Most growing businesses reach a point where one or two internal IT staff simply cannot keep pace with the demands placed on them. Tickets pile up, strategic projects stall, and the question of whether to hire another person, outsource everything, or find a smarter middle ground becomes increasingly urgent.
For many North West businesses with between 30 and 150 employees, the answer sits somewhere between those two extremes. Co-managed IT services offer a model that lets you retain the institutional knowledge your internal team has built, while extending their capacity with external expertise, round-the-clock monitoring, and a full security stack they could not practically maintain alone.
This post cuts through the noise around that decision. You will find a clear comparison of the three main IT delivery models, the warning signs that your current setup has reached its limits, a practical breakdown of what co-managed engagement actually looks like day to day, and an honest look at the numbers. If you are weighing up your options and want a model that scales without forcing you to hand over full control, this is the guide to read first.
What Is Co-Managed IT?
Co-managed IT is a structured service model that sits between keeping everything in-house and handing full responsibility to an external provider. Your internal IT person stays exactly where they are, retaining ownership of day-to-day user relationships and the institutional knowledge that makes them genuinely valuable to your business. What changes is that a managed IT services provider takes on the functions that a single internal hire cannot reliably cover alone.
In practice, the external partner typically handles:
- Endpoint detection and response (EDR) and continuous threat monitoring
- Patch management and scheduled maintenance
- Dark-web monitoring for compromised credentials
- Helpdesk overflow during peak periods
- Out-of-hours cover under defined SLAs
- Complex project delivery such as Microsoft 365 tenant design or Entra ID conditional access configuration
This is not a sign that your internal team is failing. It is a deliberate, commercially sound model that UK SMEs are increasingly adopting to scale IT capability without the cost and lead time of additional headcount. The internal IT person brings context and continuity; the external partner brings specialist depth, enterprise-grade tooling and 24/7 availability. Neither replaces the other, and that is precisely the point.
Three Models Compared: Full In-House, Co-Managed and Full Outsource
To choose the right model, it helps to see them side by side across the dimensions that matter most to a growing business.
Full in-house IT gives you maximum control and an IT person who knows the business inside out. The cost is significant: a single hire runs to £45,000–£70,000 annually once you factor in recruitment, tooling, training and holiday cover. A one-person team also creates a single point of failure; when that person is ill, support stops.
Full outsourced IT support transfers all responsibility to an external managed IT services provider, which works well for businesses with no internal IT resource. For organisations that already have an internal hire, full outsourcing can mean losing institutional knowledge and user relationships built over years.
Co-managed IT addresses both problems. Your internal person retains user-facing work, strategic input and business context. The external partner handles monitoring, security, out-of-hours cover and specialist escalations one person cannot reliably deliver alone.
The table below summarises all three across five practical dimensions:
| Full In-House | Co-Managed | Full Outsource | |
|---|---|---|---|
| Cost per user | High | Lower | Lowest with no internal staff |
| Control retained | Maximum | High | Lower |
| 24/7 coverage | Unlikely | Yes | Yes |
| Security stack depth | Limited | Full | Full |
| Scalability (30–150 users) | Costly | Efficient | Efficient |
For businesses in the 30–150 user range with one or two internal staff, co-managed IT delivers stronger security coverage and broader capability than additional internal hires at equivalent cost.
The Signs Your Business Has Outgrown Its Current IT Setup
Knowing which model fits your business is one thing; recognising that you have already outgrown your current setup is another. These are the clearest signs.
Your internal IT person is permanently reactive. The working day is consumed by ticket resolution, password resets and hardware faults, leaving no capacity for infrastructure improvements, security reviews or technology strategy. If your IT person cannot remember the last time they worked on something proactive, that is a structural problem, not a personal one.
Out-of-hours incidents go unanswered. When something fails on a Friday evening or a bank holiday, either it waits until Monday or it lands on someone not equipped to resolve it. Every hour a critical system sits unattended is direct business risk.
Security gaps are accumulating. No endpoint detection and response (EDR) tool in place, patches running behind schedule, phishing simulation never tested, and Cyber Essentials certification still on the backlog. The ICO’s UK-GDPR security obligations apply regardless of your team’s capacity, so these gaps carry genuine compliance risk.
Holiday and sick leave cover is informal at best. In practice, the business is without IT support for several weeks each year, with no documented handover and no guaranteed response.
The project backlog keeps growing. A cloud migration, Microsoft 365 rollout or network refresh remains unaddressed because the internal team has no bandwidth beyond day-to-day demands. These are not minor tasks; they directly affect your business technology resilience and your ability to scale.
None of this reflects poorly on your IT person. It reflects the reality that the scope of IT in a growing business has exceeded what one or two people can manage alone.
What Co-Managed IT Looks Like in Practice
Once you recognise those gaps, the natural question is: what does the alternative actually look like week to week?
