Ask a managing partner how their firm runs IT and the answer is usually historical rather than strategic. A firm of 40 people hired a capable IT manager. The firm grew to 150, and that person is now responsible for cyber security, cloud, compliance evidence, Microsoft licensing, AI and every laptop in the building.
For law firms between 50 and 300 people, that model is under more strain than ever, and more firms are weighing outsourced or co-managed IT as an alternative. Clients, insurers and lenders expect enterprise-grade security. Regulators expect evidence. Fee-earners expect everything to work from anywhere. And the skills needed to deliver all of that are scarce and expensive.
There are three ways to run IT at this size: fully in-house, fully outsourced to a managed service provider (MSP), or co-managed, where your own team and an external partner share the work. None is right for every firm. This article sets out what each model really involves, what the latest UK research says, and how to work out which one fits your firm.
The three models at a glance
In-house. You employ your own IT team, who know the firm, its people and its case management system intimately. You have full control and an instant response. The risk is depth: a team of two or three cannot be expert in everything, and when someone is on holiday or leaves, knowledge walks out with them.
Fully outsourced. An MSP runs your IT end to end: service desk, infrastructure, security and projects. You gain breadth of skills, out-of-hours cover and predictable costs. The trade-off is distance. A provider that does not understand legal workflows, or treats you as one of hundreds of tickets, can leave fee-earners frustrated.
Co-managed. Your internal team stays and owns the relationship with the business, while an external partner provides the depth and scale: round-the-clock monitoring, security operations, specialist projects, licensing, and overflow support. Done well, it combines local knowledge with specialist reach.
| In-house | Fully outsourced | Co-managed | |
|---|---|---|---|
| Knowledge of the firm | High | Varies by provider | High (internal team retained) |
| Breadth of specialist skills | Limited by headcount | High | High |
| 24/7 monitoring and cover | Rarely affordable | Usually included | Provided by partner |
| Resilience to staff leaving | Low | High | High |
| Cost profile | Salaries, recruitment, training, tools | Predictable monthly fee | Internal salaries plus a smaller partner fee |
| Control over priorities | Full | Shared, contract-led | Full, with partner support |
| Best suited to | Smaller firms with simple needs, or very large IT teams | Firms with no internal IT, or wanting to step back from it | Firms with a good internal team that is stretched |
What the research says
Four findings from recent UK government research explain why this decision has become more pressing for mid-sized firms.
Mid-sized organisations are attacked more, not less. The government’s Cyber Security Breaches Survey 2025/26, published in April 2026, found that 43% of UK businesses identified a breach or attack in the previous 12 months. For medium-sized businesses the figure was 65%, and for large businesses 69%. A 50–300 person law firm, holding client money and confidential data, sits squarely in the most-targeted group.
The skills gap is widening. The government’s Cyber Security Skills in the UK Labour Market 2026 report, published in September, found that 57% of businesses have a basic technical cyber skills gap, up from 49% a year earlier. Basic here means tasks like configuring firewalls, managing access and detecting malware: the everyday work of a small IT team.
Many organisations are exposed and unsupported. The same report found that almost half of the people responsible for cyber security in UK businesses lacked confidence to deal with a breach and had not outsourced that function. That is the scenario most firms fear: a capable generalist IT manager facing a ransomware incident at 2am, alone.
Specialists are expensive to hire. The median advertised salary for a core cyber security role was about £58,000 in 2025, before recruitment fees, training and the cover needed for holidays and turnover. Few firms of this size can justify a dedicated security analyst, let alone the several people needed for 24/7 monitoring.
None of this means in-house IT is failing. It means a small internal team is being asked to cover a much wider brief than it was built for.
Which model fits your firm?
The right answer depends less on headcount than on what your firm already has, and what it is trying to do next.
Stay in-house if your IT needs are simple and stable, you have a strong team with genuine depth, and you can afford to cover holidays, sickness and resignations without gaps. This is increasingly rare below 300 people, particularly once round-the-clock security monitoring is factored in.
Outsource fully if you have no internal IT, your IT manager is leaving or retiring, or the partners want IT to be a service they buy rather than a function they manage. Choose a provider that understands legal software, matter-centric document management and the evidence your insurers and clients will ask for.
Choose co-managed if you have a good internal team that is stretched. Typical signs:
- Your IT manager spends their week on password resets instead of projects.
- Security monitoring stops at 5.30pm and at weekends.
- Projects like a cloud migration, Copilot rollout or merger integration keep slipping.
- Insurance and client security questionnaires take weeks to answer.
- One person holds knowledge that nobody else could pick up tomorrow.
In a co-managed model, your team keeps what it does best: knowing the partners, supporting fee-earners and setting priorities. The partner takes on what is hard to staff internally, such as 24/7 monitoring, security operations, licence management, specialist projects and overflow support. Both work from the same service desk, so nothing falls between the gaps.
It is also not a permanent choice. Many firms start co-managed to relieve pressure, then adjust the balance as they grow, merge or lose key staff.
Five questions to ask before you decide
- If our IT manager resigned tomorrow, what would we lose? Write down the systems, passwords and supplier relationships only they understand.
- Who is watching our systems at 2am on a Sunday? If the answer is nobody, that is when attackers prefer to strike.
- How long did our last insurance or client security questionnaire take, and could we evidence every answer?
- Which projects have slipped in the last 12 months because the team was firefighting?
- What do we actually spend on IT per fee-earner, once salaries, tools, licences and recruitment are included?
The answers usually make the right model obvious. If they point to a strong team that needs more depth rather than a replacement, co-managed IT is worth exploring.
Frequently asked questions
What is co-managed IT?
Co-managed IT is a support model where a firm keeps its own IT staff and shares the workload with an external managed service provider. The internal team handles day-to-day relationships and priorities, while the provider adds specialist skills, 24/7 monitoring and extra capacity.
How is co-managed IT different from outsourced IT?
With fully outsourced IT, the provider runs everything and the firm has no internal IT staff. With co-managed IT, the firm’s own team stays in control and the provider fills specific gaps. Many law firms choose co-managed IT because it keeps knowledge of their people and systems in-house. Read more about IT managed services for law firms.
How much does co-managed IT cost?
It depends on what the partner covers, from out-of-hours monitoring only to a full shared service desk with security operations. Because the internal team is retained, the partner fee is usually smaller than a fully outsourced contract. The useful comparison is the cost of the gap: an extra specialist hire, plus cover for holidays and turnover.
Is co-managed IT right for a small law firm?
Co-managed IT works best for firms with at least one capable internal IT person who is stretched. Firms with no internal IT are usually better served by a fully managed service. See our IT support for law firms and solicitors for both options.
Does co-managed IT improve cyber security?
It can, mainly by adding round-the-clock monitoring and specialist response that small teams struggle to staff. Our cyber security guide for solicitors covers the controls insurers and clients expect.
Talk it through with us
Quiss has supported UK law firms for over 36 years, including through our “One IT, One Team” co-managed service, which works alongside your internal team through a shared service desk. If you would like an informal conversation about which model suits your firm, with no assumption that the answer involves us, get in touch with our team.
Like what you read?
