Disclosure: This post contains affiliate links. If you click and purchase, I may earn a commission at no extra cost to you.
Last Updated: August 18, 2026
Most SMB technology decision-makers walk into an MSP sales conversation at a structural disadvantage. The vendor has done this pitch a thousand times. You’ve done it once, maybe twice. The result? Businesses routinely sign agreements for services three tiers above what they actually need — paying $150 per user per month for full-service managed IT when a $900/month co-managed arrangement would cover 90% of their risk exposure. This guide cuts through that. Below is a direct comparison of the three MSP service models — Break-Fix, Co-Managed IT, and Full-Service Managed IT — mapped to real business profiles, compliance requirements, and honest pricing ranges. Read the comparison table first, identify your tier, then use the vendor questions at the end before you sign anything. For more details, see our guide on avoid getting locked into a bad MSP contract. For more details, see our guide on RMM platform comparison for monitoring and patching.
Break-Fix vs. Co-Managed IT vs. Full-Service MSP: Which Model Fits Your Business?
The three MSP service models differ fundamentally in scope, cost structure, and risk allocation. Here’s the at-a-glance comparison before we go deeper: For more details, see our guide on detailed MSP pricing breakdown and service tiers.
[IMAGE: alt=”Comparison table: Break-Fix vs Co-Managed IT vs Full-Service MSP showing cost, scope, best fit, and red flags” | filename=”msp-service-model-comparison-table.jpg”]
| Model | Typical Cost | Scope | Best Fit | Red Flag |
|---|---|---|---|---|
| Break-Fix | $125–$175/hr | Reactive only; no monitoring | Solo operators, <5 employees, no compliance obligations | “Monitoring add-ons” that quietly become contracts |
| Co-Managed IT | $800–$2,500/month | Supplements in-house IT; helpdesk, patching, SOC access | 15–75 employees with an existing IT person or office manager | Bundled software licenses you don’t understand or need |
| Full-Service MSP | $100–$175/user/month | Complete IT outsourcing: helpdesk, infrastructure, security, compliance | Compliance-heavy industries, multi-site operations, no internal IT | Vague SLA language and no data ownership clause on termination |
Key takeaway: Your MSP tier should be determined by your compliance exposure and internal IT capacity — not by what a vendor’s sales team is incentivized to close.
Is Break-Fix IT Support Ever the Right Answer for a Small Business?
Break-Fix IT support is a pay-per-incident model with no ongoing contract, no proactive monitoring, and no guaranteed response time. You call when something breaks; you pay the hourly rate to fix it. For a specific, narrow business profile, it’s genuinely the right answer.
Verdict: Best for solo operators and micro-businesses (fewer than 5 employees) with no sensitive data obligations and minimal downtime risk.
The honest case for break-fix is simple: proactive monitoring costs money every month whether anything breaks or not. If your “IT environment” is three laptops, a Wi-Fi router, and a cloud-based point-of-sale system, you’re paying for insurance you don’t need. At $125–$175 per hour for on-demand support, a micro-business that experiences two or three incidents per year spends $500–$1,500 total — versus $10,800+ annually for even a basic managed IT contract.
Here’s where break-fix falls apart fast. The moment your business touches protected health information (PHI), payment card data, or operates under any regulatory framework — HIPAA, PCI-DSS, CMMC — break-fix is no longer a cost-saving strategy. It’s a liability. HIPAA’s Security Rule requires documented, ongoing risk analysis and technical safeguards. A reactive IT model produces neither. The HHS Office for Civil Rights has levied settlements against covered entities specifically because their IT support was ad hoc rather than managed. For more details, see our guide on MSP vs traditional IT support comparison.
The other break-fix failure mode is ransomware. I’ve seen this pattern repeatedly: a business owner runs lean on IT costs for years, gets hit with a ransomware event, and the recovery bill — forensics, data restoration, downtime, potential regulatory fines — runs $40,000 to $200,000. That’s not a hypothetical range. The IBM Cost of a Data Breach Report 2024 puts the average breach cost for businesses with fewer than 500 employees at $3.31 million when you include full business impact.
Watch for this specific vendor behavior: MSPs that offer “break-fix with a monitoring add-on for just $99/month.” That monitoring add-on is a foot in the door. Within 90 days, you’re being upsold endpoint detection, backup, and patch management — each billed separately — until your “break-fix” arrangement costs more than a co-managed contract would have from the start.
Key takeaway: Break-fix is cost-effective only for micro-businesses with no compliance obligations and low downtime sensitivity — the moment either condition changes, the model creates more financial risk than it saves.
When Does Co-Managed IT Win Over Full Outsourcing?
Co-managed IT services is a model where an MSP supplements an existing internal IT staff member or a technically capable office manager, rather than replacing them. The MSP handles the heavy infrastructure — helpdesk escalations, patch management, security operations center (SOC) access, and compliance tooling — while the internal person handles day-to-day user support and vendor coordination.
Verdict: Best for businesses with 15–75 employees that have outgrown break-fix but aren’t ready for full IT outsourcing — particularly professional services firms with compliance exposure.