The engagement begins with a documented division of responsibility, agreed before any tooling is deployed. Your internal IT person retains ownership of user relationships, first-line triage and business-specific configuration decisions. The external partner takes ownership of monitoring, patch management, security tooling, out-of-hours cover and specialist escalations. Neither side is guessing where their remit ends.
Escalation paths are written down, not implied. When your internal person hits something outside their skill set, whether that is Entra ID conditional access policy design or backup and infrastructure verification, a named senior engineer at the external partner picks it up directly. There is no generic helpdesk queue, no re-explaining context from scratch.
The security stack goes live from day one. EDR, threat hunting and dark-web monitoring run continuously across your environment, drawing on threat signals from the provider’s entire client base. That breadth of visibility is not something a single internal hire can replicate independently. It is also worth noting that a stronger security posture directly supports your position when renewing or applying for cyber insurance, where insurers increasingly expect active endpoint protection to be in place.
Out-of-hours cover sits entirely with the external partner, under SLAs with response and resolution targets agreed in writing. Your internal IT person is not on call.
Onboarding follows a structured sequence: asset discovery, a knowledge transfer session where the internal team documents the environment, and RMM platform deployment. In Blowfish Technology’s experience, for a business of 30 to 150 users, this is typically achievable within two to four weeks.
The Cost Case: What You Are Actually Comparing
Once you understand what a co-managed arrangement looks like operationally, the next question is almost always the same: what does it actually cost compared to solving the problem through internal hiring?
That £45,000–£70,000 total annual cost covers more than a salary line: add employer National Insurance contributions of 15% on earnings above £5,000, statutory pension, recruitment fees, tooling licences, training and the cost of covering annual and sick leave, and the true annual cost climbs considerably above that figure.
A co-managed IT contract from a managed IT services provider bundles helpdesk overflow, monitoring, patching, security tooling and out-of-hours cover into a single predictable per-user monthly fee. For teams under 100 people, that model is typically 30 to 50 percent cheaper than the equivalent internal hire cost.
Per-user pricing makes budgeting straightforward and scales cleanly as headcount grows, with no recruitment cycle and no capability lag.
The correct comparison is never co-managed IT versus zero cost. It is co-managed IT versus the true cost of the additional hire or hires needed to fill the same gaps internally. For businesses in the 30 to 150 user range, that calculation almost always favours the managed model.
Who Owns Cybersecurity in a Co-Managed Arrangement?
Cost comparisons matter, but budget clarity only takes you so far. The question that causes the most friction in co-managed engagements is simpler and more urgent: who is responsible for cybersecurity when something goes wrong?
A good provider will insist on defining this before the engagement begins, not leave it to be resolved during an incident.
The external partner owns the security tooling layer. As outlined above, EDR deployment and continuous monitoring, patch management schedules, phishing simulation campaigns and dark-web credential monitoring all sit with the provider and run without interruption. This is not a shared responsibility; it is a clean ownership line. Your internal IT person should not be managing these tools day to day.
Compliance work is genuinely shared. For Cyber Essentials or Cyber Essentials Plus preparation, the external partner handles technical remediation, evidence gathering and documentation. Your internal IT person owns communication with internal stakeholders, such as department heads and the board, where business context matters more than technical depth.
Incident response follows a documented path. Escalation follows the same documented path described earlier, now applied specifically to security events: the provider’s monitoring platform detects and triages the threat, notifies your internal IT person immediately, and the provider’s senior engineers lead containment and remediation under agreed SLAs. No ambiguity, no delay caused by unclear ownership.
When selecting a co-managed partner, verify that they hold Cyber Essentials Plus certification and Microsoft Solutions Partner status for Security. Both confirm that the provider’s own environment meets the standard they are helping you achieve, which is a meaningful signal rather than a marketing claim. The NCSC Cyber Essentials overview explains the scheme’s scope and certification tiers in full.
For detail on how EDR and threat hunting are delivered within a co-managed engagement, Blowfish’s cyber security managed services page covers the operational specifics.
Why Growing North West Businesses Work with Blowfish Technology
Choosing the right partner matters as much as choosing the right model. Blowfish Technology supports businesses across the North West, built on over 50 years of combined engineering experience. When you raise an escalation, the person handling it is a senior practitioner who has seen the problem before, not a first-line agent working from a script.
The security stack included in a co-managed engagement covers EDR, threat hunting, dark-web monitoring and phishing simulation. These are not optional add-ons billed separately; they are part of the managed IT support contract from the outset, which keeps costs predictable and removes the negotiation that often delays security improvements.
On the compliance side, it is worth vetting any co-managed partner for relevant industry certifications before you commit. Ask Blowfish about current accreditations when you speak to the team; if your business is working towards Cyber Essentials Plus or Microsoft Solutions Partner alignment, your co-managed partner needs to hold them first.
