Most businesses switch IT models after an outage they couldn't afford, not after a cost analysis.
Maybe it was the invoice that arrived after a network failure ran into a second shift — emergency rate, four hours of drive time, plus the expedited switch. Maybe it was the third urgent call this quarter to a provider who had no idea your equipment existed until you described it over the phone. Or maybe nothing has broken badly yet and you're trying to decide before it does.
Whether you're the person approving the invoice or the person standing on the floor waiting for the network to come back, this is a comparison of two genuinely different models. One of them is right for some businesses, and we'll say which ones.
Break-fix is exactly what it sounds like. Something stops working, you call somebody, they fix it, you get a bill. Usually hourly, sometimes per incident, occasionally against a block of prepaid hours.
There's no ongoing relationship required and no continuous responsibility. Between calls, nobody is looking at your systems. The provider's knowledge of your environment is whatever they remember from last time.
Break-fix is a reasonable choice for a small office with a handful of employees, cloud-based applications, no production or fulfillment dependency on uptime, no compliance obligations, and no customer or insurer asking about security controls.
If a five-person professional office loses email for an afternoon, that's a frustrating afternoon. Work shifts around it. There's no scrap, no idled crew, no missed carrier cutoff. Paying for continuous monitoring of an environment where the cost of an outage is genuinely low isn't a smart purchase, and a provider who tells you otherwise is selling.
The trouble is that businesses often stay on break-fix well past the point where that description stopped applying to them.
Managed IT services replace the hourly transaction with a fixed monthly fee covering a defined scope: continuous monitoring, patching, security management, backup, and user support, with someone responsible for the environment between incidents rather than only during them.
The provider maintains documentation, watches systems around the clock, and does the maintenance that prevents failures instead of waiting to be paid for repairing them. Here's the full breakdown of what managed IT services include.
Three of those carry most of the argument.
The incentive point is the structural argument. Under break-fix, a provider's revenue increases when your systems fail. That's not a claim about anyone's integrity — it's how the arrangement is built. A break-fix provider who invested heavily in preventing your outages would be reducing their own billable hours. Under a fixed fee, the provider absorbs the cost of your emergencies, so preventing them is how they make money.
How problems get found determines how big they get. In a break-fix arrangement, the detection system is your employees noticing something is broken, which means every problem is discovered at the point it has already caused an impact. Monitoring finds the degrading access point, the failing drive, and the backup that stopped completing days before anyone on the floor feels it. Network security monitoring is the least visible difference between the two models and usually the most consequential.
Documentation is what you own. Break-fix arrangements tend to leave institutional knowledge in the provider's head, or worse, in one technician's head. Ask what happens if that person leaves.
Break-fix almost always looks cheaper on the monthly line, because most of its cost doesn't appear on an invoice.
The invoice shows labor hours. It doesn't show the crew standing idle, the overtime to recover the schedule, the expedited freight on a replacement switch, the order that missed its carrier cutoff, or the product scrapped while a line sat down. Those costs land in operations, not IT, which is exactly why nobody adds them up.
Don't take an industry average — run your own number. The napkin version:
(people idled × loaded labor rate) + (delayed or lost orders) + (scrap or spoilage) = your hourly cost of downtime
Run it once and the comparison usually resolves itself. A 40-person operation with a fully loaded labor rate of $38/hour is burning more than $1,500 an hour in wages alone before anything else is counted, and wages are typically the smallest term in that equation.
For context, a February 2025 survey of 715 small and mid-sized organizations by Calyptix Security and ITIC found that 37% of SMBs put their downtime cost between $1,000 and $5,000 per hour, while 8% reported more than $25,000 per hour. That survey covered organizations with 1 to 100 employees. The much larger figures you'll see quoted — ITIC's 2024 research puts mid-size and large enterprises above $300,000 per hour — describe a different class of company and don't apply at this size. ITIC's own report notes that businesses under 20 employees typically don't reach $100,000 per hour.
Put that against the cost of prevention. At the $1,520 an hour the example above produces, ten prevented hours in a year is roughly $15,000 — comparable to a full year of a mid-range managed services agreement. Most businesses that switch discover they had been absorbing considerably more than ten hours.
Two lists. Work out which one describes your operation.
If you recognized yourself in three or more of the second list, the model question is already answered. We'll go deeper on the specific warning signs in a follow-up piece.
The real obstacle isn't cost. It's the assumption that transitioning will be disruptive, so the decision gets deferred until an outage forces it.
In practice it runs in four stages. Assessment and discovery, where a provider inventories what you have and documents how it connects. Tooling deployment — monitoring agents, endpoint security, backup verification. A transition period where the new provider takes over operations, typically with the outgoing arrangement still available. Then steady state. Weeks, not months, and the disruptive part is mostly answering questions.
One thing worth knowing: a competent provider will assess before quoting, not after. That assessment produces a documented inventory and network map, which is genuinely useful whether or not you sign anything. If a provider will quote you a monthly number without looking at your environment first, they're guessing, and you'll meet the real number later as a change order.
Is managed IT more expensive than break-fix?
Higher monthly cost, frequently lower total cost. Break-fix concentrates spending into unpredictable emergencies and leaves the downtime cost in operations where it's rarely counted against the IT budget. The comparison only makes sense if you include the cost of the outages that didn't get prevented.
Can we use a hybrid of the two?
Yes, and many businesses do. Common arrangements put critical infrastructure — network, servers, security, backup — under a managed agreement while handling desktop support or project work hourly. Co-managed IT is a structured version of this for companies with internal IT staff.
What happens to our current IT provider or internal IT person?
If you have an internal IT person, a co-managed arrangement is usually designed to support them rather than replace them — they keep applications, users, and projects while the provider takes monitoring, security, and after-hours coverage. If you're replacing an outside provider, the main thing to secure is documentation: make sure your environment details transfer to you, not just to the next vendor.
If you're weighing the two models, the most useful next step is an assessment: what you actually have, where the risk sits, and what an outage would cost you. CTC Technologies has been doing this for Michigan businesses since 2004, and we'll give you the network documentation either way.
Request an IT assessment or call 734-408-0200. Managed IT is available across Michigan, including Troy, Warren, and Detroit.
Manufacturers, one more read: if you've already moved past break-fix and are now weighing a standard MSP against a full-service IT partner, that's a different question with different stakes. We take it apart here.
