Co-Managed IT: The Real Growth Path Beyond Break-Fix

Most break-fix clients do not jump straight to fully managed. The real growth channel right now is co-managed IT, where an internal IT department keeps strategy and stays on staff while an MSP takes over the operational load that team can no longer cover alone. MSPs still selling only fully managed or nothing are leaving that gap open.

What Is Co-Managed IT, and How Is It Different From Fully Managed?

Co-managed IT is a defined split of responsibility between an internal IT team and an MSP, not a lighter version of full outsourcing. The internal team keeps strategy, vendor negotiation, budget ownership, and executive relationships. The MSP takes on helpdesk volume, monitoring, patching, endpoint security operations, and after-hours coverage.

That split matters commercially. A fully managed sale asks a company to hand over IT entirely, which is a hard conversation with a business that already employs IT staff and has no intention of laying them off. A co-managed sale asks for something narrower: take the parts our team cannot keep up with. CompTIA's Trends in Managed Services research found that roughly six in ten managed services engagements are already structured as a collaborative arrangement with the customer's internal IT department, and that 68 percent of MSPs now offer a co-managed package. This is not a niche add-on anymore. It is close to the median way managed services actually gets sold into companies with any in-house IT presence.

Why Is Co-Managed IT Growing Right Now?

Co-managed IT is growing because internal IT teams are under budget pressure, not primarily because they cannot find people to hire. ISC2's 2025 Cybersecurity Workforce Study found the global cybersecurity workforce gap reached a record 4.8 million unfilled roles, up 19 percent year over year, and for the first time in the study's history, economic pressure and budget cuts outranked lack of qualified talent as the leading driver of staffing shortfalls.

That distinction changes how you sell. A prospect who cannot find candidates is receptive to "we already have the people." A prospect who has a hiring freeze or a flat headcount budget is receptive to "we let your one or two IT staff cover ten times the ground." The pitch is capacity, not scarcity, and it works on companies that were never going to eliminate their IT department in the first place.

The revenue is following. Kaseya's 2025 Global MSP Benchmark Report found that 61 percent of MSP executives reported co-managed IT revenue was up year over year, and two-thirds of MSPs now pull as much as half of their total revenue from co-managed arrangements. That is a meaningfully different number than a side hustle. For an MSP owner still treating co-managed as a discount tier on the way to a full takeover, it is worth reading as its own line of business with its own growth curve.

What Does a Co-Managed Engagement Actually Look Like?

A working co-managed engagement runs on a written responsibility matrix, not a verbal understanding. Without one, alerting, patch failures, and after-hours incidents fall into gaps neither side notices until something breaks. The matrix names, task by task, who owns detection, who owns remediation, and who owns the client relationship for that item.

The tool stack question comes up early and needs an answer before the contract is signed. Most working arrangements have the MSP own the RMM and PSA platform, since that is where the automation, alerting, and ticket history live, and give the internal team read access plus a written data-export clause so the client is never locked out of its own device history if the relationship ends. A shared password vault and shared documentation round out the minimum viable stack. Anything less and the internal team is flying blind on what the MSP is actually doing on their network.

The Revenue and Margin Case for Your MSP

Co-managed clients are usually a better fit for automation-heavy delivery than full break-fix accounts, because the scope is narrower and more repeatable. You are not pricing an unpredictable stream of one-off incidents. You are pricing a defined slice of monitoring, patching, and Tier 1/2 resolution against a headcount and device count you already know. That is closer to how a managed contract prices than how a time-and-materials break-fix contract prices, and it is one of the reasons the segment shows up in Kaseya's data as a growing share of total MSP revenue rather than a flat one.

Pricing usually lands per device or per endpoint rather than per user, since the internal team is still handling first-line contact with staff and the MSP's cost driver is the number of machines it monitors and patches. That per-device model also caps your delivery cost more tightly than a break-fix retainer does, because the ticket volume you are responsible for is bounded by scope, not by whatever happens to break that week. A client having a bad month does not blow up your margin the way it does under time and materials.

It also changes your sales cycle. A break-fix account that has resisted a full managed pitch for two years will often say yes to "we will just take the monitoring and patching off your team's plate," because the ask is smaller and the internal IT staff sees the MSP as reinforcement rather than a replacement threat. That internal champion effect is worth more than the first contract. IT staff who keep their jobs and their titles become the people recommending you internally when the next budget cycle comes around, and they are often the ones who eventually ask you to take on more scope voluntarily.

What Goes Wrong When the Boundaries Are Fuzzy?

Most co-managed engagements that fail do not fail on price. They fail because nobody wrote down who owns what, and the gap surfaces during an incident instead of during onboarding. A patch fails at 2 a.m. and both sides assume the other was watching. A former employee's access is not revoked because the internal team assumed the MSP handled offboarding and the MSP assumed the internal team did.

The fix is not more trust. It is a shorter list, reviewed at renewal, of exactly which alerts page which party and who has final authority to make an emergency change without a ticket. Building that list into the contract, rather than leaving it as tribal knowledge between two account managers, is what keeps a co-managed account renewing instead of churning after the first bad incident makes the gap visible to the client's leadership.

Where This Fits Your Break-Fix Book

Not every break-fix client has an internal IT person, and for those accounts fully managed is still the right pitch. But any break-fix account that has one or two IT employees on staff, however overloaded, is a co-managed conversation before it is a full-takeover conversation. Leading with full replacement asks that employee to help negotiate away their own job. Leading with augmentation asks them to help you sell.

Building that offer correctly takes more than a rebadged managed contract. It needs a defined scope, a tool-access model the client's IT staff will actually trust, and a pricing structure that holds up against variable device counts. Our Forge University programs cover exactly this kind of staffing and delivery model work, built for MSP teams standing up a new service line without hiring for it from scratch.

If you are still deciding what your own service catalog should look like next to co-managed, running your current stack through our stack builder is a fast way to see where the gaps sit relative to what clients are actually asking for. And if you want to see how a co-managed offer fits alongside the rest of a white-labeled AI tool lineup, our full product catalog lays out every piece.

Co-managed IT is not a consolation prize on the way to a full managed contract. It is a distinct, growing offer with its own economics, and MSPs that build it deliberately, rather than backing into it account by account, are the ones capturing the growth Kaseya and CompTIA are both measuring. See the full stack to find where it fits next to what you already sell.

Sources: CompTIA Trends in Managed Services Study | Kaseya 2025 Global MSP Benchmark Report | ISC2 2025 Cybersecurity Workforce Study.