Co-Managed IT Services: Your IT Person Stays, We Take the Rest

Home Solutions

Most practices with an IT person didn’t plan to have one. A BIM lead inherited the servers, or a systems administrator who joined for the Revit deployment stayed for a decade and now carries the whole environment in their head. They’re good, but they’re one person, they can’t be on call every night, and there are things a forty-seat practice needs that no single person can keep current: security tooling, cloud architecture, disaster recovery that’s been tested.

Co-managed IT services, or co-managed services, are a shared responsibility model: a managed IT provider works alongside that person rather than around them. They keep day-to-day operational ownership, the relationships and the decisions about how the practice works. We take escalation, specialist engineering and the parts of the environment that need a team. We’re NexSys, a managed service provider built for architecture, engineering and construction firms, and we’ve done this since 2013.

Book a Strategic Review

Call 1300 733 010

The co-managed model: what your internal IT staff keep, and what we take

Your person keeps the tickets, the onboarding, the printers, the relationship with the BIM manager, the CAD and BIM licensing decisions, the project file structures: the daily operations, and everything that needs someone who knows which project is due Friday. What comes to us needs a team rather than a person: advanced cloud architecture, security monitoring and response, network monitoring and network management, disaster recovery design and testing, infrastructure management and optimisation, and the pages at two in the morning. That work needs enterprise grade tools and someone awake, and the internal IT capability you already have is why the arrangement works.

The boundary goes in writing before anything starts, which sounds too obvious to mention, except that almost nobody does it, and that’s why most co-managed arrangements fall over. Without it, the internal person assumes we’re watching the backups and we assume they are. A ransomware event settles the argument. So the roles sit in the agreement, by name, reviewed every quarter.

An external provider staffed by people who have been the internal IT person

Long Vo, who runs our service desk, was National IT Manager at Hames Sharley before he came to us. He has been the internal person. He knows what it feels like when a provider talks past you to the directors, and he runs the desk so that doesn’t happen here. Russell Swainston did more than ten years at Cox Architecture as National Service IT Manager before joining our Microsoft and automation team, and David O’Brien, now our IT project manager, grew the infrastructure at DKO Architecture and ASPECT Studios to eight studios.

We mention the résumés because co-managed IT almost never breaks on the technology. It breaks when the provider decides the internal person is in the way of a bigger contract, and from there it ends one of two ways: they leave, or we get shown the door. Several of our co-managed clients have had the same internal person for years. That’s what we’re after. If your internal IT is a contractor with one foot out already, this is the wrong product, and we’d rather say that now than after you’ve signed.

Where in-house IT usually needs backup: security, incident response, disaster recovery and after-hours coverage

Whether the internal team is one person stretched thin or an IT department of four, the same three gaps turn up in nearly every engagement, and security tooling is the first. Tier 1 builders and government clients now ask consultants to state their Essential Eight maturity level, and the tooling behind Maturity Level Two (threat detection and incident response, application control, privileged access management) costs about as much to run for one practice as for twenty. A forty-seat firm can’t justify that alone. A provider spreading it across many can, so we run the tooling and your person owns the policy.

Disaster recovery is the second. Most practices have backups. A smaller group has restored a live central model from them, and a much smaller group can show that a compromised account couldn’t delete the backup along with the data, which is the Maturity Level Two test. With the Australian Signals Directorate’s 2024–25 report putting the average self-reported cost of a cybercrime for a medium business at $97,200, up 55 per cent in a year, that difference is money. We design and test the recovery, your person signs off the recovery time, and both names go on it.

After-hours is the third, and it decides whether your person is still there in two years, because nobody can be on call every night. Our 24/7 service desk takes the night and weekend pages, escalates to your person only when the agreed escalation paths say to, and leaves a written summary for the morning, so the 2am printer call comes to us.

Co-managed versus fully managed: cost efficiency, and what growing businesses gain access to

Co-managed is priced on the defined scope rather than a per-seat rate that assumes we’re doing everything, so it sits below a fully managed contract, and with someone good already in the chair it’s the more cost effective support model. The invoice isn’t where the real saving is, though. It’s the specialised expertise and extra capacity you don’t hire for the cloud migration or the next major project, the security platform you don’t have to buy and run alone, and the internal person who stays because the job became sustainable. The number for each area is on the table before anyone signs, and the scope can move either way at the quarterly review.

The strategic side is included rather than sold separately: quarterly governance sessions reporting on response times, ticket patterns, infrastructure health and security posture, so your person walks into the leadership meeting with a roadmap.

How a co-managed arrangement starts

It starts with a systems audit, and your internal person is in the room for it, because the point is to find the gaps, not to grade their work. The split is drafted from what the audit finds, talked through with them before the directors see it, then written into the agreement. The first ninety days run with a weekly check-in, where the boundary meets real tickets and gets adjusted. Most practices turn up two or three things nobody owned. Finding them is the arrangement working.

Questions internal IT managers ask first

What's the difference between co-managed and fully managed IT?

Fully managed means we run everything and there’s no internal IT role. Co-managed means your person keeps day-to-day ownership and we take defined areas, usually infrastructure, security tooling, disaster recovery and after-hours cover, with the boundary written into the agreement.

Is this a step towards replacing me?

Not with us. Most of our co-managed clients have had the same internal person for years; the arrangement is designed to make that job sustainable, not redundant. If it’s one contractor who wants to leave, co-managed is the wrong product and we’ll say so.

When does a business need co-managed IT rather than more internal staff?

When the gaps are specialist depth and after-hours coverage rather than hours. A second generalist doesn’t buy a security platform, a tested disaster recovery plan or someone awake at 2am, and many organisations of thirty to a hundred people find co-managed scales support as the business grows without a second salary. When the gap is volume during busy periods, hire.

Does co-managed IT reduce risk, or just move it?

It reduces it, provided the boundary is written down. Threat detection, proactive monitoring and incident response run on enterprise-grade tools your internal team gains access to without buying them, and decisions on what to change stay with the people who know the business. What moves is the 2am page. That’s the point.