Co-managed IT is a model where your internal IT staff and an outside managed service provider share responsibility for your technology. Your team keeps the work it does best, usually strategy, user relationships, and business applications. The provider takes the work that’s hard to staff internally: 24/7 monitoring, cybersecurity, after-hours coverage, and specialized projects. It’s the answer for companies that have outgrown fully managed IT but aren’t large enough to run a complete IT department alone.
In this guide
- What co-managed IT means
- How responsibilities split
- Co-managed vs. fully managed vs. in-house
- What co-managed IT costs
- Who it’s for
- Signs your IT team needs backup
- How Sixwatch runs co-managed IT
- FAQ
What co-managed IT means
Most companies hit an awkward stage between 75 and 300 employees. They have one to three IT people who know the business inside out. Those people are also the only ones who can restore a server at 11 p.m., answer 40 help desk tickets a day, evaluate security tools they’ve never used, and plan next year’s budget. Something gets dropped, and it’s usually security or long-term planning.
Co-managed IT (sometimes called co-managed IT services or hybrid IT) fills those gaps without replacing the internal team. The provider plugs into your existing operations with the same tools an MSP uses for fully managed clients: remote monitoring, a ticketing system, patch management, and security platforms. Your staff gets access to those tools too, so both sides see the same picture.
The internal team stays in charge. The provider is an extension of it, not a replacement.
How responsibilities split in a co-managed IT model
There’s no single right division. The most common arrangements:
| Function | Internal IT keeps | Provider takes |
|---|---|---|
| Help desk | Tier 1: password resets, “my screen is frozen,” desk-side support | Tier 2/3: complex troubleshooting, escalations, overflow, after hours |
| Monitoring and patching | Business applications and line-of-business software | Servers, workstations, network, 24/7 monitoring, patch schedules |
| Cybersecurity | Policy enforcement, user awareness | EDR/MDR, vulnerability management, email security, incident response |
| Backup and disaster recovery | Defining what matters | Running, testing, and restoring |
| Projects | Business requirements, vendor relationships | Migrations, server builds, network redesigns, cloud moves |
| Strategy | Business alignment, budget ownership | Technical roadmap input, quarterly reviews, industry benchmarks |
| Compliance | Internal audits, documentation | Control implementation, evidence collection, framework expertise |
| Coverage | Business hours | Nights, weekends, vacations, sick days |
The split is written into the agreement so nobody assumes the other side handled the backup. A good provider documents who owns what down to the ticket category.
Co-managed vs. fully managed vs. in-house IT
| In-house only | Fully managed (MSP) | Co-managed IT | |
|---|---|---|---|
| Internal IT staff | Yes, all functions | None | Yes, focused on strategy and users |
| 24/7 monitoring | Only if you staff it | Included | Included |
| Security expertise | Limited to what you hire | Provider’s team | Provider’s team, plus internal policy ownership |
| Institutional knowledge | High | Depends on provider tenure | High; internal staff stays |
| Vacation and turnover risk | High | Low | Low |
| Typical company size | 300+ employees | 10 – 150 | 75 – 500 |
| Cost | Highest per capability | Lowest for small companies | Middle; scales with what you outsource |
Fully managed IT is right when you have no IT staff and want none. Co-managed IT is right when you have good people who can’t cover everything and shouldn’t have to.
What co-managed IT costs
Because the provider takes on a subset of the work, co-managed IT is priced below fully managed rates. Typical ranges:
| Scope | Per user / month |
|---|---|
| Monitoring, patching, and tools access only | $40 – $70 |
| Plus security stack (EDR/MDR, email security, MFA) | $70 – $110 |
| Plus after-hours help desk and escalation | $90 – $140 |
| Full co-managed with compliance and vCISO support | $120 – $180 |
A 150-person company with two internal IT staff might pay $12,000 to $18,000 a month for a provider covering security, monitoring, and after-hours support. That’s less than one additional senior security hire, and it comes with a team instead of a person.
Project work is generally quoted separately. Some providers include a bank of project hours in the monthly fee.
Who co-managed IT is for
Best fit:
- Companies with 75 to 500 employees and one to five internal IT staff
- Organizations with a strong IT manager who is stretched thin
- Businesses facing compliance requirements (HIPAA, FTC Safeguards, CMMC, SOC 2) that need security expertise the internal team doesn’t have
- Companies growing faster than they can hire
- Multi-site or multi-state organizations where one team can’t be everywhere
Not the right fit:
- Companies with no internal IT (fully managed makes more sense)
- Large enterprises with complete security operations centers and 24/7 staffing already in place
Signs your internal IT team needs a co-managed partner
- Your IT person hasn’t taken a real vacation in two years because nobody else can cover.
- Patches are behind. Windows updates months old, firewalls on original firmware, because there’s never time.
- Security is antivirus and hope. No EDR, no 24/7 monitoring, nobody watching alerts at night.
- Your cyber insurance renewal asked questions you couldn’t answer about MFA coverage, backup testing, or incident response.
- Tickets take days, and the team spends its time on password resets instead of the projects that would eliminate them.
- The last big project stalled (a migration, a new office, a phone system) because day-to-day support consumed everyone.
- You’re about to hire a second IT person and realizing a $95,000 salary buys one set of skills, business hours only.
- Turnover would be a disaster. If your IT manager left tomorrow, nobody knows the passwords, the vendors, or the undocumented workarounds.
If three or more of these sound familiar, your internal team isn’t failing. It’s under-resourced.
How Sixwatch runs co-managed IT
Sixwatch has provided co-managed IT to businesses in Tampa Bay and Cincinnati for over two decades. We plug into your existing operations, give your internal staff full access to our monitoring and ticketing platforms, and take on the pieces you define: 24/7 monitoring, managed cybersecurity, after-hours escalation, compliance support, or project work.
Your team stays in charge. We’re the specialists on call, with a 30-minute emergency remote response, same-day onsite support, and founder John Owens’s 25+ years of experience behind every escalation. Our 5.0 Google rating includes IT managers who’ll tell you we made them look good.
Book a 15-minute call to talk through how the split would work for your team, or request a proposal.
Frequently asked questions
What is co-managed IT? An arrangement where your internal IT staff and an outside provider share responsibility for technology. The internal team typically keeps strategy and first-line user support; the provider handles monitoring, security, after-hours coverage, and specialized projects.
What is the difference between co-managed IT and managed IT services? Managed IT services replace an internal IT department entirely. Co-managed IT supplements one. The provider’s scope is smaller and priced accordingly.
How much does co-managed IT cost? Typically $40 to $180 per user per month depending on scope. Security and after-hours coverage are the biggest cost drivers.
Will a co-managed IT provider try to replace my IT staff? A reputable one won’t. The model exists because internal staff have knowledge and relationships an outside provider can’t replicate. The agreement should define the provider’s scope clearly so the roles don’t blur.
Do internal IT staff get access to the provider’s tools? They should. Shared visibility into monitoring, ticketing, and security platforms is what makes co-managed IT work. If a provider won’t give your team access, that’s a red flag.
What size company uses co-managed IT? Most commonly 75 to 500 employees with one to five internal IT staff, though it works at any size where internal IT exists but can’t cover everything.
Is your IT team stretched thin? Book a 15-minute call · Request a proposal
