Choosing Managed IT Services: Co-Managed vs Fully Managed Models for Mid-Market Teams

Key takeaways

• Managed IT services now come in three common shapes: in-house with project help, co-managed, and fully managed.

• Co-managed models suit organisations with 200 to 1,500 staff that want to keep an internal IT lead but hand off 24/7 monitoring, patching and security operations.

• Cyber risk is a major driver. ASD put the average self-reported cybercrime cost for a medium Australian business at $97,200 in 2024-25, up 55%.

• Judge a provider on response times, security depth and exit terms, not on the lowest monthly fee.

Mid-market IT teams across Australia and the wider Asia Pacific region are being squeezed from two sides. Gartner forecasts Australian IT spending will pass A$192 billion in 2027, with software spend growing 13.3% while IT services grow just 3.4%. Budgets are moving toward platforms and AI, yet someone still has to run them every day. That gap is why more organisations are rethinking how they buy managed IT services.

What a Managed IT Contract Covers Today

Managed IT services are ongoing contracts where an external provider runs part or all of an organisation’s technology for a fixed monthly fee. The scope now goes well beyond the help desk. Typical contracts now include the following.

• 24/7 cloud and infrastructure monitoring, mostly across Microsoft Azure and Microsoft 365

• Patch management and endpoint security

• Security operations centre (SOC) services and incident response

• Network management across offices and remote staff

• AI operations, such as Copilot rollouts, data permissions and usage governance

Comparing the Three Operating Models

Each model trades control against cost and coverage. The table below shows how they compare for an organisation with a small internal IT team.

Co-managed arrangements are gaining ground because they keep institutional knowledge in-house. The internal IT manager still sets priorities, while the provider absorbs the round-the-clock work a small team cannot staff.

Questions to Ask Before You Sign

The right managed IT services provider is the one whose contract matches how your organisation actually operates. These five questions expose most gaps early.

• What are the guaranteed response and resolution times for priority 1 incidents?

• Is the SOC run in Australia, and where is our data held?

• How do your controls map to the Essential Eight, given ASD’s planned move to a new “Essentials” series?

• What does offboarding look like, including documentation and credential handover?

• Which tasks stay with our team, and is that written into a responsibility matrix?

Sydney-based Nexon, which has operated since 2000, is one example of a provider that runs managed services across cloud, security and networks. Whichever provider you shortlist, ask to see a sample responsibility matrix before the proposal stage.

What This Means for Mid-Market IT Leaders

The best operating model is the one that closes your specific coverage gap. If after-hours security is the weak point, a co-managed contract fixes it without giving up control. If vendor sprawl is the problem, a fully managed model with one accountable managed IT services provider simplifies reporting to the board. Map your gaps first, then pick the model.

References

• Australian Signals Directorate. (2025). Annual cyber threat report 2024-25. https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025

• Gartner. (2026, September 16). Gartner forecasts IT spending in Australia to exceed $192 billion in 2027. https://www.gartner.com/en/newsroom/press-releases/2026-09-16-gartner-forecasts-it-spending-in-australia-to-exceed-192-billion-in-2027