What Are Managed IT Services? A Guide for Business Leaders

Managed IT services are the ongoing care of your technology by an outside company, for a predictable monthly fee, under a written agreement that spells out what is covered. The company doing the work is called a managed IT services provider, or MSP.

This guide is written for owners, CFOs, and office managers deciding how to run IT. It covers what counts as an MSP, how managed services differ from hourly IT work, what an agreement should include item by item, what an MSP does for cybersecurity and for healthcare, how the managed, co-managed, and break-fix models compare, and what an MSP does not do. If you already know all that and want to see what we offer, our managed IT solutions page is the shorter road.

What Counts as a Managed Service Provider (MSP)

A managed service provider is an outside company that takes ongoing responsibility for running, securing, and supporting some or all of your technology, under a written agreement, for a monthly fee.

Ongoing responsibility. The provider looks after your systems every day whether or not anyone has called, which is what separates it from a technician you phone when something breaks.
A written scope. The agreement names the people, computers, servers, network devices, and cloud accounts covered, and what is billed separately.
Monitoring and maintenance. Software on your computers and servers reports their health, installs patches, and raises alerts, so problems get attention before staff notice them.
A help desk your staff can reach. Employees call or open a service request, and for every request, the MSP tracks the work done and the resolution.
Security built into the service. A current MSP runs core defenses such as managed endpoint detection and response, email compromise filtering, and cloud backup as part of the job, because a system that is supported and unsecured is a liability for everyone.
A complete inventory. The provider keeps a verified list of every device and account it manages, since anything missing from that list goes unpatched and unwatched.
Planning and reporting. Regular reviews cover support numbers, security status, and what needs replacing next year, so whoever owns the budget sees costs coming.

An MSP can also be narrow. Some manage only security, only backup, or only phones. The test is the same either way: does the provider own an ongoing result under a written agreement? If you are comparing providers, our Right Fit IT Resource Center covers what to look for and what to avoid.

IT Services vs Managed Services: The Difference Is Who Owns the Outcome

IT services are work you buy by the hour or by the project, while managed services are an ongoing result you buy by the month, with the provider accountable for keeping that result in place.

Who starts the work. With hourly IT services, work starts when you call; with managed services, the provider’s monitoring often finds the problem first.
How you pay. IT services arrive as hourly or per-project invoices, while managed services carry a predictable monthly fee for a defined scope.
Who pays for reoccurring problems. On an hourly bill, a problem that comes back gets billed again; under a managed agreement it costs the provider, which gives the provider a reason to fix the root cause.
What gets measured. A managed provider should track how fast it responds and how fast it resolves issues, by priority, and show you the numbers.
Who keeps the records. The provider builds and maintains your asset list, documentation, and onboarding and offboarding steps, so knowledge stays with your business when a technician changes.
Who plans ahead. Hardware lifecycles, license renewals, and next year’s budget are reviewed with you on a schedule, usually in a quarterly business review.

Plenty of organizations use both: a managed agreement for day-to-day support and security, with projects such as an office move or a cloud migration quoted separately. Pegasus publishes its response and resolution times by year, and What Your IT Provider Should Be Showing You Every Quarter explains what that reporting should look like from any provider.

What Is Included in Managed IT Services: The Itemized List

A full managed IT services agreement includes support, monitoring, maintenance, security, backup, user management, vendor coordination, and planning, and each item should appear by name in the agreement.

