← All Blogs

Co-Managed IT When Your One IT Person Is Drowning

By Best IT MSP Editorial Team - Updated October 21, 2026 - 12 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

What does co-managed IT actually divide?

Co-managed IT divides three things, and none of them is a technology layer. It splits the clock, the tiers and the room. The provider takes the hours and the ticket volume nobody can staff, and your internal IT manager keeps the work that has to be in the building.

That distinction is the whole article. Most co-managed proposals split by equipment, meaning the provider takes servers and network while you keep desktops and printers. The split reads clean on a slide and fails in week three, because one incident crosses both halves and nobody owns it. A split by clock, tier and presence never produces that argument, because every ticket has exactly one answer to the question of who holds it right now.

Your situation is common and it is measured. ISC2 found 47 percent of practitioners feel overwhelmed by the workload and 48 percent feel exhausted trying to stay current on threats, and that 33 percent say their organization lacks the resources to staff the team adequately. One person running a help desk, a patch cycle, a backup console and a vendor list is the extreme case. They are a single point of failure who cannot take a holiday, and the resignation is a question of when rather than whether.

Best IT MSP is an independent directory and does not sell IT services, so nothing changes for us if you hire instead. For the plain definition of the model, read Co-Managed IT Explained. For the arithmetic on whether to hire at all, read MSP vs Hiring IT Staff. This article starts after the hire exists, when the only useful question is how to support the person you already have.

Why a second hire does not fix a one-person IT team

A second hire doubles your capacity inside about a quarter of the year and adds nothing to the rest. A 40-hour business week is 2,080 hours of the 8,760 in a year. Put two people in that window and the window does not move, so the other 6,680 hours stay empty.

Price the hire honestly first. BLS puts the median annual wage for a computer user support specialist at $61,860, and its own compensation release shows wages are 70.0 percent of what an employer actually pays, with benefits the other 30.0 percent. Divide the salary by 0.70 and the real cost is about $88,400 before a single license. Add SHRM's average cost per hire of $5,475 for a nonexecutive role and year one lands near $93,900. The division is our arithmetic, and both inputs are published.

Now price the coverage you actually wanted. One full-time technician has roughly 1,900 hours at the desk once public holidays and leave come out, so covering 8,760 hours once, with nobody ever overlapping and no cover for sickness, takes about five people. At the support-specialist median that is roughly $442,000 of total employment cost for a rota with no redundancy in it. No small business buys round-the-clock coverage with headcount, which is why after-hours cover is a purchase rather than a hire.

Holiday cover is the same sum with a human face. BLS reports 32 percent of private industry workers received 10 to 14 days of paid vacation after one year of service, and with one IT person every one of those days is a day your IT function is absent. Unplanned sickness sits on top of that. BLS also puts median employee tenure at 4.1 years, and 3.0 years for workers aged 25 to 34, so the person carrying your estate alone is one resignation away from taking the documentation with them.

Which layers should the provider take?

The provider should take five layers, and buyers instinctively keep the wrong ones. After-hours cover, tier 1 ticket volume, specialist project work, the shared tooling, and the monitoring.

Buyers get this backwards in a predictable way. The instinct is to hand the provider the frightening specialist work and keep tier 1 internally, because tier 1 feels easy and your person already knows the users. Tier 1 volume is exactly what is drowning them. It is also the most commoditized thing a provider sells and the cheapest per ticket you will ever buy. Buy the cheap high-volume layer and the rare specialist layer, and keep the middle. The middle is where your one person is worth their salary.

• After-hours cover. Sophos found 88 percent of ransomware payloads were deployed during non-business hours and measured 3.4 hours from an attacker getting inside to reaching the Active Directory server. An on-call rota of one person fails the first night they are on a plane.
• Tier 1 volume. Password resets, new starter accounts, printer queues and mailbox permissions. A provider's service desk triages these at a unit cost no overloaded generalist matches.
• Specialist project work. Migrations, firewall replacement and identity projects. BLS puts the median annual wage for an information security analyst at $129,180 and projects that occupation growing 21 percent from 2025 to 2035, so the skill you most need is the one you can least hire.
• Shared tooling. The RMM, the PSA, patching, the backup console and endpoint protection. A provider buys all of it at volume and runs it across hundreds of estates.
• Monitoring and patching at scale. Verizon found only 26 percent of critical known exploited vulnerabilities were fully remediated in 2025, down from 38 percent, with a median 43 days to fully resolve one. A provider patches continuously and monitors overnight. One person loses to that treadmill every month.

