At a machine shop off the East Sam Houston Tollway, the IT guy is also the ERP guy, the badge-system guy, and the person who knows why the CNC controllers talk to a server that’s technically running an operating system Microsoft stopped supporting years ago. He’s the most valuable person in the building who isn’t on the leadership team, and he hasn’t had a clean weekend since spring. The plant runs three shifts. The network runs all 168 hours. He runs about 50 of them.
You can describe co-managed IT in the abstract all day — partnership, responsibility matrix, shared tools — and it still sounds like consultant noise until you see it land in a real business. So this post does that. We’ll walk three composite Houston businesses — a manufacturer, a professional-services firm, and a medical practice — through the before (one buried person, real gaps) and the after (who owns what, and what changed). These are representative examples, not real clients, but the patterns are exactly what we walk into.
Example 1: A typical Houston machine shop
Picture a mid-size precision-manufacturing operation — sixty-five employees, a busy shop floor, an ERP system that the whole business runs on. One internal IT person, and he’s genuinely good.
Before: one person, two worlds, no nights
His real value is deep and specific: he knows the ERP inside out, which shop-floor machines depend on which servers, and the dozen little integrations that keep production data flowing. That knowledge can’t be outsourced — it lives in the business. But it also means everything else gets whatever’s left of his week, and there isn’t much. The gaps are predictable:
- The machines run 24/7; nobody watches them after 5. A failed backup or a server hiccup at 1 a.m. waits until morning — on a line where an hour of downtime is real money.
- Patching is behind because there’s never a safe, supervised window to touch production systems.
- OT/IT convergence is quietly dangerous. The shop-floor (operational technology) network and the office (IT) network have grown into each other over the years. Old industrial controllers that were never designed to be on the internet now share paths with email and file shares. That’s the exact seam attackers love, and no one has had time to segment it properly.
After: he keeps the ERP, the MSP takes the watch
Co-managed doesn’t touch the part he’s great at. The written responsibility matrix draws a clean line:
- He keeps: the ERP, shop-floor systems and integrations, vendor relationships, and the day-to-day decisions that need someone who knows the plant.
- The MSP takes: 24/7 monitoring of servers and backups, after-hours response, patch management on a tested schedule, and OT/IT security — including segmenting the shop-floor network from the office network so a phished email can’t reach a CNC controller.
What changed: the line is now watched at 2 a.m. by people whose job is to watch it, patches land in controlled windows instead of piling up, and the internal guy finally took a vacation without his phone becoming the help desk — because the partner already knew his environment and covered it.
Example 2: A mid-size engineering or accounting firm
Now a professional-services firm — say a forty-person engineering shop, or an accounting practice of similar size. There’s a small internal IT presence, maybe one person plus a sharp office manager who’s “good with computers.” The business runs on a handful of line-of-business apps and a mountain of sensitive client data.
Before: sensitive data, compliance pressure, no security depth
This firm’s risk isn’t the shop floor — it’s the client files: engineering drawings, financial records, tax data, contracts. That brings two pressures a small internal team can’t fully carry:
- Real compliance obligations. An accounting or tax firm falls squarely under the FTC Safeguards Rule, which treats them as a “financial institution” and requires a written information-security program with specific controls — access controls, encryption, monitoring, an incident-response plan. Engineering firms face client and contractual security demands that look much the same.
- No security operations. The internal person keeps the apps and the users running, which is plenty. There’s no one running a real network security program — no 24/7 monitoring, no centralized logging, no one tuning detection rules. The data is valuable and the door is only sort of locked.
After: internal IT keeps the apps, the MSP runs security and compliance
The split here plays to each side’s strength:
- Internal IT keeps: the line-of-business apps, user support, onboarding and offboarding, and the trusted internal face the staff already go to.
- The MSP adds: security operations — EDR/MDR, 24/7 monitoring, MFA enforcement, email filtering, logging — plus the compliance controls and the documentation that proves they work when an auditor, client, or insurer asks.
What changed: the firm can answer a client security questionnaire honestly instead of optimistically. The Safeguards program isn’t a PDF someone half-wrote — it’s controls actually running, with evidence. And the internal person is no longer lying awake wondering whether they’d even know a breach was happening, because now someone is genuinely watching.
Example 3: A growing medical practice
The third pattern has the thinnest IT bench of all: a busy multi-provider medical practice where the “IT department” is the practice manager who learned it because someone had to.