Help desk support. Staff call or open a ticket, and each request is tracked to resolution.
Onsite support. A technician visits for hardware setups, office reconfigurations, and problems that cannot be fixed remotely.
Monitoring and health checks. Computers and servers report their status, so failing hardware shows up as an alert first.
Patch installation. Security updates for Microsoft, Adobe, and other software are installed on a schedule and reported.
Preventative maintenance. Routine upkeep on a set schedule keeps computers and servers running well between problems.
Endpoint detection and response (EDR). Protection that watches for unusual behavior, including attacks that legacy antivirus misses.
Managed detection and response (MDR) with a security operations center (SOC). Analysts review alerts and isolate compromised devices.
Advanced email security. Filtering that catches phishing, fraud, business email compromise attacks, impersonation, and lookalike domains.
Cybersecurity awareness training. Staff are trained and tested with simulated phishing emails.
Immutable cloud backup. Copies of Microsoft 365 or Google Workspace data that cannot be altered or deleted, restorable item by item.
Onboarding and offboarding. Accounts, devices, and permissions are set up and removed following documented steps.
Asset inventory and lifecycle planning. Every device and license is listed, with replacement dates feeding your budget.
Vendor coordination. The provider deals with your internet provider, phone company, cloud software vendors, and office equipment suppliers.
Business phone service. VoIP phones can be managed under the same agreement.
Quarterly business reviews. A standing meeting on support, security, and upcoming costs.

Read the exclusions as closely as the inclusions. After-hours work, emergency support, computer replacements, migrations, and office moves are the items most often billed separately, and The Truth About Managed IT Services covers those warning signs. Our Advanced Cloud Backup page explains the limits of the backup your cloud provider already includes.

What a Managed Service Provider Does in Cybersecurity

In cybersecurity, a managed service provider deploys and runs layered defenses, watches for attacks around the clock through a security operations center, trains your staff, and tests whether those defenses hold.

Endpoint detection and response. Software on every computer and server flags suspicious behavior and can stop it, including fileless and in-memory attacks that definition-based antivirus cannot see.
Managed detection and response with a SOC. Human analysts review alerts, spot activity such as network enumeration or lateral movement, and isolate affected devices.
Cloud account monitoring. Microsoft 365 and Google Workspace sign-ins are watched for signs of a stolen password, such as impossible travel times between login locations.
Email security. Filters catch phishing, account takeover, business email compromise, and senders spoofing your domain.
Patching and end-of-life replacement. Published vulnerabilities get closed, and firewalls and switches running end-of-life firmware get replaced.
Security awareness training. Interactive training and simulated phishing, with extra training for anyone who keeps failing the tests.
Help desk identity checks. Password resets, permission changes, and new accounts require verification and approval, so a convincing caller cannot talk their way in.
Backups attackers cannot alter. Immutable copies mean ransomware cannot encrypt or delete the data you need to recover.
Testing. Vulnerability scans and penetration tests show whether the defenses work under real attack conditions.
Compliance evidence. Reports and documentation map your controls to frameworks such as HIPAA, CMMC, and NIST 800-171.

One honest caution: general IT skill and security skill overlap, and they are separate specialties, so ask any provider who on its team does the security work and how that work gets tested. Our penetration testing guide explains how a real test works, and SNAP-Defense describes how Pegasus runs MDR and its SOC.

What a Managed Service Provider Does for Healthcare Organizations

For a healthcare organization, a managed service provider runs the same support and security services with HIPAA built into them: protecting patient data, documenting the controls, and keeping every location running.

Protects patient data. Encryption, access controls, and role-based permissions limit who can reach protected health information (PHI).
Works under HIPAA itself. Any vendor that comes into contact with PHI must be HIPAA compliant, so ask to see the provider’s own compliance program; Pegasus holds the Seal of Compliance from Compliancy Group.
Stores data in audited facilities. Encrypted data and backups are kept in SOC 2 datacenters, which are independently audited on their security controls.
Keeps the logs and reports. Security events are logged and compliance reports are generated for audits and the annual risk analysis.
Trains clinical and front-desk staff. Awareness training and phishing simulations address staff education, a recognized HIPAA compliance concern.
Supports the risk assessment. The provider helps complete the risk analysis, follows through on its recommendations, and adds testing such as penetration tests and vulnerability scans as evidence.
Standardizes multiple locations. One security baseline and one hardware lifecycle plan across every clinic, so aging equipment is replaced on schedule, before it fails.
Plans for continuity. Backup and disaster recovery planning sets out how records, scheduling, and phones get restored after an outage.
Coordinates healthcare vendors. The provider works with your EHR, imaging, and phone vendors, so office staff are spared the role of go-between.

