Most Chicagoland businesses do not choose between managed IT and break-fix support deliberately. They drift. A friend of the owner set up the first server, a local shop started answering calls when something broke, and five years later nobody can say who patches the firewall or whether backups actually restore. The question only gets asked after an outage that cost real money.

The two models are not just different price structures. They produce different networks. Here is how to tell which one your business should be running.

What each model actually is

Break-fix means you call someone when something stops working, and you pay for the time it takes to fix it. There is no ongoing relationship with your environment. The technician who shows up may have never seen your network. Documentation, if it exists, lives in somebody’s email.

Managed IT means a provider takes ongoing responsibility for a defined scope: endpoints, servers, network gear, identity, backups, and the vendor relationships around them. Work happens on a schedule, not only in response to failure. You pay a recurring fee instead of hourly.

The important difference is incentive. Under break-fix, the provider earns more when things break. Under a managed agreement, the provider absorbs the cost of recurring problems, so there is a direct reason to fix root causes instead of symptoms.

The hidden costs of break-fix

Hourly rates look cheaper on paper because the invoice only shows labor. It does not show what the gaps cost you.

• Patching falls behind. Nobody is paid to install updates on a schedule, so operating system and third-party patches sit unapplied until something forces the issue. This is the single most common way small networks get compromised.
• No monitoring. A failing drive, a full disk, or a switch running hot gives warning signs for days. Without monitoring, the first notification is an outage.
• Backups are assumed, not verified. Backup software reporting success is not the same as a tested restore. Break-fix engagements rarely include restore testing because nobody is scoped to do it.
• Configuration drift. Each visit is a different technician making a local decision. Firewall rules accumulate, admin accounts never get removed, and nothing is documented.
• Downtime is on your clock. When you are not under contract, you are in the queue behind clients who are.

The cost that actually hurts is not the hourly rate. It is the hours your staff cannot work.

When break-fix is still a reasonable choice

Break-fix is not automatically wrong. It can be the right call when:

• You have fewer than roughly five users, no server, and everything runs in cloud apps on devices nobody shares.
• Your business can tolerate multiple days without IT systems without losing revenue or missing contractual obligations.
• You have internal technical capability and only need occasional hands or specialized project work.
• You are buying a single defined project, like a cabling build or a firewall replacement, rather than ongoing operations.

If more than one of those is false, you are carrying risk that a recurring agreement is designed to remove.

Signals that you have outgrown break-fix

These are the practical triggers we see most often:

1. You cannot answer basic questions about your own environment. How many endpoints do you have? Which ones are missing patches? Who has admin rights? If these take a week to answer, nobody owns the environment.
2. A compliance or insurance questionnaire showed up. Cyber insurance applications and client security reviews ask about MFA, endpoint detection, patch cadence, and tested backups. Those are operational commitments, not one-time purchases.
3. You have a server, a line-of-business application, or production equipment on the network. Anything with dependencies needs change control.
4. Staff have stopped reporting problems. When people assume IT issues take days, they build workarounds. Those workarounds are usually where data leaves the company.
5. The same problem keeps recurring. Repeat tickets mean the root cause has never been addressed, because nobody was paid to address it.

How to evaluate a managed agreement

Not all recurring agreements are worth the money. Read the scope, not the brochure. Ask for specifics:

• What is in scope and what is billed separately? Projects, hardware, and after-hours work are commonly excluded. That is fine, as long as it is written down.
• What is the response commitment, and during what hours? Get the coverage window in writing along with how after-hours issues are handled.
• Who patches what, and on what cadence? Including network gear and firmware, not just Windows.
• Are backups tested, and will you see the test results? Ask for a restore test, not a backup report. See backup and disaster recovery for what that should cover.
• What security controls are included versus add-on? Endpoint detection, email filtering, and MFA enforcement are baseline items under cybersecurity services, not luxuries.
• Who owns documentation and licensing? You should be able to leave with your own network diagram, admin credentials, and license records.
• Who will actually do the work? Ask whether you get a dispatcher or a named engineer who knows your environment.

That last point is worth pressing on. A lot of operational risk in small networks comes from nobody holding continuity of knowledge.

A middle path

If a full agreement is not in the budget yet, close the highest-risk gaps first and handle the rest hourly. In rough priority order: MFA on email and remote access, endpoint detection on every device, verified and immutable backups, a patching schedule, and a documented network diagram. An IT consulting engagement can produce that roadmap and the budget to go with it, without committing you to a monthly contract on day one.

If you are weighing the two models for a Chicagoland office, warehouse, or plant, our managed IT services page lists what we cover, including helpdesk, patching, monitoring, and vendor management, and you work directly with the senior engineer handling your environment rather than a rotating queue.