Co-Managed IT Services
Co-managed IT is an arrangement where your internal IT team keeps the work it does best and a provider takes on the rest, typically security monitoring, after-hours coverage and specialist projects. Defensible works as an extension of your team, with security built in, so your staff stop choosing between tickets and strategy.
Built and led by former Stroz Friedberg leaders. Fully managed or co-managed, whichever fits.
When Does Co-Managed IT Fit?
Co-managed IT fits when you have capable internal IT people but not enough of them to cover everything: 24/7 security monitoring, after-hours issues, compliance evidence and the projects that keep slipping.
It is also a good fit when leadership wants a security partner that answers to them, without replacing a team that already knows the business.
One- or two-person IT
Coverage gaps when someone is sick, on vacation or leaves.
No overnight eyes
Security alerts land outside business hours and wait until morning.
Projects keep slipping
Ticket queues beat strategic work every time.
Security skills gap
Generalist IT staff asked to run detection, response and compliance.
Audit and insurer pressure
Customers, auditors and carriers want evidence of monitoring.
Tool sprawl
Separate consoles for endpoint, email, identity and cloud, none correlated.
How Is Co-Managed IT Different From Fully Managed IT?
In fully managed IT, the provider runs your whole environment. In co-managed IT, responsibilities are split and written down. Your team stays in charge of the business relationships and systems it knows; we add security depth and capacity.
A clear split of who does what, agreed before go-live.
Monitoring, endpoint, email and identity protection run by security specialists.
Overflow, after-hours and project help without a new hire.
A vCISO for risk decisions, policies and board reporting.
What Tooling and Escalation Do You Use?
We deploy tools from our technology partners and agree an escalation path with your team before anything goes live.
Security Tooling
Proven platforms from our partner list, configured and monitored by Defensible.
- SentinelOne — Endpoint detection and rapid containment
- CyFlare — Continuous monitoring and incident response support for 24/7 coverage
- Ironscales — Email security and phishing-risk reduction
- Qualys and Cavelo — Vulnerability visibility and attack surface management
Escalation Path
Everyone knows who acts, and when, before the first alert fires.
- Runbook — Which alerts we contain directly and which go to your team
- Named contacts — Primary and after-hours contacts on both sides
- Incident response — 24/7 hotline; a senior responder engages within one hour
- Reporting — Regular reviews of alerts, actions and open risks
What Do We Take On, and What Does Your Team Keep?
A typical split. We agree the final version with you during onboarding.
| Responsibility | Your IT team | Defensible |
|---|---|---|
| Day-to-day user support and local systems | Included | Overflow and after-hours, if agreed |
| Business application ownership | Included | Not included |
| 24/7 security monitoring | Not included | Included |
| Endpoint and email security | Informed of actions | Included |
| Vulnerability scanning | Patches and fixes | Optional in MSSP Only |
| Security awareness training and phishing simulation | Encourages participation | Included |
| Incident response | Joins the response | Included |
| Security strategy, policies and board reporting | Input | vCISO |
Teams That Use Co-Managed IT
Organizations with internal IT that need security depth, coverage or capacity.
An IT lead who has outgrown doing everything alone.
Campus IT teams that need security operations and leadership.
Firms with regulators, clients and insurers asking for evidence.
Existing IT teams standardizing security after an acquisition.
How Do We Start a Co-Managed Engagement?
A structured start that doesn't disrupt the people already running your IT.
- STEP 1Consultation
Understand your team, stack and pain points.
- STEP 2Assessment
Review identity, endpoints, email, cloud and existing tools.
- STEP 3Responsibility split
Agree who does what and document it.
- STEP 4Go-live
Tools deployed, monitoring live and escalation tested.
- STEP 5Ongoing review
Regular reviews and adjustments as your team changes.
How Is Co-Managed IT Priced?
Co-managed security usually maps to our MSSP Only plan, which is built for organizations that already have internal IT support. It is quoted after a consultation because scope varies by users, endpoints and options.
For comparison, our Standard MSP plan starts at $150 per user per month and includes the full IT service. See the full plan comparison.
- Included in MSSP Only — Virtual CISO, endpoint security, email security, security monitoring, security awareness training, phishing simulation, Microsoft 365 / Google Workspace backup and dark web monitoring.
- Optional — Attack surface management, threat intelligence, vulnerability scanning, networking, data protection and DLP, and compliance.
The Juilliard School: Building a Security Practice Alongside Campus IT
- Challenge: IT staff primarily provided help desk services, with campuses in New York and Tianjin, China to protect
- Solution: A Defensible vCISO led the program, with Defensible's Managed Services providing vulnerability management and threat detection and response
- Result: A modern security practice aligned with NIST, and a dedicated cybersecurity budget approved by stakeholders
"I've worked with Defensible for years, and they're in a different league from other MSPs and security providers. Their team brings unmatched expertise, sharp strategic thinking, and a level of commitment that's rare in this industry. When it comes to protecting your business and making smart, confident decisions, Defensible is the partner you want in your corner."
— Max Everett, CISO, Shaw Industries · Former CIO at The White House and U.S. Department of Energy
Frequently Asked Questions
What is co-managed IT?+
An arrangement where your internal IT team keeps some responsibilities and a provider handles others, typically security monitoring, after-hours support or specialist projects. Responsibilities are documented so nothing falls between teams.
Will co-managed IT replace our IT staff?+
No. The point is to make your existing team more effective. They keep ownership of the systems and relationships they know; we add security operations, capacity and leadership.
Which Defensible plan fits a co-managed setup?+
Our MSSP Only plan is designed for organizations that already have internal IT support but need a robust, external security layer. If you also want help desk overflow or infrastructure management, we can scope that with you.
How much does co-managed IT cost?+
The MSSP Only plan doesn't have a published price because it depends on users, endpoints and options. We give you a clear quote after the initial consultation. Our Standard MSP plan, for comparison, starts at $150 per user per month.
Do you work with the tools we already have?+
We review your current tools during the assessment. Where they meet the need, we discuss working with them; where they don't, we recommend replacements from our technology partners.
What happens if there's a security incident?+
Our 24/7 hotline is (646) 349-4252, and a senior responder engages within one hour. The agreed escalation path tells everyone who acts, and your team is part of the response.
Give Your IT Team a Security Partner
Keep the people who know your business. Add 24/7 security operations, specialist depth and a vCISO, without adding headcount.