Ask three providers to quote for the same North West business and you will get three different monthly figures. None is necessarily wrong. Each is pricing a different bundle of service levels, which is why a single number tells you almost nothing about what you are buying.
This post decodes the variables behind managed IT services UK buyers actually receive: per-user versus per-device models, response and resolution times, remote versus on-site cover, security stack composition, contract length, onboarding and setup costs, and what sits outside support entirely, such as projects, licences and hardware. Coverage of the Cyber Security Breaches Survey 2025/2026 points to a persistent resilience gap between larger and smaller organisations, a useful reminder that the cheapest proposal is rarely the most complete one.
You will learn why no two quotes match, how to read a proposal line by line, how to build a like-for-like framework, and how to answer the pricing questions that come up most. By the end, you should be able to turn a quote into a decision instead of comparing one monthly figure. The lowest per-user price usually buys the slowest response, the thinnest security stack and the least on-site cover.
Why No Two Managed IT Quotes Match
Three proposals land on the desk. All labelled “managed IT support”. The monthly figures differ by a factor of two or more, and nothing in the paperwork explains why. A managed IT services provider in the North West can quote the same business two very different numbers depending on what is inside the bundle.
A managed IT proposal is a bundle of service levels, not a commodity price. The monthly per-user figure is an output, not the product. Two quotes can be numerically identical and deliver wildly different things.
Before comparing anything, unpack the pricing basis (per-user or per-device), response and resolution commitments, remote versus on-site cover, the security stack included, contract length, onboarding, and what sits outside the support agreement entirely. Our guide to what to look for in a managed IT support company covers how to weigh those up.
This piece explains what drives price, not what price should be. There are no pound figures or typical cost benchmarks here, because regional rate cards shift with scale, sector and risk appetite.
Each component is also sold separately. Blowfish Technology’s Managed IT Support, Cyber Security, Cloud Services, Connectivity and Telecoms service pages show how they look when unbundled.
Per-User vs Per-Device: What You Are Actually Buying
Per-user pricing covers the person: one monthly figure whether that person uses a laptop, a desktop and a mobile, or a single machine. Per-device pricing covers the kit: every laptop, server, tablet and handset carries its own line.
Per-user suits mobile teams and desk-sharing, where devices follow people. Per-device can look cheaper for a small headcount with a heavy hardware estate, then reverses as staff numbers grow.
The traps: minimum seat counts that price a 12-person business as 15, licensed users who never raise a ticket counted anyway, and servers, network and firewall endpoints arriving as extra line items.
A hypothetical 30-person business with 45 devices crosses over between the two bases, which is exactly where quotes stop being comparable. A hosted desktop model shifts the device count again (UK hosted desktop).
Ask every provider: is this priced per user or per device, what is the minimum seat count, and does it include servers, network equipment and mobile devices?
Check the model too. Fully managed, co-managed (your team keeps some responsibility) and break-fix are three different products; a co-managed quote beside a fully managed one is not like for like.
Response and Resolution Times: The Biggest Price Lever in the Quote
Pricing basis set, the service level agreement often moves the monthly figure more. Response time is how quickly an engineer acknowledges and starts work; resolution time is how quickly the fault is actually fixed. Cheaper quotes often pair a fast response with a slow resolution target.
Providers band issues by priority, with different targets for a total outage and a single user with a printing problem. Ask which band routine faults fall into, because that band shapes daily experience.
Price also shifts with 24/7 versus business-hours cover, an in-house or subcontracted desk, a named engineer, and proactive monitoring.
Watch the constraints: clocks that only start once a ticket is logged correctly, availability windows, and exclusions for third-party software or user error.
Ask for the SLA matrix in writing, with targets per band and service credits if they are missed. No matrix attached? That is your first question. See what North West businesses should expect from managed IT support from a local provider.
Remote vs On-Site Cover: Why Geography Moves the Number
Beyond the SLA, geography is the next lever. Most support is delivered remotely, which is why remote-only cover is the cheapest contract shape. Dead hardware, cabling, a failed switch and new-starter setups still need hands on site.
Geography is a pricing variable, not a claim about regional rates. Distance travelled, site count, travel billing and whether local engineers can reach you same day all move the number. One site near a provider’s base and five across two counties buy different amounts of on-site time.
Allowances vary: unlimited visits, set monthly hours, or hourly billing per visit on top of the retainer. Five included hours and unlimited visits are not the same product. Ask whether scheduled visits (patching, asset reviews) or reactive call-outs are covered.
