Somewhere between the first twenty staff and the first hundred, every business has the same argument. Do we hire somebody to look after IT, or do we pay a company to do it? It is usually framed as a cost comparison, which is why it so often produces the wrong answer.
The useful question is not which is cheaper. It is which risks you are comfortable carrying yourself.
What one person really costs
A single internal hire looks like a salary. It is not. Add recruitment, employer costs, equipment, training and certification, and the tooling they will reasonably ask for. Then add the part nobody budgets: cover.
One person cannot be on holiday, ill, asleep, or at a conference without your IT being unattended. They also cannot be an expert in everything. The modern estate spans networking, identity, cloud platforms, security, backup, telephony and a dozen applications. One generalist covers that at a certain depth, and the gaps appear precisely when something unusual happens.
And there is the quiet risk: everything they know lives in one head. We have walked into environments where the only documentation was a departed administrator’s memory, and reconstructing it cost more than three years of the salary that was saved.
Where an internal hire genuinely wins
This is not an argument that outsourcing always wins. It does not.
- Presence matters in some businesses. Manufacturing, labs, studios and warehouses have physical problems that need somebody walking the floor.
- Deep domain knowledge. If your competitive advantage sits inside a bespoke application, you want that expertise on the payroll.
- Constant change. A business reorganising continuously benefits from somebody in the room when decisions are made, not summarised afterwards.
- Culture and trust. Somebody who knows who actually needs what, and who is likely to click the wrong link, is worth a great deal.
Where outsourcing wins
- Breadth on demand. You get a firewall specialist for the afternoon you need one, rather than hoping your generalist has done it before.
- Cover is somebody else’s problem. Holidays, illness and turnover stop being your operational risk.
- Process arrives with the people. Ticketing, monitoring, patching, documentation and reporting are already built. An internal hire has to construct all of that while also answering the phone.
- Pattern recognition. A provider seeing fifty environments spots the thing that is about to break because it broke somewhere else last month.
The option most businesses do not know exists
Co-managed IT is the arrangement that fits a surprising number of organisations, and almost nobody asks for it by name because they do not know it is available.
Your internal person keeps the relationships, the day-to-day and the business context. The provider supplies the tooling, the out-of-hours cover, the specialists, and a second pair of eyes on anything significant. The internal hire stops being a single point of failure and starts being the part of the function that genuinely benefits from being internal.
The common failure is not choosing wrongly between hiring and outsourcing. It is hiring one person, giving them everything, and calling that an IT department.
Questions that settle it
- What happens at 2am? If the honest answer is nothing until morning, decide whether that is acceptable, and write it down either way.
- Who covers the three weeks in August? If there is no answer, you do not have a function, you have a person.
- Could somebody else run this from your documentation? If not, that is the first thing to fix, whichever model you choose.
- What are you asking them not to do? Every hour on password resets is an hour not spent on the patching, backup testing and access reviews that actually reduce risk.
- Who is accountable for security specifically? It is a distinct discipline, and it is the one that quietly gets dropped when somebody is busy.
Whatever you choose, the operational basics do not change. Somebody has to own a tested restore and a rehearsed plan for the day the office is unavailable, as in The Building Is Shut. Somebody has to own patch cadence across the estate, as in Vulnerability Remediation. And somebody has to own the endpoints that leave the building every evening, as in The Right Tech for the Job. Those jobs exist whether the person doing them is on your payroll or ours.
Decide what you want to own, be honest about what you are not covering, and pick the model that closes the gap. One capable person with the right support behind them beats both a lone hire and a faceless contract.