Notice what the five layers have in common. Each one gets cheaper or better with scale, and none of them improves because the person doing it sits near your accounts team. That is the test for moving a layer out. Price the layers separately when you ask for a quote, and read Per User vs Per Device Pricing before you accept one blended rate for a thinner scope.

Which work has to stay internal?

Four kinds of work stay internal, and each one degrades when it moves. Business context, prioritization, vendor relationships, and anything physical.

• Business context. Which systems stop the invoices going out, which user is mid-audit, which outage is survivable until Monday. No provider learns this fast enough to matter, and no service level agreement encodes it.
• Prioritization. Your internal IT manager decides what gets done this week. A provider that also sets your priorities is quietly deciding your spend.
• Vendor relationships. The line-of-business application nobody else understands, the practice management system, the machine on the plant floor. Keep those account manager relationships internal.
• Presence. Hardware moves, new starter setup, the walk-up, and the training nobody remotes into. Presence is the one thing a hire buys that no contract delivers.

One duty is genuinely shared, and it falls between the two sides almost every time. CISA's performance goals call for a defined and enforced administrative process to off board staff, and for reviewing user access and disabling accounts after a set period of inactivity such as 30 days. Your internal person knows who left. Your provider holds the rights to disable them. Write down which side starts that process and how the other is told, or leavers keep a live mailbox for months.

The vCIO seat is the one contested line. A provider's vCIO brings pattern recognition across many estates, and your internal IT manager brings the room. BLS prices the senior version of that job, with a median annual wage of $175,140 for computer and information systems managers. Buy the vCIO hours while your person grows into the seat, then stop buying them. Say that out loud at signing so it is not a surprise at renewal.

Who owns the ticket at each moment?

One side owns a ticket at any moment, ownership is visible in one shared system, and it moves only on a recorded state change. Those three rules remove almost every argument a co-managed arrangement produces, because ticket ownership then stops being a matter of opinion.

Start with the system, because the rest is unenforceable without it. If your provider runs its PSA and your internal person runs a separate queue or an email inbox, you do not have co-managed IT. You have two help desks and a buyer in the middle reconciling them. One shared PSA, with your internal person holding a named technician seat inside it, is the single most important thing to negotiate. Everything below becomes a reporting question once that exists.

• Route by entry point. Anything arriving outside business hours is owned by the provider until the next business morning, with no exception for severity.
• Route every in-hours tier 1 ticket to the provider's service desk first, including the ones your person could close in four minutes.
• Escalate inside the provider, never across to your side. A tier 1 ticket needing tier 2 moves within the provider's own team, and your internal person is never the escalation path.
• Hand a ticket to your internal person for exactly two reasons, meaning it needs physical presence or it needs a business decision.
• Return anything your person cannot progress straight back to the provider with a written reason, and allow that return right no exceptions.
• Close nothing you did not own at the moment it was resolved.
• Log every walk-up in the shared PSA, in front of the user.

That last rule decides whether the whole arrangement works. Users walk to the person they can see. An unlogged desk visit is invisible to the ticket data, so your provider's report shows a comfortable queue while your one person is still drowning, and at renewal you conclude co-managed IT did not help. It was never actually tried. Make the walk-up rule explicit, hand the tier 1 ones to the provider's desk while the user is standing there, and the habit breaks in about six weeks.

Ambiguous ownership has a measurable cost. Verizon studied 7,513 third-party cloud MFA exposures and found 50 percent still unresolved 28 days after discovery, and 42 percent still open at 90 days. None of those fixes is technically hard. They are items of work sitting between two organizations with no single named owner, which is the exact failure mode a written split exists to prevent.

Co-managed IT fails on ownership ambiguity, not on price. A split nobody can misread costs the same as a split nobody can enforce.

What to put in the co-managed contract

Put eight things in the contract, and write them so the internal person is supported rather than policed. A proposal is marketing. The contract is the only document anyone reads during an incident.

The federal advisory on managed providers makes the case plainly. CISA, the NSA, the FBI and allied agencies wrote that both MSPs and their customers benefit from contractual arrangements that clearly define responsibilities, and that contracts should require MFA to be enforced on all MSP accounts used to access customer environments. CISA's performance goals add that contracts should detail how and when a managed service provider notifies the customer of an incident. Your provider is also your largest third party, and Verizon reported a third party involved in 48 percent of breaches, a 60 percent jump in a year.

