Every business that depends on computers eventually has to answer a simple question: when something goes wrong with our technology, who fixes it, and how do we pay for it? For small and midsize companies without a large internal IT team, the answer usually falls into one of two models: break-fix support or managed services. They differ in when work happens, how it is billed and who is responsible for preventing problems.
This article explains both models, compares them side by side and lists the questions worth asking before you commit to either.
What is break-fix IT support?
Break-fix is the traditional way of buying IT help. As TechTarget describes it, services are provided only when needed, usually after something has broken. The business contacts an IT provider when a problem appears and pays for the time and materials required to fix it. Fees may be hourly, or a flat rate for a specific job such as virus removal or data recovery.
There is no ongoing engagement. Once the problem is resolved, the relationship pauses until the next call.
The drawbacks
TechTarget lists three common criticisms of the model:
- It is reactive. Problems are addressed only after they occur, which can mean longer downtime.
- Costs are unpredictable. A quiet month costs little, but a serious failure can arrive with a large, unplanned bill.
- Incentives are misaligned. A provider paid per incident earns more when things break, so there is little built-in reason to prevent problems.
What are managed services?
TechTarget defines a managed service provider (MSP) as a third-party company that remotely manages a customer's IT infrastructure and end-user systems. Instead of waiting for a call, the MSP takes ongoing responsibility for a defined set of services, which, per TechTarget, may include network and infrastructure management, security, monitoring, scheduled maintenance and technical support for internal staff.
Two features define the model:
- A subscription fee. MSPs commonly bill monthly, often as a flat fee per user or per device.
- A service-level agreement (SLA). The SLA documents what the customer can expect: which systems are covered, response times, reporting and so on.
Because an MSP is paid through a recurring arrangement, the contract can give the provider a reason to reduce avoidable incidents rather than waiting for billable repairs. Actual incentives depend on the scope and terms of the agreement.
Side-by-side comparison
| Break-fix | Managed services | |
|---|---|---|
| When work happens | After a problem is reported | Continuously, including preventive maintenance and monitoring |
| Billing | Time and materials, or flat fee per job | Recurring subscription (often monthly) |
| Cost predictability | Low; varies with incidents | Higher; typically a recurring fee for a defined scope |
| Provider incentive | Paid per incident; prevention is not built into the billing model | Recurring arrangement can support prevention, depending on contract |
| Ongoing relationship | None between calls | Continuous |
Common misconceptions
"Managed services means everything is included." Not necessarily. An MSP contract covers what the SLA says it covers. New projects, hardware purchases or support for systems outside the agreement may be billed separately. Read the scope carefully.
"Break-fix is always cheaper." It can be cheaper in a quiet year, and more expensive in a bad one. The real comparison is between a predictable fixed cost and a variable one, plus the business cost of downtime while waiting for a fix.
"Handing IT to an MSP removes all risk." Outsourcing management does not outsource accountability for your data. The 2022 joint advisory discussed below warns that threat actors can use a vulnerable MSP as an initial access vector to multiple victim networks.
Security questions to ask an MSP
In 2022, cybersecurity agencies from the United States (CISA, NSA and FBI), the United Kingdom, Australia, Canada and New Zealand issued a joint advisory on threats to managed service providers and their customers. Its recommendations for customers translate into practical questions to raise before signing:
- Who is responsible for what? The contract should state whether the MSP or the customer handles tasks such as system hardening, threat detection and incident response, and how and when the MSP will notify you of an incident.
- Is multi-factor authentication required? The advisory recommends requiring MFA on the services you receive and on the MSP accounts used to access your environment.
- How much access does the MSP have? MSP accounts should follow the principle of least privilege, reaching only the systems the provider actually manages.
- How are logs handled? The advisory recommends storing the most important logs for at least six months.
- What is the patching policy? The advisory recommends prioritizing security updates for software containing known exploited vulnerabilities, so ask whether the provider does.
- How are backups done and tested? The advisory recommends encrypted backups that are regularly tested and kept isolated from network connections that could enable the spread of ransomware.
- What happens when the contract ends? Accounts the MSP no longer needs should be disabled, a step the advisory notes is easy to overlook.
Hybrid arrangements
The choice is not always binary. Some providers sell block-hour (block-time) agreements, in which clients prepay for a set number of hours that are drawn down as work is done. Co-managed IT pairs an internal IT team with an external MSP.
How to decide
Ask yourself a few questions:
- How much does an hour of downtime cost us?
- Can we absorb a surprise IT bill? Break-fix can bring unexpectedly high bills during critical failures; a subscription is more predictable.
- Do we have anyone internally who watches systems day to day?
- Are we subject to security questionnaires or compliance requirements?
Bottom line
Break-fix buys repairs; managed services buys ongoing responsibility. Managed services trade a recurring fee for predictability, preventive care and a written SLA. Whichever you choose, define the scope in writing, understand who is accountable for security, and make sure you can get your data and access back if the relationship ends.
Sources
- Kaseya, "Break-Fix vs. Managed Services"
- IBM, "What are managed services?"
- CISA, NSA, FBI, NCSC-UK, ACSC, CCCS, NCSC-NZ, "Protecting Against Cyber Threats to Managed Service Providers and their Customers" (AA22-131A, May 11, 2022)
- N-able, "Why your IT business might consider selling block-time agreements"
- Centrex IT, "What is co-managed IT"