The provider supports compliance; your practice still owns its HIPAA program, its policies, and its decisions. For more, read Is It Time for Healthcare Managed IT Services? and our post on why multi-site medical groups overspend on aging network infrastructure.

Managed, Co-Managed, and Break-Fix IT: Three Models Compared

Managed IT hands ongoing responsibility for your technology to an outside provider, co-managed IT splits that responsibility between your own IT staff and a provider, and break-fix pays a technician only when something breaks.

	Managed IT	Co-managed IT	Break-fix
Who is responsible day to day	The provider	Your IT staff and the provider, by agreed areas	Nobody, until you call
Usual fit	Organizations without internal IT staff	Organizations with one or more IT employees	Very small offices with simple systems
How you pay	Predictable monthly fee for a defined scope	Monthly fee for the services you choose	Hourly or per-incident invoices
Help desk for staff	Included	Optional; some teams keep it in-house	Paid per call
Monitoring and patching	Included	Included for systems in scope	Usually none
Security (EDR, MDR, SOC)	Included	Often the first services added	Only if bought separately
Planning and budgeting	Quarterly reviews and lifecycle planning	Shared with your IT lead	None; costs arrive as surprises
Main risk	Exclusions you missed in the agreement	Unclear lines of responsibility	Problems found only after they cause downtime

No IT staff. Managed IT is the usual fit, because someone has to own support, security, and planning every day.
An IT person or department. Co-managed IT lets your team pick which services to hand off, such as monitoring, security, or busy-period coverage, and keep what it prefers to run in-house.
Break-fix. It can work for a very small, simple office, though many break-fix problems are preventable and almost all are budgetable, since computers last three to five years and servers five to seven.

Go deeper with the difference between managed and co-managed IT, our managed IT services for IT departments page, and why managed IT beats break-fix for law firms.

What a Managed Service Provider Does Not Do

A managed service provider does not give legal, accounting, or insurance advice, make you compliant on its own, decide how much risk you accept, or guarantee you will never be breached, and a good one says so before you sign.

Legal, accounting, or insurance advice. It can help complete compliance questionnaires and document your security practices; the advice itself belongs to your attorney, accountant, and insurance broker.
Certify you as compliant. It implements and documents technical controls, while an auditor or assessor makes the determination and your policies and staff behavior remain your responsibility.
Decide your risk tolerance. It lays out the options, risks, and costs, and leadership decides how much risk and spending is right for the organization.
Guarantee you will never be breached. It lowers the odds and limits the damage, and any provider promising zero risk is promising something nobody can deliver.
Cover every project in the monthly fee. Migrations, office moves, new hardware, and new software rollouts are often scoped and billed separately, so find the definition of a project in your agreement.
Manage what it does not know about. Devices and accounts left off the inventory go unpatched and unmonitored, which is why a good provider builds the inventory first.
Hand out access to whoever calls. Password resets and permission changes require verification and approval, even when the caller sounds like the CEO.
Repair the inside of your industry software. It manages the computers, network, and accounts your software runs on and works the problem with the vendor, who owns fixes to its own product.

Knowing these limits makes agreements easier to compare honestly. The Truth About Managed IT Services covers the warning signs worth watching for, and the Right Fit IT Resource Center has the questions to ask before you sign.

Managed IT services come down to one question: who owns the result when something goes wrong, and who is working to keep it from going wrong in the first place. Get that answer in writing, item by item, and the rest of the decision gets much easier.

If you want an honest read on which model fits your organization, talk to the Pegasus team or call 610-444-8256. We will tell you what we would include, what we would leave out, and why.

Call us!

What Are Managed IT Services? A Complete Guide for Business Leaders