[IMAGE: alt=”Side-by-side checklist showing what co-managed IT should include versus common vendor upsells to question” | filename=”co-managed-it-checklist-vs-upsells.jpg”]
Co-managed contracts in the US market typically run $800–$2,500 per month depending on seat count and the specific technology stack the MSP manages. What should that actually include? At minimum: 24/7 remote monitoring and management (RMM), a shared helpdesk for tier-2 and tier-3 escalations, patch management across servers and endpoints, and a documented incident response path. Some agreements include SOC access — meaning your environment is monitored by a security operations team — and virtual CISO (vCISO) advisory hours for compliance planning. For more details, see our guide on evaluating MSP tools and platform capabilities.
The use case where co-managed clearly wins is a law firm, CPA practice, or engineering consultancy with 25 to 60 employees. These businesses have an office manager or junior IT coordinator who handles printer issues and new user setups, but they don’t have the internal expertise to manage a SIEM, conduct quarterly vulnerability scans, or produce the documentation an external audit requires. Co-managed fills that gap without the cost of a full-service engagement.
Thing is, vendors routinely inflate co-managed agreements with software licenses the client doesn’t understand and may not need. Endpoint Detection and Response (EDR), Security Information and Event Management (SIEM), and Mobile Device Management (MDM) are legitimate tools — but each adds $8–$25 per user per month to your bill. Before signing, ask the vendor to explain, in plain language, what each tool does and what specific risk it addresses for your environment. If they can’t answer that clearly, the tool is probably there to pad margin.
According to CompTIA’s 2024 MSP industry report, 61% of SMBs that switched MSPs cited “services that didn’t match actual needs” as the primary reason. Co-managed agreements are the most frequent source of that mismatch — because vendors often sell a full stack to businesses that only need half of it.
Key takeaway: Co-managed IT is the most cost-efficient model for growth-stage SMBs with existing internal IT capacity — but only when the agreement is scoped to your actual compliance requirements, not the vendor’s standard package.
What Does Full-Service Managed IT Actually Cover — and When Is It Overkill?
Full-service managed IT (sometimes called all-in MSP) is complete outsourcing of IT operations: helpdesk, infrastructure management, cybersecurity, compliance support, and strategic planning through a virtual CIO or vCISO function. You have no internal IT staff — the MSP is your IT department.
Verdict: Best for compliance-heavy industries (HIPAA, CMMC, PCI-DSS), multi-location operations, or businesses with no internal IT capacity and real regulatory consequences for failure.
Full-service agreements in the US market run $100–$175 per user per month. What justifies the top of that range? Documented SLA penalties (not just promises), after-hours NOC coverage staffed internally rather than outsourced to a third-party call center, quarterly compliance reviews, and a vCISO who actually knows your industry’s regulatory framework. A healthcare practice under HIPAA or a defense contractor pursuing CMMC Level 2 certification needs that depth. A 10-person marketing agency does not.
I’ll be honest about where full-service loses: vendor dependency is a real risk that most MSP sales conversations never address. If your entire IT operation lives inside an MSP’s proprietary tools and documentation, switching providers becomes painful and expensive. Before signing any full-service agreement, negotiate three things explicitly: data ownership language (your data is yours, period), a documented offboarding process with a specific timeline (30–60 days is reasonable), and disclosure of any subcontractors handling services listed in the agreement.
The NIST Cybersecurity Framework provides a useful lens here: a credible full-service MSP should be able to map their service delivery to the CSF’s five functions — Identify, Protect, Detect, Respond, Recover — with specific tools and processes for each. If a vendor can’t do that mapping during the sales process, their “full-service” claim is marketing language, not operational reality.
One thing that surprised me early in evaluating MSP contracts: the SLA response time guarantees that look impressive in the proposal often have carve-outs buried in the appendix. “4-hour response” frequently means 4 business hours, excludes weekends, and applies only to priority-1 incidents as defined by the vendor — not as you’d define them. Read the SLA definitions section before anything else.
Key takeaway: Full-service managed IT is the right model when compliance obligations or operational complexity genuinely require it — but negotiate data ownership, offboarding terms, and SLA definitions before signing, or you’re accepting significant lock-in risk.
How Do You Match Your Business to the Right MSP Tier?
The decision framework is simpler than vendors want it to be. Answer three questions honestly:
- What is your compliance exposure? If you handle PHI (HIPAA), payment card data (PCI-DSS), or federal contract information (CMMC), you need at minimum co-managed IT with documented security controls — and likely full-service. If you have no regulatory obligations, break-fix or co-managed is sufficient.
- What is your internal IT capacity? Zero internal IT staff points toward full-service. One capable internal person points toward co-managed. A fully staffed internal IT team that just needs security augmentation may need only a SOC-as-a-service agreement, not an MSP at all.
- What does unplanned downtime actually cost you per hour? Calculate this before any vendor conversation. If an hour of downtime costs your business $500, a $150/month monitoring service pays for itself in the first prevented incident. If downtime costs $50, the math is different.
