Blog / it-strategy
In-house, outsourced or hybrid IT
How to decide between in-house IT, an outsourced provider, or a hybrid, based on company size, risk, and the hidden costs of each.
Every growing company hits the same question, usually after a bad week: should IT be someone's job here, or someone else's business?
The honest answer is that it depends on size and risk, not on ideology. I have seen ten-person companies that genuinely needed an internal person and hundred-person companies well served by an outside firm. Here is how I actually think it through with clients.
What size really changes
Under about 20 people, full in-house rarely makes sense. There is not a full-time job's worth of work, so your "IT person" becomes whoever is least afraid of the router, and the real cost is the job they are not doing while they reset passwords. An outsourced provider, even a modest one, usually wins here on both cost and quality.
Somewhere between 20 and 75 people, the math gets interesting. Ticket volume grows, the tools multiply, and the outsourced bill starts to approach a salary. This is where companies make their first IT hire, and it is also where they most often get the role wrong, hiring a technician when what they need is an owner of the whole picture.
Past 75 or 100 people, you almost always want some internal capability, because IT stops being "fix my laptop" and starts being how the company actually operates. The question shifts from whether to bring it in-house to which parts.
Risk decides more than headcount does
Size sets the budget conversation. Risk sets the requirements.
Ask three questions. First, what happens to revenue if systems are down for a day? A consultancy limps along on phones and patience; a distributor stops shipping. Second, what data do you hold, and who would care? Health information, payment data, and anything under a regulator's eye raise the bar sharply. Third, how specialized is your environment? Standard office IT is what outsourced providers are genuinely good at. A custom manufacturing system or a homegrown platform is not on their menu, and pretending it is leads to expensive mutual disappointment.
High revenue-per-hour risk argues for someone whose attention you do not share. Commodity needs argue for a provider who does the same work for fifty other companies and is better at it than your one hire would be.
The hidden costs, both directions
Outsourcing looks cheaper than it is. The visible number is the monthly fee. The invisible numbers are everything outside the contract's definition of "covered": projects billed separately, the queue you share with every other client during a widespread outage, and the slow drift toward whatever stack the provider prefers to support. There is also a knowledge cost that only shows up when you leave: if the provider holds all the documentation and passwords, switching is painful, which is precisely why some providers hold them.
In-house looks more controlled than it is. The visible number is salary. The invisible numbers are software, training, and the single point of failure problem: one person means no coverage for vacations, no peer review of decisions, and a hard scramble if they resign. A lone IT generalist also has nobody to learn from, which quietly caps how good your environment gets.
Neither set of hidden costs is a dealbreaker. But compare the honest totals, not the sticker prices.
Why hybrid usually wins in the middle
For most companies between roughly 20 and 150 people, the answer I end up recommending is a split: keep judgment in-house, buy execution.
That means someone internal, sometimes part-time or fractional, owns strategy, vendor relationships, security posture and budget, and an outside provider handles the ticket queue, after-hours coverage, and commodity infrastructure. The internal side keeps the provider honest and keeps institutional knowledge in the building. The outsourced side gives you depth and coverage no single hire can.
The failure mode of hybrid is fuzzy boundaries, where each side assumes the other patched the thing. Write down who owns what, including in an incident, and revisit it yearly. A hybrid with clear boundaries is the best of both; a hybrid without them is the worst.
Deciding without a bad week forcing you
The wrong time to decide this is during an outage or a resignation. The right time is now, with your actual size, growth rate and risk profile on the table.
If you want help making the call, I do this two ways: a fixed-fee assessment of your current setup with a straight recommendation, or an ongoing fractional arrangement where I act as the in-house judgment in a hybrid model. Either way you get an answer that fits your company rather than a vendor's sales motion.