For dispersed teams, hybrid working and multiple premises push demand up; a remote-only contract can leave a director fixing site problems personally. Ask how many on-site visits the provider made to comparable clients last year, a question in our IT support checklist for Liverpool businesses.
Security Stack Composition: Where Cheap Quotes Quietly Thin Out
Antivirus, patch management and a firewall are the entry-level expectation. The price difference sits above them: EDR with active threat hunting, email security, identity protection and security awareness training.
GOV.UK published the Cyber Security Breaches Survey 2025/2026 on 30 April 2026 as Official Statistics. It reports 43% of businesses had a breach in the last 12 months, rising to 65% for medium and 69% for large against 42% for micro and 46% for small. Alston & Bird’s secondary analysis shows malware protection at 81%, cloud backups and firewalls at 74%, two-factor authentication at 47% and VPNs at 36%. Editorially, that makes MFA and identity protection fair questions; adoption is not a price tag. About a third of businesses use, adopt or consider AI, but only 24% manage AI-related risks; where AI tools are in use, risk management belongs as a named line item. The truncated supply chain section and phishing share figure need checking before quoting.
Ask for the stack as an itemised list with tooling named, what is monitored out of hours, who triages alerts and what response follows detection. Cyber security managed services show how EDR and threat hunting sit alongside managed IT support.
Contract Length, Onboarding and Setup Costs
A 36 or 60-month term spreads onboarding, hardware and platform costs over more months, lowering headline cost but raising total contract value and lock-in. Compare total value, not monthly number.
Check 30/60/90-day notice periods, auto-renewal and early termination charges. A cheap monthly price with punitive exit can cost more than a flexible deal.
Onboarding covers estate discovery and documentation, monitoring agent rollout, licence and platform migration (including Azure vs AWS decisions), password resets and user communication. Ask whether it is billed as one-off or absorbed into retainer, and what written deliverables you get: asset register, documented network and configuration, named escalation path. Confirm who owns that documentation if you leave.
Ask how often monthly figure rises, on what basis, and if uplifts are capped. An uncapped inflation-linked clause can erase the difference between two quotes within two years. UK consumer subscription rules will require clearer exit terms from January 2027, a useful benchmark though not governing business contracts (Latham & Watkins).
What Sits Outside Support: Projects, Licences and Hardware
Support runs the environment you have; projects change it. A Microsoft 365 migration, a new server, a site move, a telephony rollout or a network refresh is project work, rarely included in a monthly retainer.
Licences sit in the same grey area. Providers may resell subscriptions, bill at cost with an admin margin, or leave them to you. Ask what is bundled, what is separate, and who manages renewals.
Hardware and connectivity are separate commercial arrangements. Blowfish Technology delivers managed Wi-Fi, leased lines, fibre broadband, hosted phone systems and business mobile alongside managed IT support, so they are costed as distinct services rather than assumed to sit inside support. Our cost comparison for North West SMEs covers the in-house alternative.
Watch the quiet extras: new starters and leavers, ad hoc training, report building, site moves, specialist engineers. Ask for the day rate and project rate card in advance.
Request inclusions and exclusions in writing, then test them against three scenarios: a new starter, a failed laptop, a new office.
How to Read a Managed IT Proposal Line by Line
Read a proposal in this order: scope and inclusions, pricing basis, SLA matrix, commercial schedule, exclusions annex. Starting at the monthly figure is exactly how cheap quotes win.
Run this checklist: per-user or per-device, seat minimum, response and resolution targets per priority band, business-hours or 24/7 cover, included on-site visits or hours, named security tooling, term and notice period, price increases, and exclusions. Our guide to What to Look for in an IT Support SLA explains which KPIs deserve your attention.
Exclusions hold the real cost differences: third-party line-of-business applications, out-of-warranty hardware, user training, and anything caused by a change made without the provider’s knowledge.
Some items should always appear but often don’t: an asset list of what’s covered, a named contact, escalation routes and reporting. Ask for a sample monthly report.
Then talk, don’t email. Ask the provider to walk the SLA matrix and exclusions annex with you, and note any answer that can’t be given in writing.
Making Quotes Like for Like: A Framework You Can Fill In
Once each proposal is read the same way, lay them side by side. Not provider against provider, but variable against variable. Rows: pricing basis and seat count; included devices (users, servers, network, mobile); response and resolution targets by priority; cover hours; included on-site hours or visits; named security tooling; contract term and notice; price-review mechanism; onboarding charge; and project rate card. Only then do the numbers compare.
