security Question

For many small businesses, security is the deciding factor, more than convenience. Attackers do not skip small companies; automated tools scan everything. Basic hygiene, applied consistently, prevents a great deal of harm: timely patching, multi-factor authentication, tested backups, least-privilege access, email filtering and staff awareness. The NIST small business cybersecurity resources lay out these fundamentals in plain terms.

Who owns which risk

Whichever model you choose, write down who is responsible for each control. In many failures, everyone assumed someone else was verifying the backups. Ask specifically: who checks that a restore actually works, who removes accounts when staff leave, who reviews administrator access, and who is called at midnight when ransomware appears? The same questions apply to websites and servers, covered in our guidance on malware and blacklisting and our server administration service.

A Decision Framework

Work through these questions honestly. They reveal more than a price comparison.

1. How many people and devices depend on IT?

Below roughly ten to fifteen staff, a full-time hire is often underused. Above fifty, the workload tends to justify at least one internal person, frequently supported by an MSP for specialist areas.

2. How costly is downtime?

If an hour of outage costs you more than a month of IT support, coverage and redundancy matter more than cost. Ask what your business would lose if email, the shop or the phone system were down for a day.

3. How specialised is your environment?

Industry systems, regulated data, custom servers and multi-site networks demand skills few individuals hold. Regulated sectors also need documented controls and audit trails, which providers with mature process often supply.

4. How fast are you growing?

Fast growth argues for flexibility: a provider scales with headcount, while hiring lags demand and then overshoots it.

5. Do you need physical presence?

Offices full of hardware, warehouses with scanners, or retail sites with tills benefit from someone on site. If most tools are cloud-based and staff work remotely, on-site needs shrink.

6. Can you manage the arrangement?

Both models need oversight. An employee needs goals and support; an MSP needs a scope, service levels and regular reviews. Assign an owner on your side either way.

The Hybrid Option Many Companies End Up With

Around the middle of the size range, the sensible answer is often both. A junior or generalist employee handles the help desk, onboarding and local hardware. An external partner supplies the specialist layer: security monitoring, server and network management, backups, after-hours cover and project work. The arrangement works when the boundary is written down: who handles what, how escalation works, and where documentation lives.

Whichever you choose, it is worth understanding what an IT partner needs from you. Our article on IT maintenance and server administration for e-commerce stores shows how the responsibilities divide when the website itself is critical to revenue.

How to Evaluate a Managed Provider

1. Ask for the scope in writing. What is included, what costs extra, and how are out-of-scope requests priced?
2. Check response and resolution commitments. Response time alone is meaningless; ask about resolution targets by severity.
3. Clarify data and credential ownership. You should own all documentation, passwords and licences, and be able to leave with them.
4. Review security practice. How do they secure their own remote access tools? Providers are attractive targets, so ask about multi-factor authentication and staff vetting.
5. Ask for references from clients of your size and sector, and call them.
6. Look at exit terms. Notice periods, minimum terms and handover assistance tell you how confident the provider is in its own service.
7. Request regular reporting. Monthly summaries of tickets, patch status, backup tests and risks keep the relationship honest.

How to Evaluate an In-House Hire

• Define the role realistically: help desk, administration, security, or a mix, and what is out of scope.
• Budget beyond salary: tools, training, and a backup plan for absences.
• Plan documentation from day one, so knowledge is written down rather than remembered.
• Give the person a growth path or an external peer network to reduce turnover.
• Decide in advance which specialist work, such as penetration tests or server migrations, will be bought in.

A Worked Example: Three Companies, Three Answers

Consider three hypothetical businesses, each with a different profile.

A twelve-person design studio works entirely in cloud tools and on laptops. Its IT needs are accounts, devices and security basics. A managed provider handles onboarding, device management, backups of local files and security monitoring, and an office manager acts as the internal contact. Hiring a full-time person would leave most of the week idle.

A sixty-person distribution company runs a warehouse with scanners, a local server for its inventory system and two offices. It has enough daily work for one employee, but the server, network and security layers need more skills than one person holds. It employs a generalist and contracts a provider for infrastructure, monitoring and after-hours cover.

A five-person online shop has almost no office IT but a website that earns all its revenue. Its real need is hosting, updates, backups and fast response when the site is down. It buys a maintenance and server administration contract and keeps one owner internally, since uptime, not desk support, is what protects income.

The lesson is that headcount alone does not decide it. What the business depends on, and how quickly it must recover, does.

Warning Signs You Have Outgrown Your Current Setup

• Staff keep a private list of the one person who can fix things.
• Nobody can say when backups were last restored successfully.
• Devices and licences are tracked in someone’s memory.
• Updates are postponed because they might break something and no one has time to test.
• Former employees still have active accounts.
• IT problems are solved in the evening or at weekends by the same exhausted person.

If three or more of these sound familiar, the risk is already higher than the cost of doing something about it.

Frequently Asked Questions

At what company size does hiring an in-house IT person make sense?

There is no fixed threshold, but companies under about fifteen employees rarely have enough work for a full-time hire, while those above fifty usually do. Between the two, a hybrid of one internal generalist plus an external specialist partner is common.

Is managed IT support cheaper than an employee?

Often it is for small teams, because you pay for a share of a team rather than a full salary plus overheads. At larger sizes an employee can cost less per hour of actual work. Compare total cost, including absences, tools, training and downtime risk.

What should be in a managed IT contract?

A clear scope, response and resolution targets by severity, monitoring and patching commitments, backup verification, security responsibilities, reporting, ownership of your documentation and credentials, and reasonable exit terms.

Can a managed provider replace on-site help entirely?

Only partly. Remote support handles most software and account issues, but hardware failures and network cabling need someone physically present. Confirm how on-site visits are arranged and priced.

Who is responsible if we get hacked?

Legally, your company remains responsible for its data, whichever model you use. That is why responsibilities for backups, access reviews and incident response should be assigned in writing before anything happens.

Can we switch from in-house to managed later, or the other way round?

Yes, and many companies do as they grow. Make transitions easier by keeping documentation, licences and administrator credentials under company control, not with an individual or a supplier.

The Bottom Line

The right model is the one that covers the five layers of IT reliably at a cost that matches the risk to your business. For most small companies that means outsourcing the specialist and after-hours work, or the whole function, and keeping a clear internal owner. As you grow, add an internal generalist and keep the partner for depth. What matters most is not the label but the discipline: written responsibilities, tested backups, owned documentation and regular reviews.

If you are weighing the options and would like an honest view of what your setup needs, contact our team and we will talk it through without a sales script.