[IMAGE: alt=”Decision tree flowchart mapping business size, compliance exposure, and internal IT capacity to the correct MSP service tier” | filename=”msp-tier-decision-framework-flowchart.jpg”]
Industry-specific guidance, briefly: healthcare practices should treat full-service as the baseline given HIPAA’s technical safeguard requirements. Law firms and CPA practices — where bar association and IRS data security rules apply — typically land in co-managed. Construction and logistics firms with project-based IT needs often do well with co-managed. Any business handling card-present transactions needs PCI-DSS scope addressed explicitly in whatever agreement they sign, regardless of tier.
Any reputable MSP should conduct a discovery call and environment audit before quoting. If a vendor sends you a proposal without asking about your current infrastructure, employee count, compliance obligations, and existing security tools, that proposal is a template — not an assessment. Walk away.
Key takeaway: Your MSP tier decision should follow from compliance exposure and internal IT capacity — in that order — not from a vendor’s standard package options.
What Questions Should You Ask an MSP Before Signing?
These eight questions will surface more useful information than any sales presentation. Ask them in writing and request written answers — vague verbal responses during a demo are not commitments.
- What does your SLA actually guarantee, and what are the financial penalties if you miss it? A real SLA has teeth. “We’ll do our best” is not an SLA.
- Who owns my data if I terminate the contract, and how long does offboarding take? The answer should be: you own your data, always, and offboarding takes 30–60 days with documented handoff procedures.
- Are you using subcontractors for any services listed in this agreement? NOC coverage, helpdesk, and SOC services are frequently outsourced. You have a right to know who’s actually touching your environment.
- What cybersecurity tools do you manage, and do I pay separately for each? Get a complete list of every software license in the agreement and its per-user cost. Compare that against the CIS Controls to determine whether the stack is justified for your risk profile.
- Have you worked with businesses in my industry, and can you demonstrate familiarity with our compliance requirements? Ask for a specific example — not a case study PDF, but a conversation about how they handled a compliance audit or incident response for a similar client.
- How do you handle after-hours incidents — internal NOC or outsourced? If after-hours coverage is outsourced to a third-party call center, your incident response at 2 a.m. on a Saturday depends on a vendor your MSP contracted with, not their own staff.
- Can I see a sample monthly report, and what metrics do you track? Reporting should include patch compliance rates, ticket resolution times, security event summaries, and uptime metrics — not just a count of tickets closed.
- What happens if my business outgrows your capacity? MSPs have service ceilings. A 10-person shop that grows to 80 employees may exceed what a small MSP can support. Know the answer before you’re locked into a 3-year contract.
[IMAGE: alt=”Printable MSP vendor evaluation checklist with eight questions for SMB technology decision-makers” | filename=”msp-vendor-evaluation-checklist.jpg”]
Key takeaway: Written answers to these eight questions will reveal more about an MSP’s actual service delivery than any sales presentation — and create a paper trail if the vendor later fails to perform.
Frequently Asked Questions: MSP Evaluation for SMBs
What is the difference between co-managed IT and full-service managed IT?
Co-managed IT supplements an existing internal IT staff member or office manager — the MSP handles infrastructure, security monitoring, and compliance tooling while your internal person manages day-to-day user support. Full-service managed IT replaces internal IT entirely, with the MSP serving as your complete IT department. Co-managed typically costs $800–$2,500 per month; full-service runs $100–$175 per user per month. For more details, see our guide on when to transition from in-house IT to managed services.
How do I know if my business actually needs managed IT services or just break-fix support?
The clearest indicator is compliance exposure. If your business handles protected health information, payment card data, or federal contract information, break-fix IT is insufficient — regulatory frameworks like HIPAA and PCI-DSS require documented, ongoing security controls that a reactive model can’t produce. If you have no compliance obligations and fewer than five employees, break-fix may be genuinely adequate.
What should an MSP SLA include?
A credible MSP Service Level Agreement (SLA) should specify response time guarantees for each incident priority level (P1 through P4), define what constitutes each priority level, state the financial penalties for missing those guarantees, and clarify whether response times are measured in business hours or calendar hours. It should also address after-hours coverage scope and escalation procedures. Any SLA that lacks penalty clauses is a statement of intent, not a contractual commitment.
Is it common for MSPs to use subcontractors for helpdesk or NOC services?
Yes — and more common than most SMB buyers realize. According to CompTIA’s MSP Industry Outlook, a significant percentage of MSPs outsource after-hours NOC coverage, tier-1 helpdesk, and SOC monitoring to third-party providers. This isn’t inherently problematic, but you should know which services are delivered by the MSP’s own staff versus contracted vendors — particularly for security-sensitive functions.
What’s the biggest mistake SMBs make when evaluating MSPs?
Evaluating on price per user without understanding what’s included — or excluded. A $75/user/month agreement that excludes after-hours support, security tooling, and compliance reporting will cost more in incident response and audit remediation than a $150/user/month agreement that covers those functions. Compare total cost of ownership across a 12-month period, not the monthly line item on the proposal.
Ready to apply this framework to a specific vendor proposal? Compare MSP contract structures, SLA language, and security stack requirements in our MSP Contract Red Flags Roundup — a detailed analysis of the clauses that cost SMBs the most money after signing.