There’s a stage most growing businesses hit where neither standard IT model fits. You’re too big for a provider to handle everything at arm’s length — you’ve got an IT person, maybe two, who know the business cold. But you’re too small for a real IT department: nobody covers vacations, nights belong to nobody, and your one IT hire is simultaneously the help desk, the security team, the project office, and the person who can never be sick. Co-managed IT is the model built for exactly this middle: your internal people stay, and a provider’s team plugs in around them. Here’s how it actually works.
The core idea: divide by strength, not by turf
Co-managed IT splits responsibilities along a simple line: your internal staff keep the work that requires knowing your business; the provider takes the work that requires scale, tooling, and around-the-clock hours. In practice the provider side typically covers 24/7 monitoring and alert response, patch cycles, backup verification and testing, security operations (the MDR layer), enterprise tooling your company would never buy alone (RMM, EDR, documentation platforms — included, not purchased), and overflow or after-hours help desk. Your team keeps strategy, the line-of-business applications only they understand, vendor and budget decisions, and the face-to-face relationships. The result reads less like outsourcing and more like your IT person suddenly having a department — specialists to escalate to, a night shift, and someone to hold the pager in Hawaii.
Who it fits (and who it doesn’t)
The fit signals are consistent: an internal IT presence that’s underwater — the ticket queue eats the project list, strategic work never ships; coverage gaps with real stakes — one person, 168-hour weeks nobody can staff, attacks timed for the empty hours; security requirements outgrowing generalist capacity — insurance applications asking for 24/7 monitoring and EDR that one person can’t deliver alone; and growth — 50 heading to 150 employees, where the alternative is hiring three more specialists at three more salaries. It’s equally worth naming who it doesn’t fit: businesses with no internal IT at all (that’s fully managed — simpler and cheaper for that situation), and organizations that want to replace their IT staff (that’s a different conversation, and pretending it’s co-management poisons everything).
What makes it work: the paper, not the vibes
Co-managed arrangements succeed or fail on explicitness, because ambiguity between two capable parties turns into gaps and duplicated work. The load-bearing documents are unglamorous: a responsibility matrix — who owns which systems and ticket types, decided before the first ticket; shared documentation that the company owns — the provider’s notes on your environment live where your team can see them, non-negotiably (documentation is the business’s property, whoever writes it); escalation paths in both directions — their desk hands local mysteries to your team, your team hands 2 a.m. and deep specialties to theirs; and honest reporting — the same metrics and QBR rhythm as any managed relationship, with your IT lead presenting the wins upward, because a provider that routes around its internal counterpart to look good to leadership has disqualified itself. The chemistry question to ask any prospective partner is exactly that: how many co-managed clients do you support, and can our IT manager talk to one of their IT managers?
The money math
Co-managed pricing usually runs meaningfully below fully managed per-user rates — your team is doing real work, and the pricing should honor it — often structured per-device or as a tailored scope rather than the standard per-seat plan. The comparison that matters is against the alternative: covering the same gaps by hiring means a security-capable admin, after-hours arrangements, and a tooling budget — realistically well north of $100k/year before you’ve achieved 24/7 anything. The co-managed fee typically lands at a fraction of that, and it flexes with you: scale the provider side up during projects and growth spurts, down as your internal team deepens. Some clients eventually hire their way out of pieces of the arrangement; a good partner treats that as graduation, not churn.
The bottom line
Co-managed IT is the honest answer to the middle stage: keep the people who know your business, add the hours, tooling, and specialist depth no small team can staff, and write the split down like adults. Done right, the visible result is quietly dramatic — your IT person finally ships the roadmap instead of drowning in the queue, the 2 a.m. alerts get answered by someone paid to be awake, and the business gets a department for the price of a partnership. It’s also the durable answer in hiring markets where one good generalist is hard to keep — Washington County being the textbook case.