The threshold is roughly fifteen people, or the first week you spend more than half a day on something no customer will ever see. Below that, a founder handling IT is normal and cheap. Above it, the hours stop being free, because they come out of the work only you can do.
Most people cross the line without noticing, then stay on the wrong side of it for two more years.
The three stages, and how each one ends
Stage one: you are the IT department. Five to twelve people. You set up laptops, you know every password, you fix the printer. It works, and it costs nothing you can see on a statement. It ends when a new hire waits two days to start because you were travelling.
Stage two: somebody technical absorbs it. Twelve to forty people. Usually an operations manager or a developer who is good with computers and never asked for this. They now carry two jobs, one of which has no objectives attached to it and no budget. This stage ends badly more often than the first, because it ends when that person leaves and takes the undocumented arrangement with them.
Stage three: it is somebody’s actual job, internal or external. The decision at this point is not whether to spend money. You are already spending it, in a currency that does not appear in the accounts.
| Stage | What it costs | What it looks like when it breaks |
|---|---|---|
| Founder handles it | Your highest-value hours | Onboarding stalls, decisions queue behind you |
| Technical staffer absorbs it | Their actual role, quietly | Knowledge leaves with them |
| Dedicated internal hire | Salary plus benefits, single point of coverage | Nights, illness and vacation are uncovered |
| External provider | Predictable monthly fee | Scope disputes if the agreement was vague |
| Co-managed split | Both, at lower total | Nobody owns the boundary unless it is written |
Applying a decision framework instead of a feeling
The Business Development Bank of Canada publishes a decision guide on outsourcing that is not about technology at all, which is why it works well here. It suggests weighing four things: cost reduction against in-house operating cost, access to expertise you cannot hire, freeing your workforce for higher-value tasks, and the ability to respond to demand without building internal capacity.
Applied to IT, the second and third do most of the work. You are not outsourcing because it is cheaper per hour. You are outsourcing because a single competent generalist cannot cover networking, cloud administration, backup integrity and security monitoring at the depth each now requires, and because the hours you spend approximating one are the most expensive hours in the company.
BDC also gives a warning worth repeating. Do not transfer your inefficiency. If your device inventory is a guess and your file structure grew by accident, a provider will charge you to fix that, and the fixing is where the first invoice surprise comes from. Tidy what you can before the handover.
The one thing that cannot wait for stage three
Security does not scale with headcount the way support does. A twelve-person firm holds client data that is worth exactly as much to an intruder as a hundred-person firm’s.
The federal Get Cyber Safe guide for small and medium businesses, published by the Communications Security Establishment, reports that 83% of small and medium businesses have no cyber security plan at all. A plan here means something modest: who is responsible, what gets backed up, what happens when someone clicks the wrong link.
Two controls belong in place before you have anyone to delegate them to. Multi-factor authentication on every account including the backup system, and one restore test you have personally watched complete. Both are free or close to it, and both take an afternoon.
What the market actually charges
Pricing is more transparent than founders expect, and quotes cluster tightly once scope is matched.
Published ranges for business IT support services in Canada sit between $100 and $250 per user per month, or $50 to $150 per device per month, depending on coverage depth. For a twenty-five person company that is somewhere between $30,000 and $75,000 a year.
Set that against a single internal hire capable of covering the same ground. Salary alone lands in similar territory before benefits, and one person cannot be on call every night of the year. The comparison that matters is not provider versus nothing. It is provider versus the arrangement you are already running and not costing.
Before you request quotes, add up twenty-four months of reactive IT spending: hourly call-outs, emergency hardware bought at retail because nothing was planned, and the days lost to outages. The figure is usually 60% to 80% of a managed agreement, paid unpredictably and with none of the preventive work attached.
The middle option most founders miss
Co-managed support keeps whoever you have internally and gives them specialists behind them. The internal person keeps day-to-day helpdesk and institutional knowledge. The provider covers infrastructure, security monitoring, after-hours escalation and the things one person should not do alone.
It costs less than full coverage, it stops your technical staffer from being a single point of failure, and it lets them do the job they were actually hired for. The one requirement is that the boundary is written down. An informal split where both parties assume the other is watching the backups is worse than either arrangement alone.
The question to answer this week
Not “can we afford IT support”. Ask instead how many hours you personally spent last month on work that no client would pay for, then multiply by what an hour of your attention is worth to the business.
If that number embarrasses you, you have your answer, and you had it before you asked for a single quote.
