The Real Cost of Running IT In-House: Tools, Staff, and the Math Your CFO Needs to See

Most business owners know what they pay their IT staff. Very few know what the tools cost to actually run, secure, and advance their technology. When you add up the licensing, staffing, and management overhead required to operate a modern IT environment in-house, the numbers tell a story that should change how every SMB thinks about its technology strategy.

This is not about whether IT matters. It absolutely does. The question is whether your company should be in the IT business at all, or whether those dollars work harder with a managed service provider who spreads the cost of enterprise-grade tooling across dozens of clients.

The Modern IT Tool Stack Is Not Optional

Ten years ago, a small business could get by with antivirus software, a firewall, and a capable IT person. That era is over. Cyber insurance carriers, compliance frameworks, and the threat environment itself have raised the floor on what counts as a functioning IT operation. Here is what a properly run SMB environment requires today:

Remote Monitoring and Management (RMM) is the platform that lets your IT team see every device, push patches, run scripts, and manage endpoints at scale. Without it, your IT staff is walking desk to desk. Enterprise RMM platforms like ConnectWise Automate or Datto run $3 to $8 per endpoint per month, and they require trained staff to configure and operate.

Endpoint Detection and Response (EDR) and Managed Detection and Response (MDR) go well beyond traditional antivirus. EDR tools like CrowdStrike or SentinelOne monitor every process on every endpoint in real time, looking for behavioral indicators of compromise. MDR adds a team of human analysts watching those alerts around the clock. EDR licensing alone runs $5 to $15 per endpoint per month. Add MDR services and that jumps to $15 to $30.

Security Information and Event Management (SIEM) aggregates logs from firewalls, servers, endpoints, cloud apps, and identity providers into a single platform where security analysts can detect threats across the environment. A SIEM is not something you install and forget. It requires continuous tuning, rule creation, and analyst time. Licensing for platforms like Microsoft Sentinel, Splunk, or LogRhythm starts around $2,000 per month for a 50-person company and scales sharply with log volume.

Security Operations Center (SOC) is the team that actually watches the SIEM, triages alerts, investigates incidents, and coordinates response. Building an internal SOC means hiring at least three to four security analysts to provide basic coverage during business hours, plus an on-call rotation. Outsourced SOC services run $3,000 to $10,000 per month depending on scope. Building your own costs multiples of that in salary alone, before you buy a single tool.

Firewalls and network security are the perimeter. A properly configured next-gen firewall from Fortinet, Palo Alto, or Cisco requires not just the hardware (which can run $2,000 to $20,000 depending on throughput needs) but annual licensing for threat intelligence feeds, intrusion prevention, web filtering, and SSL inspection. Budget $1,500 to $5,000 per year per appliance for those subscriptions.

Cloud management covers your Microsoft 365 environment, Azure or AWS infrastructure, identity and access management, backup, and disaster recovery. M365 licensing for a 75-person company runs $15,000 to $40,000 per year depending on the plan tier. Azure infrastructure, backup solutions, and administration add another layer that requires specialized skills most SMB IT teams do not have.

AI tools and governance are the newest addition. Microsoft Copilot, AI-powered security tools, and business automation platforms are entering the stack faster than most companies can evaluate them. Copilot alone adds $30 per user per month. Beyond licensing, someone needs to govern how AI is used, prevent shadow AI from creating data exposure, and measure ROI. Most three to four person IT teams are already stretched thin before AI enters the picture.

Add It Up and the Numbers Get Uncomfortable

For a 75-person company trying to run all of this in-house, the tool stack alone (before a single salary) looks something like this:

• RMM: $225 to $600/month
• EDR/MDR: $1,125 to $2,250/month
• SIEM: $2,000 to $4,000/month
• SOC services (outsourced, since in-house is far more): $3,000 to $10,000/month
• Firewall licensing: $125 to $420/month (annualized)
• Cloud/M365 licensing and backup: $1,250 to $3,500/month
• AI tooling: $2,250+/month (if adopted)
• Miscellaneous (documentation platforms, password managers, MFA, patching tools, ticketing): $500 to $1,500/month

That is roughly $10,000 to $24,000 per month in tools, or $120,000 to $290,000 per year. And this is a conservative range that does not include hardware refreshes, cabling, or project work.

Now add staff. A competent IT manager in the Texas market costs $130,000 to $160,000 in total compensation. A systems administrator adds $85,000 to $110,000. A help desk technician adds $50,000 to $65,000. A security analyst (if you can hire one) adds $95,000 to $130,000. A team of three to four people runs $300,000 to $450,000 per year in fully loaded compensation, and that team still lacks depth in cloud architecture, cybersecurity operations, or AI implementation.

