IT support fixes what broke. Managed IT is paid to stop it breaking, and takes on the monitoring, patching, security and reporting that come with that promise. Break-fix bills by the hour after the fact. Managed IT bills a flat per-user rate every month whether the month was quiet or awful. Texas SB 2610 and cyber insurance underwriting have both moved the line since 2025, and they moved it in the same direction.
IT support is reactive and billed by the hour after something fails. Managed IT is a fixed monthly contract where the provider owns uptime, security and patching, so preventing the failure is their problem rather than your invoice. For most Texas businesses past roughly 15 people, or holding any regulated data at all, managed IT is the model that survives an insurance renewal.
This post sits underneath our managed IT services overview and answers the question people actually type before they get to a pricing page. Which model do I need. Not which is better in the abstract, because that question has no honest answer. A 6-person title company and a 90-person fabricator in Pasadena need different things, and any provider who tells you otherwise is selling one thing.
We publish our own rates, so the cost sections below use real numbers rather than the vague ranges most comparison posts hide behind. Where we think break-fix is still defensible, we say so.
Managed IT and IT support, defined
Managed IT is an ongoing contract in which a provider takes responsibility for a defined set of systems for a flat recurring fee, usually per user per month. IT support is the delivery of help when something goes wrong, whether that arrives inside a managed contract or is bought by the hour on its own.
That wording matters because the two words are not opposites. Support is a component. Managed IT is a commercial model that contains support plus everything that reduces how often you need it. When somebody says they want to compare managed IT against IT support, what they usually mean is a comparison of managed services against break-fix, and that is the comparison we run below. Our older explainer on the difference between IT support and managed services covers the same ground without the Texas angle, and what IT support actually includes breaks down the tiers.
Side by side, on the things that change your bill
| Dimension | Break-fix IT support | Managed IT |
|---|---|---|
| Trigger | You call after something breaks | Monitoring alerts before you notice |
| Billing | Hourly, per incident, plus parts | Flat per user per month |
| Provider incentive | More tickets means more revenue | Fewer tickets protects margin |
| Patching | Whenever someone gets to it | Scheduled and reported |
| Security stack | Usually your problem | Included and centrally managed |
| Documentation | Lives in a technician’s head | Maintained as a deliverable |
| After-hours | Emergency rate if available | Defined in the SLA |
| Evidence for auditors | Invoices | Reports, logs and policy records |
| Budget behaviour | Spiky and unforecastable | Predictable line item |
Look down the incentive row again. It is the only row that explains all the others. Everything else follows from who absorbs the cost of a bad month.
The real difference is who owns the outcome
Under break-fix, you own the outcome and rent the hands. You decide when a server is old enough to replace, whether that firewall warning matters, and how long a backup can go untested. The technician is skilled and probably very good. They are also not paid to think about your environment on a Tuesday when nothing is wrong.
Under managed IT, the provider owns the outcome. If they skip patching and a workstation gets encrypted, they carry the remediation inside a fee they already collected. That single structural fact drives the behaviour people describe as proactive. It is not virtue. It is margin protection, and it happens to line up with what you want.
The failure mode is worth naming too. A managed contract with a weak scope gives you the flat fee without the ownership, because everything meaningful sits in an exclusions list. We wrote about that pattern in what is actually included in managed IT services. Read any proposal’s exclusions before you read its inclusions. The exclusions are where the truth lives.
What each model costs a Texas business in 2026
Break-fix rates quoted across Texas metros generally land between $125 and $250 an hour, with after-hours and emergency work at the top of that band. Nothing recurs, which is the appeal. You pay when you need someone.
Managed IT runs $125 to $225 per user per month across the Texas market for a fully managed engagement. Our own published rates start at $91 for remote-only essentials and $138 for fully managed, with co-managed at $100 and a security-only tier at $40. Every figure and what sits behind it is on our Texas managed IT pricing page, which is unusual mostly because so few providers publish anything.
The arithmetic most comparisons skip
Take a 25-person company. Fully managed at $138 costs $3,450 a month, so $41,400 a year. To spend that on break-fix at $175 an hour you would need to buy 237 hours, which is about 4.5 hours of technician time every week of the year.
Plenty of 25-person companies genuinely do not consume 4.5 hours a week. On hours alone, break-fix wins for them, and any provider claiming otherwise is doing bad arithmetic in public. What breaks the comparison is that the two numbers do not buy the same thing. The $41,400 includes the security stack, the patching cadence, the backup testing, the documentation and the reporting. The 237 hours include none of it. Add licensed EDR, cloud backup, email security and a password manager to the break-fix side and you have added $30 to $50 per user per month before anyone has touched a keyboard.