Before: the practice manager is also “IT”
She runs scheduling, billing, staff, and vendors — and somewhere in there resets passwords, calls the EHR vendor, and prays the backup is working. The exposure is serious:
- HIPAA isn’t optional. The practice handles protected health information, which means HIPAA-grade safeguards aren’t a nice-to-have — they’re the law, with real penalties.
- “We have backups” is a hope, not a fact. No one has tested a restore. If ransomware hit on a Friday, nobody knows if Monday’s schedule survives.
- There’s no security program at all — just a firewall someone set up once and antivirus that came with the laptops.
After: a real safety net, no new hire
Here the practice has very little internal IT to lift, so the MSP carries more — but the practice manager stays in control of the practice. The matrix gives her:
- HIPAA-grade security: encryption, access controls, MFA, monitoring, and the documentation a HIPAA audit demands.
- Backups that are real: monitored, tested restores — proven recoverable, not just “running.”
- A help desk for the staff so she stops being the password-reset bottleneck and gets her actual job back.
One honest note: a practice with no internal IT at all sits near the edge between co-managed and fully managed IT services. If there’s a person to partner with — even a practice manager who wants to stay involved — co-managed fits. If there’s truly no one, managed is the cleaner shape, and we’ll tell you which honestly.
The thread running through all three
Different verticals, same mechanics. In every case the model holds because of a few non-negotiables:
- It’s a partnership, not a replacement. The internal person keeps control and stays the face of support. The shop’s ERP expert, the firm’s app owner, the practice manager — none of them get pushed out.
- A written responsibility matrix names who owns what, line by line, so there’s no “I thought you had that” at 2 a.m.
- Shared tools and visibility — both sides see the same dashboards and alerts. No black box.
- Month-to-month, no lock-in. The partnership keeps earning its place.
This is exactly how Bob Coppedge of Simplex-IT, who wrote the book on co-managed IT, frames it: a good partner lifts internal IT up rather than replacing it. He even estimates roughly 70% of MSPs already have a co-managed client without realizing it — companies with internal people quietly leaning on an outside team for the parts they can’t cover. The whole model is laid out in the pillar, what is co-managed IT, and it’s the foundation of our co-managed IT services.
The honest caveat
These examples are clean because they’re composites. Real engagements get messy in one specific way: the split only works if the matrix is genuinely airtight. The dangerous failure isn’t a missing control — it’s a control everyone assumes someone else is watching. If the shop’s internal guy thinks the MSP is monitoring backups and the MSP thinks that’s still his job, a failed backup sits unread until the day you need it. Drawing that line precisely — and revisiting it as the business changes — is the actual work. Done loosely, co-managed is just a more expensive way to miss the same alert.
Frequently asked questions
Our internal person knows our systems better than any outsider could. Doesn’t that knowledge get lost?
No — that knowledge is exactly what co-managed protects. The internal person keeps the systems they know best (the ERP, the LOB apps, the EHR vendor relationship). The partner takes the parts that don’t require business-specific knowledge — monitoring, security, after-hours, patching. Shared documentation also means the knowledge stops living in one person’s head, so a resignation or vacation isn’t a crisis.
We’re a manufacturer — do you actually understand the OT side, not just office IT?
Yes, and it’s a critical distinction. OT/IT convergence — shop-floor controllers sharing network paths with office systems — is one of the biggest unaddressed risks we see in Houston manufacturing. A real co-managed engagement includes segmenting those networks so an office-side compromise can’t reach production equipment, while your internal expert keeps owning the ERP and machine integrations.
How do we know what this would cost for a business our size?
Co-managed pricing scales with headcount and what you want the partner to own, so it varies by situation. Our pricing calculator gives you a realistic range for your own employee count, and a discovery call sharpens it once we understand which slices you’d keep internal.
The bottom line
Co-managed IT stops sounding abstract the moment you map it onto a real business. The Houston machine shop keeps its ERP expert and finally gets the line watched overnight and the OT/IT seam closed. The engineering or accounting firm keeps its apps and its trusted internal face while gaining real network security and a Safeguards program that survives scrutiny. The medical practice gets HIPAA-grade protection and backups that actually restore — without a six-figure hire. Same model, three shapes, one principle: the partner fills the gaps, your people keep control. If any of these felt close to home, book a free discovery call — and bring your IT lead. This conversation works best with them in the room, because the whole point of co-managed IT is that it works with them.
Aspendora Technologies provides co-managed IT and managed IT services to Houston-area businesses, since 2010.