Co-Managed IT vs. Fully Managed: Which Fits a Business With One IT Person?

By Earl Kelly III, MCP, CEO of Cydian Group · Reviewed by Earl Kelly III, MCP · Updated October 2026

Short answer: If you already have a capable IT person, co-managed IT is usually the better fit. They keep day-to-day support and final say, and a managed provider adds monitoring, security tools, patching, backup testing, and vacation coverage. Fully managed IT fits when nobody in-house owns IT, or when your IT person is leaving.

Most of the businesses we talk to aren't starting from zero. There's already someone who "does the IT." Sometimes that's a full-time IT manager. Often it's the office manager, the practice administrator, or the partner who's good with computers. The real question isn't whether you need help. It's what kind of help fits the person you already have.

This guide explains both models in plain English, shows how the work is usually split, and gives you a simple way to decide.

What is the difference between co-managed and fully managed IT?

Fully managed IT means an outside provider runs your technology end to end. That covers the help desk, patching, security, backups, Microsoft 365, vendor calls, and planning. You don't need anyone in-house to own IT. At Cydian, that's Cydian Secure.

Co-managed IT means you keep your IT person, and a provider fills the gaps around them. Your person stays the one who knows your people, your systems, and your vendors. The provider adds what one person can't carry alone: around-the-clock monitoring, patching at scale, security tooling, backup checks and restore tests, and someone to cover vacations and sick days. At Cydian, that's co-managed IT.

The difference comes down to who owns the day-to-day. In fully managed, the provider does. In co-managed, your person does, and the provider is their backup.

Who does what in a co-managed arrangement?

Every co-managed agreement we write starts with a written split. A typical one looks like this:

The split isn't fixed. Some businesses want us to own security entirely and leave the help desk alone. Others want us to take the after-hours alerts and nothing else. The point is that it's written down, so nobody assumes the other side has it covered.

When does co-managed IT make more sense?

Co-managed tends to fit when:

• Your IT person is good, and stretched. They're fixing a printer when the security alert comes in. They're on vacation when the server goes down.
• You need tools you can't justify buying for one office. Monitoring, endpoint protection, email security, and backup verification are built for scale, and they're expensive to license and run for a single location.
• Someone is asking harder questions. A carrier questionnaire, a client security review, a HIPAA risk analysis, or CMMC requirements in a defense contract can all show up at once. One person rarely has the time to document all of it.
• You don't want a single point of failure. If one person holds every admin password and knows where every backup lives, the business depends on that person never being out sick.
• Your culture values the person you have. Co-managed keeps them in charge. It doesn't replace them.

We see this most often in law firms with one IT person, surgery centers where a practice administrator handles technology, insurance agencies where the office manager runs the agency management system, and growing teams that have outgrown a single IT hire. Companies with a full internal IT department use it too, usually for security coverage and overnight monitoring.

When is fully managed IT the better choice?

Fully managed fits when:

• Nobody in-house owns IT, or the person who does would rather go back to their real job.
• Your IT person is leaving and you don't plan to replace the role.
• You want one accountable party for everything, with one agreement and one phone number.
• You're small enough that a dedicated IT salary doesn't make sense, but your obligations (client confidentiality, HIPAA, the FTC Safeguards Rule) are the same as a larger firm's.

The two models aren't permanent. Some of our clients start co-managed and switch to fully managed when their IT person moves on. The handoff is easier because we already know the environment.

How is co-managed IT priced compared with fully managed?

At Cydian, co-managed IT is a flat monthly fee based on the number of users or devices and which pieces we take on. It's quoted in writing after we agree on the split. Because your person keeps part of the work, a co-managed scope is usually narrower than a fully managed one.

What to watch for with any provider:

• Is the scope written down, or just described on a call?
• Who gets the 2 a.m. alert, and what happens next?
• Are backups tested by restoring them, or only reported as "successful"?
• Can your IT person see the same dashboards and reports the provider sees?
• What happens if you want to change the split later?

Will a co-managed provider try to replace our IT person?

A good one won't. The point of co-managed IT is to make your person more effective, not to make them redundant. In our agreements, you're in charge: the split is written down, and your IT person approves changes in their areas.

If a provider's pitch leans on how much you'd save by letting your IT person go, that's a fully managed sale dressed up as co-managed. Ask directly.

How do you decide? A simple test

Answer these five questions:

1. Do you have someone whose job, or a large part of whose job, is IT?
2. If that person were out for two weeks, would security alerts still get answered?
3. Has anyone restored a backup in the last year to prove it works?
4. Could you hand a carrier, auditor, or client a written description of your security controls today?
5. Does more than one person know the admin passwords, and are they stored somewhere safe?

If you answered yes to #1 but no to any of #2–#5, co-managed IT is probably the right starting point. If you answered no to #1, look at fully managed.

You can also take our free 2-minute risk check. It's ten yes-or-no questions on security, backups, and AI use, and your score shows up instantly.

What does this look like in Jacksonville and Tampa?

Cydian Group has offices in Jacksonville (San Marco, since 2010) and Tampa, and we support businesses across Northeast Florida and Tampa Bay. In both markets the pattern is the same: regulated, owner-run businesses with one trusted IT person and a growing list of security expectations from carriers, clients, and regulators. Hurricane season adds another reason not to rely on one person and one building.

Frequently asked questions

Is co-managed IT only for large companies? No. It's often a better fit for smaller businesses with one IT person, because they get monitoring, security tools, and coverage they couldn't justify buying alone, without giving up the person who knows their office.

Who's in charge in a co-managed arrangement? You are. The split is written down, and your IT person approves changes in their areas. The provider handles what's agreed and reports back.

Can we start co-managed and move to fully managed later? Yes. Many businesses switch when their IT person moves on or retires. The handoff is easier because the provider already knows the environment and has the documentation.

What does a co-managed provider usually take on first? Usually the work one person can't do around the clock: monitoring and alerts, patching, email and endpoint security, and backup checks with restore tests. Projects and vacation coverage are typically shared.

How is co-managed IT priced? At Cydian it's a flat monthly fee based on users or devices and the pieces we take on, quoted in writing after we agree on the split.

Talk it through

If you're weighing the two models, the easiest next step is a conversation. We'll look at what your IT person handles today, where the gaps are, and what a written split could look like, with no pressure to sign anything. Start with a real conversation, or see how co-managed IT and Cydian Secure work.