Named account management means your internal IT person speaks to the same contact every time, someone who already understands your environment, your infrastructure decisions and where the business is heading. There is no re-briefing a different engineer on every call.
Being a North West provider is not just a geographic label. It means senior engineers are available during business hours, out-of-hours cover is backed by defined SLAs, and there is a named person who owns the relationship rather than a central call queue.
Beyond managed IT support, Blowfish’s portfolio includes cloud services, connectivity and telecoms. As your business grows, the engagement can grow with it, without adding new suppliers or the coordination overhead that comes with them.
Is Co-Managed IT the Right Model for Your Business?
The co-managed model is the strongest fit for businesses with 30 to 150 users and one or two internal IT staff whose institutional knowledge is genuinely valued, but where a widening gap has opened between what those staff can cover and what the business now demands.
Use this checklist to assess your position honestly:
- Does your internal IT person spend the majority of their time resolving reactive tickets, with little or no capacity for proactive or strategic work?
- Is out-of-hours cover a recurring gap, leaving incidents unaddressed overnight or at weekends?
- Has a security project such as EDR deployment or Cyber Essentials been on the backlog for more than six months?
- Are you planning significant headcount growth in the next 12 to 24 months?
If two or more of those apply, the business has likely already crossed the point where co-managed IT delivers a better outcome than attempting to close those gaps through additional internal hiring alone.
For businesses with no internal IT resource at all, managed IT support delivered as a fully outsourced arrangement is the more appropriate starting point. The co-managed model can always be introduced later if an internal hire is made and the hybrid structure becomes the right fit.
Taking the Next Step with Co-Managed IT Support
If the checklist in the previous section reflected your situation, the next move is straightforward.
The model’s commercial logic and operational design have been set out in full above, what remains is to act on it.
The practical steps are three: review what your internal IT person can realistically own, identify where external depth is genuinely needed, then speak directly to Blowfish Technology about what a co-managed engagement would look like for your business specifically.
Get in touch with Blowfish Technology to discuss a co-managed IT arrangement. A direct conversation costs nothing and gives you a clear picture of exactly what the model delivers for a business like yours.
Conclusion
Co-managed IT is not a stopgap. It is a structured, scalable model built for businesses that have outgrown a single internal hire but do not need, or want, full outsourcing.
For growing North West businesses navigating increasing complexity, this model delivers genuine strategic advantage, not just IT support.
If your current setup is starting to strain, now is the right time to explore what co-managed IT could look like for your business. Speak with Blowfish Technology today and take the first step toward a smarter, more resilient IT model.
Frequently Asked Questions
What is the main difference between co-managed IT and full outsourcing?
The key difference is that co-managed IT retains your internal IT person in a user-facing, strategic role while an external partner handles monitoring, security, patching, and out-of-hours support. Full outsourcing transfers all IT responsibility to an external provider, which can mean losing the institutional knowledge and user relationships your internal team has built. Co-managed IT gives you the best of both worlds: your internal team's context and continuity, combined with the external partner's specialist depth and 24/7 availability.
How much can a business save by switching to co-managed IT services?
For teams under 100 people, co-managed IT is typically 30 to 50 percent cheaper than the true cost of hiring an additional internal IT staff member. When calculating the full cost of an internal hire—including salary, National Insurance contributions (15%), pension, recruitment fees, tooling licences, training, and annual and sick leave cover—the comparison strongly favours the managed model. Co-managed contracts also provide predictable per-user monthly pricing that scales cleanly as your business grows.
What security services are included in a co-managed IT package?
A comprehensive co-managed package typically includes endpoint detection and response (EDR), continuous threat monitoring, dark-web credential monitoring, patch management and scheduled maintenance, phishing simulation campaigns, and out-of-hours security incident response under defined SLAs. These security services are integrated into the managed IT support contract from day one, not billed as separate add-ons. The external partner owns the security tooling layer entirely, running it without interruption across your environment.
How long does it typically take to implement a co-managed IT arrangement?
For a business with 30 to 150 users, onboarding a co-managed IT arrangement typically takes two to four weeks. The process follows a structured sequence that includes asset discovery, a knowledge transfer session where your internal team documents the environment, and deployment of the remote monitoring and management (RMM) platform. Before any tooling is deployed, a documented division of responsibility is agreed between your internal team and the external partner to ensure clarity on roles and escalation paths.
What signs indicate that our business has outgrown its current IT setup?
Key warning signs include: your internal IT person spending the majority of their time on reactive ticket resolution with no capacity for strategic work; out-of-hours incidents going unanswered on evenings, weekends, or bank holidays; security gaps accumulating (no EDR in place, patches behind schedule, security certifications on backlog); informal or missing IT cover during holidays and sick leave; and a growing project backlog that remains unaddressed due to limited bandwidth. If two or more of these apply, your business has likely crossed the point where co-managed IT delivers a better outcome than attempting to close gaps through additional internal hiring alone.