Total annual cost for a 75-person company running IT in-house: $420,000 to $740,000. That is before the cost of downtime, before the risk of a single person leaving and taking institutional knowledge with them, and before the inevitable gaps in coverage during vacations, sick days, and turnover.

Businesses Under 100 Employees: Full Outsourcing Is the Clear Financial Play

If your company has fewer than 100 employees, the math on building an internal IT team simply does not work. Here is why.

At that size, you cannot afford the specialization required. You need someone who can manage endpoints, administer M365, configure firewalls, respond to security incidents, run projects, manage vendors, and provide strategic IT leadership. That person does not exist at a salary you can afford, and even if they did, they would burn out inside of 18 months. This is exactly why SMBs struggle to retain IT talent.

A managed service provider spreads the cost of every tool listed above across its entire client base. The RMM, EDR, SIEM, SOC, firewall management, cloud administration, and AI governance that would cost your company $120,000 to $290,000 per year in licensing alone is included in a managed services agreement because the MSP is running those platforms for hundreds of clients simultaneously. The per-client cost drops dramatically.

More importantly, you get a team. Not one person trying to do everything, but a bench of engineers, architects, and analysts who specialize in the areas that matter. Your help desk tickets go to trained technicians. Your security alerts go to SOC analysts. Your M365 environment is managed by cloud engineers who do it every day. Your quarterly business reviews are led by someone who functions as your virtual CIO.

Any CFO who runs the comparison between fully loaded in-house costs and a managed IT services agreement will arrive at the same conclusion: a company with fewer than 100 employees is not in the IT business, and it should stop pretending otherwise.

Businesses Over 100 Employees: The Co-Managed Model

Once a company crosses the 100-employee threshold, the picture shifts. At this size, you typically have enough complexity to justify having someone internal who understands the business, knows the users, and can handle on-the-ground work. But that does not mean you should try to build the entire function in-house.

The co-managed IT model puts a single capable IT person (or a small team) on-site to handle day-to-day break-fix, user onboarding, hardware issues, and internal stakeholder communication. The MSP partner handles everything that requires depth, scale, or around-the-clock coverage: the security stack, cloud infrastructure, network architecture, project delivery, and strategic planning.

This division of labor works because it plays to each side’s strength. Your internal person knows the business context that an external provider can never fully replicate. They know which users are VIPs, which applications are mission-critical, and which office has the printer that jams every Tuesday. The MSP brings the tooling, the analyst bench, the after-hours coverage, and the specialized expertise that no single internal hire can match.

Many MSPs, including Infonaligy, will also offer to place a dedicated resource on-site multiple days per week for larger clients who want the feel of an internal team with the backing of a full-service provider. This hybrid approach gives you physical presence without the risk of building an under-resourced department that cannot keep up with the demands of a modern IT environment.

The co-managed model also solves the single point of failure problem. When your sole IT person takes vacation, gets sick, or resigns, the MSP maintains continuity. Documentation is kept current in shared systems. Escalation paths exist. The business does not grind to a halt because one person is unavailable.

What Your CFO Should Actually Be Comparing

The mistake most CFOs make when evaluating IT costs is comparing the MSP’s monthly fee against current staff salaries. That comparison misses the majority of the real cost.

A proper comparison looks like this:

In-house total cost includes salaries and benefits for all IT staff, licensing for every tool in the stack, hardware procurement and refresh cycles, training and certification costs, recruiting costs when someone leaves (and they will), the cost of coverage gaps during transitions, and the opportunity cost of not having capabilities you cannot afford to hire for.

MSP total cost includes the monthly managed services fee, any project work billed separately, and potentially one internal IT resource if you are running the co-managed model.

When Dallas-area CFOs and COOs run this analysis correctly, the managed services model typically comes in at 30 to 50 percent less than full in-house delivery for companies under 150 employees. But cost is only part of the equation. The MSP model also delivers capabilities that most SMBs cannot build internally at any price: 24/7 SOC monitoring, enterprise-grade SIEM, certified cloud architects, and a cybersecurity program that meets the requirements of insurance carriers and compliance auditors.

The question is not “can we afford an MSP?” The question is “can we afford to run IT ourselves when the tooling requirements alone exceed what most SMBs budget for their entire IT function?”

Two Models, One Conclusion

Whether you have 30 employees or 300, the calculus points in the same direction: the modern IT tool stack is too expensive, too complex, and too critical to run as a side function of your business.

For companies under 100 employees, full outsourcing to a managed service provider eliminates the hiring problem, the tool licensing problem, and the coverage gap problem in one move. For companies over 100, a co-managed partnership lets you keep the internal knowledge that matters while offloading the heavy lifting to a team with the depth and tooling to actually do it well.

Your company makes money doing whatever it does best. Unless that thing is IT, the smartest financial move is to partner with someone for whom it is.