Managed IT vs Break-Fix

The break-fix / managed-IT debate isn’t really about IT services — it’s about who carries the risk of something going wrong. That’s the lens that makes the choice obvious in most cases.

How break-fix actually works in practice

You hire an IT firm. They have your phone number. When something breaks, you call. They show up, fix it, send an invoice for the hours. In a calm year, you might spend almost nothing. In a bad year — a ransomware infection, a failed server, a compromised email account — you can easily spend more in one month than a full year of a managed contract would have cost.

The incentive problem is structural: the IT firm gets paid for emergencies. They have no financial motivation to invest unpaid time preventing those emergencies. Patching, monitoring, backup verification, MFA rollouts, security awareness training — all the unsexy work that prevents incidents — doesn’t generate billable hours. So it doesn’t get done.

How managed IT actually works in practice

You sign a contract that says the IT firm is responsible for keeping your environment running. They charge you a flat fee — usually per user or per device per month. In exchange, they’re on the hook for the time it takes to keep things running smoothly.

Now the incentives flip. Every after-hours emergency eats into the IT firm’s margin on your contract. Every preventable incident is money out of their pocket. So they patch promptly, watch monitoring alerts, test backups, and push you toward MFA — not because they’re saintly but because the contract makes those things their problem.

The hidden cost of break-fix: cyber-insurance and compliance

This used to be a soft argument; it’s now a hard one. Cyber-insurance underwriters in the last few years have tightened their requirements dramatically. They want to see:

• MFA on every administrative and email account
• EDR (endpoint detection and response) deployed and managed
• Documented patching cadence
• Backup test-restore evidence
• An MSP attestation that someone is actually responsible for this

A break-fix shop can spin those up as a project, but they tend to drift after the project ends because nobody is contractually maintaining them. Managed clients have those controls in their contract as continuous operations, which is what the underwriters actually want to see.

Same story with HIPAA, PCI DSS, and SOC 2 work — these are not one-time projects, they’re ongoing posture, and ongoing posture fits the managed model.

Where break-fix still makes sense

Honest answer: there are businesses for which break-fix is the right call.

• Solo operators or 2-3 person shops where the cost of any managed contract exceeds the realistic cost of bad luck
• Businesses with strong internal IT that just need a specialist on call for niche issues (firewalls, cloud architecture, compliance audits)
• Project work — even if you’re a managed client elsewhere, one-off cloud migrations and major buildouts often get scoped as separate projects

What we actually recommend

If you have more than ~10 employees, compliance pressure, or a cyber-insurance policy you’d like to keep renewable, managed IT is almost always the right model. The exception is usually that you’re a 3-person shop with no compliance exposure and an in-house tech person — in which case, break-fix on retainer for the occasional emergency is fine.

When in doubt, the test is this: imagine a ransomware infection or a 3-day server outage. Under which model do you sleep better the night before?