Add outcomes rows: agreed uptime, what happens after a detected threat, how new starters are handled, how you escalate at 08:00 on a Monday, and how you reach a human when your usual contact is unavailable.
Weight each row by what matters to your business, then compare. If a proposal cannot be completed accurately, treat that as a finding and go back with written questions.
The reframing line: the lowest per-user figure usually buys the slowest response, the thinnest security stack and the least on-site cover. You are pricing outcomes, not buying a monthly number.
Frequently Asked Questions About Managed IT Pricing
Why do managed IT quotes vary so much? The monthly figure totals independent decisions: pricing basis, SLA tier, cover hours, on-site allowance, security layers, term and project scope. Providers matching on all of these still differ on onboarding.
Per-user or per-device: which is cheaper? Neither in the abstract. Per-device can look cheaper at low headcount with heavy hardware; per-user is more predictable as staff and devices grow.
What should a managed IT services UK proposal include? A pricing basis with seat minimums, a written SLA matrix, itemised security tooling, an on-site allowance, term and notice, a price-review mechanism and written exclusions.
How long should a contract be? Term trades monthly cost against flexibility: three to five years spreads onboarding costs and lowers the monthly figure, while shorter terms cost more but avoid lock-in. Compare total contract value.
How do I check a security stack? Compare named tooling with less widely deployed controls, such as two-factor authentication and identity protection, then ask how out-of-hours alerts are triaged and who responds.
Where is the survey data? The Cyber Security Breaches Survey 2025/2026 was published on GOV.UK on 30 April 2026 as Official Statistics; this article’s analysis draws on the Alston & Bird key takeaways summary.
Turning a Quote Into a Decision
A managed IT proposal is a bundle of service levels. The monthly per-user figure is an output, not a product, and the lowest number normally buys the slowest response, the thinnest security stack and the least on-site cover.
Three actions this week:
- Rewrite your requirement as outcomes, not a target price.
- Ask every managed IT services provider you shortlist to quote against it line by line.
- Complete the like-for-like table before you look at any monthly figure.
Agree internally what a day of downtime costs you and which data you could not afford to lose. Those two figures weight your table, at no cost.
In the North West, engineer proximity, the number of sites you run and the on-site work you genuinely need are part of the price, not footnotes. Ask about them explicitly.
Statistics above come from the Cyber Security Breaches Survey 2025/2026 on GOV.UK, with the Alston & Bird summary as secondary analysis. The deployment-rate to price-line link is editorial inference.
Conclusion
Managed IT pricing comes down to service levels, not a headline monthly rate. The biggest levers are response and resolution times, the depth of the security stack, remote versus on-site cover, and what sits outside support, such as projects, licences and hardware. Per-user and per-device models bundle different things, so no two quotes match unless you compare them line by line. In the North West, engineer proximity and your genuine on-site needs are part of the price, not footnotes. Your next step: rewrite your requirement as outcomes, ask every shortlisted provider to quote against it, and complete the like-for-like table before looking at any monthly figure. Weigh it with the cost of a day of downtime and the data you cannot lose. Then choose the proposal that delivers real value, not just the lowest number.
Frequently Asked Questions
Why do managed IT quotes vary so much?
The monthly figure adds up several independent decisions: pricing basis, SLA tier, cover hours, on-site allowance, security layers, contract term and project scope. Two providers can match on all of these and still differ on onboarding.
Is per-user or per-device pricing cheaper?
Neither is cheaper in the abstract. Per-device can look cheaper for a small headcount with a heavy hardware estate, but per-user is more predictable as staff and devices grow. Check the minimum seat count and whether servers, network equipment and mobile devices are included.
What should a managed IT services proposal include?
A pricing basis with seat minimums, a written SLA matrix with response and resolution targets per priority band, an itemised security stack, an on-site allowance, contract term and notice period, a price-review mechanism and written exclusions.
How long should a managed IT contract be?
Term trades monthly cost against flexibility. A three to five year term spreads onboarding, hardware and platform costs and lowers the monthly figure, but raises total contract value and lock-in. Shorter terms cost more per month but avoid lock-in. Compare total contract value rather than the monthly number.
How do I check a managed IT security stack?
Ask for the stack as an itemised list with tooling named. Check whether less widely deployed controls, such as two-factor authentication and identity protection, are included. Also ask what is monitored out of hours, who triages alerts and what response follows detection.
