How many staff before a business needs managed IT?

Why headcount is only a rough guide

Staff numbers are a convenient shorthand because they drive the volume of IT work: more people means more devices, more accounts, more requests and more chances for something to go wrong. Yet two businesses with the same headcount can have completely different needs. A ten-person architecture practice with large design files and a server has very different demands from a ten-person cleaning company whose office staff use only email and an online booking system.

So treat headcount as a starting point and then adjust for the factors that really drive risk and effort. Those are the sensitivity of the data you hold, how much revenue you lose for every hour systems are down, how many locations and devices you support, and whether anyone in the business has the time and skill to look after IT properly alongside their real job.

Under five staff

Very small teams can often manage with good cloud services, a sensible security baseline and occasional help from an hourly technician. If everyone uses modern laptops, Microsoft 365 or Google Workspace, multi-factor sign-in and automatic updates, there may be little day-to-day maintenance to do. A one-off setup done properly, and an annual check that nothing has drifted, can be enough.

The exception is a small business that holds sensitive information, such as a financial adviser, a medical practice or a law firm. Even with three staff, the consequences of a breach or lost data can be serious enough, under the Privacy Act 2020 and professional obligations, to justify managed security, monitored backups and a provider who is accountable for both.

Five to twenty staff

This is where most businesses feel the shift. Someone in the office usually becomes the unofficial IT person, fielding questions and calling the contractor when stuck. Requests become frequent enough that hourly bills start to add up, and the jobs nobody is formally responsible for, like patching, backups and removing access for leavers, begin to slip quietly without anyone noticing.

A managed plan at this size turns those background jobs into someone's actual responsibility and gives staff a clear place to ask for help. The predictable monthly cost also makes budgeting easier. For many businesses in this range, the comparison with hourly support is closer than expected once lost staff time and the occasional bad incident are counted.

Twenty staff and beyond

Beyond twenty or so staff, IT is almost always a constant workload. New starters and leavers happen most months, there are more devices to manage, more software to support and usually a network with several moving parts. Security expectations from clients, insurers and partners also rise, and questionnaires asking about controls become routine rather than occasional.

At this size, the question is usually not whether to have managed IT but what form it should take. Some businesses go fully managed; others hire an internal IT person and add a provider for security, after-hours cover and specialist projects. Doing nothing, with IT spread across busy staff who were hired for other roles, becomes a real risk to the business.

Other triggers that matter more than size

Several events can make managed IT worthwhile regardless of headcount. A cyber insurance renewal that asks hard questions you cannot answer. A near-miss, such as a staff member almost paying a fake invoice. A client demanding evidence of your security controls before signing a contract. A move to a new office, a second site or a shift to hybrid working that adds complexity overnight.

Another trigger is simply time. If the owner or office manager is spending several hours a week on IT problems, that time has a real cost. Working out what those hours are worth at your charge-out rate or salary often makes a monthly plan look much more reasonable, because it frees people to do the jobs they were hired for.

A quick way to decide

List the IT tasks your business needs done regularly: helping staff, patching, checking backups, managing accounts, reviewing security alerts, renewing licences and planning replacements. Mark who does each one now and how confident you are it is done well. Be honest about the gaps rather than optimistic about intentions, and include the jobs that only happen when someone remembers.

If most tasks are covered by someone with the skills and time, you may not need managed IT yet. If several are marked nobody or not sure, the business needs more structured support, whatever its size. That simple exercise usually answers the question more reliably than any headcount threshold or rule of thumb.