A fairer way to run the numbers. Price the managed quote against your hourly spend plus your current tool licensing plus one incident. Not one catastrophic incident, just one ordinary one. A ransomware-free week where a bad update takes down accounting for a day is enough to move most 25-person comparisons, and it happens more often than the catastrophic version.
Texas SB 2610 moved the line on 1 September 2025
This is the part that makes the question Texas-specific rather than generic. Senate Bill 2610 added Chapter 542 to the Business and Commerce Code and took effect on 1 September 2025. It gives businesses under 250 employees that hold sensitive personal information a safe harbor against exemplary damages after a breach, but only if a qualifying cybersecurity program was already in place when the breach happened.
The obligations scale with headcount, and the middle tier is the one that reshapes this decision.
| Employees | What the statute expects | Can break-fix realistically deliver it |
|---|---|---|
| Under 20 | Password policies and employee cybersecurity training | Yes, with discipline and documentation |
| 20 to 99 | CIS Controls Implementation Group 1 | Rarely, and never without someone owning it |
| 100 to 249 | A recognised framework such as NIST CSF, ISO/IEC 27001, CIS Controls or FedRAMP | No |
IG1 is 56 safeguards that CIS calls essential cyber hygiene. Read the list and the problem becomes obvious. Asset inventory, continuous vulnerability management, audit log management, secure configuration, account management. None of those are events. They are all running processes with an owner and a record, and an hourly technician you call three times a year is not that owner.
Worth being precise about what the safe harbor does. It blocks exemplary damages. Compensatory damages and regulatory enforcement carry on untouched, and the program has to predate the incident. Standing one up after the letter arrives buys nothing. If you want the deeper walkthrough, our Texas SB 2610 compliance guide covers the documentation side.
Cyber insurance is the second forcing function
Underwriting changed faster than the law did. Carriers now expect enforced multi-factor authentication across email, VPN, remote desktop and every privileged account, plus endpoint detection and response monitored around the clock rather than merely installed. Written attestation is no longer enough at renewal on most desks. They want exported sign-in logs, conditional access configuration, or a signed letter from your IT provider.
That last requirement is the quiet one. An hourly technician cannot sign a letter about controls they do not maintain and cannot see. This is where we watch break-fix relationships end, and it is almost never a dramatic ending. A renewal questionnaire arrives, three questions cannot be answered, the premium jumps or the quote is declined, and someone starts calling providers in September for a January renewal.
The underlying risk is not theoretical either. Business email compromise stays near the top of the loss tables every year in the FBI’s Internet Crime Report, and almost none of it requires malware. It requires one mailbox, a plausible reply, and nobody watching the account. Carriers price that reality into every renewal, which is why they now ask for evidence instead of assurances.
If your renewal is inside 90 days, pull the questionnaire out now and answer it honestly on paper. Whatever you cannot evidence is your actual scope requirement, and it is a far better brief than any provider’s standard proposal.
Which one you need right now
Headcount is a weak signal on its own. These are the conditions that actually decide it, and any single one of them is usually enough.
Choose managed IT when any of these are true
- You hold regulated or sensitive data, including PHI, cardholder data, client financials or legal matter files.
- You employ 20 or more people, which puts CIS IG1 in scope under SB 2610.
- You carry cyber insurance, or you are about to be asked to.
- A day of downtime has a number attached to it that you would not want to explain to a partner.
- You run more than one location, or a meaningful share of staff work remotely.
- Your contracts or your clients impose security requirements on you.
- Nobody internally can name when the backups were last restore-tested.
Break-fix is still defensible when all of these are true
- You are under roughly 10 people with no regulated data.
- You run Microsoft 365 or Google Workspace with almost nothing on-premises.
- You already have MFA enforced everywhere and backups that someone verifies.
- A full day offline is inconvenient rather than expensive.
- You have no cyber insurance requirement and no client security clauses.
We lose deals over that second list every year and we would rather keep saying it. Selling a 7-person architecture firm a full managed contract they do not need is how providers get fired in month 14. If that list describes you, harden your tenant, test a restore, and call someone hourly when you need hands. Our Texas IT support page covers what that looks like.
Where co-managed IT fits
There is a third option and it gets skipped in almost every version of this comparison. Co-managed IT keeps your internal person or team and layers a provider underneath them for monitoring, security, after-hours coverage and specialist depth.