• Name the layers line by line, using the clock, tier and presence split rather than an equipment list.
• State the ownership rules above as contract text, including the documented return right and the walk-up logging rule.
• Name a lead engineer and a named backup on the provider side. Your person needs a counterpart, not a rotating queue, or you have swapped one single point of failure for a stranger.
• Keep named administrator rights for your internal person in every shared tool, including the RMM and the PSA. Read-only access turns your employee into a spectator in their own estate.
• Define who documents what. The provider maintains the regularly updated inventory of all organizational assets and the accurate documentation describing current network topology, reviewed annually that CISA's goals call for, and your person documents the business context nobody else holds.
• Schedule knowledge transfer as a deliverable with dates, not as a culture. Two hours a month shadowing a tier 2 engineer, named projects your person co-leads, and runbooks handed over at each milestone.
• Set patch deadlines in days by severity, faster for anything on the CISA known exploited list, and name who signs off the exceptions.
• Agree exit terms returning your data, documentation and administrator credentials inside a stated window.

One clause does more for retention than all the others. Commission reporting that measures the arrangement, not the individual. The default pack a PSA produces is tickets closed by technician, which hands a vendor the audit trail on your own employee's work, and that vendor would be happy to replace them. Ask instead for time to first response, escalation accuracy, backlog age, after-hours volume, and the share of tier 1 that reached your internal person at all. Those five numbers tell you whether the split is right, and not one of them is a performance review.

Two adjacent clauses deserve reading separately before you sign. Scope decides what arrives as an extra invoice, covered in Out of Scope IT Support, and exit mechanics decide whether you can leave at all, covered in Termination for Convenience.

How do you tell in 90 days whether it is working?

To tell whether it is working, run one test and watch four numbers. The test is that your IT person takes two consecutive weeks off with the phone switched off and nothing escalates to them. If that cannot happen by month three, the split is wrong rather than the model.

• Share of tickets your internal person touched. It falls inside 60 days, or the routing rules are being ignored.
• After-hours incidents resolved without waking your person. Target every single one of them.
• Backlog age on the projects they were hired for. Those projects are the reason the arrangement exists.
• Their own answer to one question, asked privately. Are you doing the work you were hired for yet.

Three signatures tell you it is drifting. The provider's report and your person's week stop resembling each other, which is the unlogged walk-up. Tickets bounce between the two sides with no recorded owner, which means a second queue exists somewhere. And your person starts asking the provider's engineers for permission, which means the administrator rights clause was not honored. Each one is a routing fix, and none of them is a reason to tear up the contract.

Co-managed IT is not free of friction, and no honest provider claims otherwise. It trades a staffing problem for an interface problem, and an interface is something you can write down. The reason to prefer it is narrow and strong. You retain the person who understands your business, and you stop asking them to be awake for 8,760 hours a year. Take the clock, tier and presence split to three merit-ranked providers, ask each to price only those layers, and compare the quotes against the second hire you were about to make. How to Choose a Managed Service Provider covers how to run that comparison.

FAQ

What does co-managed IT include?

Co-managed IT includes five provider layers. After-hours cover, tier 1 ticket volume, specialist project work, the shared tooling such as the RMM and PSA, and monitoring. Sophos found 88 percent of ransomware payloads were deployed during non-business hours, which is the clearest reason after-hours cover is the first layer to buy.

Who owns the ticket in a co-managed IT arrangement?

One side owns each ticket at any moment, recorded in a single shared PSA. The provider owns everything arriving after hours and all in-hours tier 1 work. Your internal person owns only what needs physical presence or a business decision. Verizon found 50 percent of third-party exposures still unresolved at day 28 where nobody is named.

Is co-managed IT cheaper than hiring a second IT person?

Co-managed IT buys different hours rather than cheaper hours. A second hire costs about $88,400 once wages are treated as 70.0 percent of employer cost on the $61,860 support specialist median, and it adds zero coverage outside the 2,080-hour business week. Covering the whole year with staff takes roughly five people.

Will co-managed IT get my internal IT person replaced?

Not where the contract is written correctly. Keep named administrator rights for your employee in the RMM and PSA, name a counterpart engineer on the provider side, and commission reporting that measures the arrangement rather than the individual. CISA advises that contractual arrangements clearly define responsibilities, which protects the employee as much as the buyer.

How do you stop co-managed IT turning into two help desks?

Insist on one shared PSA, and log every walk-up inside it. Two ticket systems guarantee two help desks. Unlogged desk visits are the common failure, because the provider's report then looks healthy while your one person is still overloaded. ISC2 found 47 percent of practitioners already feel overwhelmed by their workload.

← All Blogs