It usually comes up for one of three reasons. Somebody left and one person is now doing the work of two. An audit or a questionnaire exposed monitoring gaps nobody had time to close. Or a near miss made it obvious how thin the coverage really was. Our rate for it is $100 per user per month, and the comparison between all three models sits on in-house versus managed versus co-managed IT, with the Texas-specific version on co-managed IT in Texas.
7 questions to ask before you sign either agreement
These separate a real proposal from a pretty one. Ask them in writing and keep the answers.
- What is excluded. Ask for the exclusions list before the inclusions list, and read projects, hardware, licensing and after-hours especially closely.
- What is the response target for a full outage, and what happens contractually when you miss it.
- Who patches what, on what cadence, and where do I see the report.
- When was the last restore test on an account like mine, and will you test mine on a schedule I can see.
- Will you sign a letter for my cyber insurance carrier confirming the controls you maintain.
- What happens to my documentation, credentials and monitoring tenancy if I leave.
- Which of the CIS IG1 safeguards does this scope cover, and which stay mine.
Question 5 is the fastest filter in that list. Providers who will sign are running something real. Providers who go quiet are telling you the answer without saying it.
Local context still matters for the onsite half of any agreement. Response radius and travel billing differ across metros, which is why we keep separate pages for managed IT in Houston, managed IT in Dallas and managed IT in San Antonio. If your quote does not say how far onsite coverage reaches, that is a question, not an oversight to let slide.
For the baseline controls underneath any of this, CISA’s cyber guidance for small businesses is free, short, and written for people who do not do this for a living. Its companion Secure Your Business hub collects the same material by topic. Both are a reasonable way to sanity-check whatever a provider tells you is essential.
Questions Texas businesses ask about managed IT and IT support
Is managed IT just IT support with a subscription attached?
No. Support is one component of managed IT, and usually not the expensive one. The rest of the fee buys monitoring, patch management, the security stack, backup testing, documentation and reporting.
A useful test is what the provider does in a month when you never call. Under break-fix, nothing, and they bill nothing. Under a real managed contract, that quiet month is when patching ran, alerts got triaged and a restore got tested.
At what headcount does managed IT start making sense in Texas?
Around 15 to 20 people for most businesses, and immediately at any size if you hold regulated data or carry cyber insurance.
The 20-employee mark carries specific weight here because SB 2610 puts CIS Controls Implementation Group 1 in scope from 20 employees up. Those 56 safeguards describe continuous processes, not occasional visits, which is difficult to satisfy on an hourly relationship regardless of how good the technician is.
Can I keep my current IT person and still get managed services?
Yes, and that arrangement has a name. Co-managed IT keeps your internal staff and adds provider coverage underneath for monitoring, security, after-hours and specialist work.
It works best when the split is written down rather than assumed. Name who owns patching, who owns the security stack, who takes the 2am alert and who talks to the insurance carrier. Ambiguity is what makes co-managed arrangements fail, not capability.
Does break-fix support satisfy Texas SB 2610?
Under 20 employees it can, if you document the program and keep it current. Above that it becomes very difficult.
The statute expects CIS Controls Implementation Group 1 from 20 to 99 employees and a full recognised framework such as NIST CSF, ISO/IEC 27001 or CIS Controls from 100 to 249. Those are ongoing programs with evidence, and the safe harbor only applies if the program was already running when the breach occurred. The model matters less than whether someone is accountable for the controls between incidents.
What does managed IT cost per user per month in Texas?
Fully managed runs $125 to $225 per user per month across the Texas market in 2026, with most small and mid-sized businesses landing between $150 and $175.
Our published rates start at $91 per user for remote-only essentials and $138 for fully managed, with co-managed at $100 and a security-only tier at $40. Software licensing sits outside that and should be passed through at cost on its own line. Any quote that buries licensing inside the per-user rate is hiding the comparison you are trying to make.
Will switching to managed IT mean replacing all our equipment?
Not usually, and be careful with anyone who says otherwise in week one.
A reasonable onboarding assesses what you have, patches and secures it, and gives you a replacement roadmap tied to age, warranty and risk. Some genuinely end-of-life gear does need to go, particularly unsupported firewalls and anything still running an operating system past its support date. That is a short list, not a forklift.
How long are managed IT contracts, and can we get out?
Most Texas managed agreements run 12 to 36 months, and 36 is common enough that you should treat it as negotiable rather than standard.
Read the termination clause, the notice period and the offboarding terms together. What you want in writing is that documentation, credentials and monitoring tenancy come back to you within a defined window at no extra charge. That clause is worth more at signing than a small discount on the rate.
Not sure which model your business actually needs?
Send us your current IT spend, your headcount and your insurance renewal date. We will tell you which model fits, including when the honest answer is that you do not need us yet.
