The practical difference between managed IT services vs break-fix for law firms is not the invoice, it is who is responsible for the hours before something breaks. Break-fix buys you a technician after a failure, billed hourly, with no obligation to patch, monitor, log, or document anything in between. A managed agreement buys a defined scope of continuous work for a flat monthly fee, and it produces a written record of that work. For a firm carrying client confidences, that record is the part that matters. We have watched partners discover this the week a client security questionnaire lands, not the week a server dies.
The 5 Things Every Firm Should Weigh Before Choosing a Support Model
Before the pricing conversation, five points decide which model actually fits a legal practice. Read them as the summary of everything below.
- Billable time is the real unit of loss. A four-hour outage at a 25-attorney firm costs far more in unbilled hours than the annual difference between the two models.
- Reactive support cannot evidence safeguards. ABA Model Rule 1.6(c) asks for reasonable efforts to prevent disclosure of client information. Hourly repair work generates no artifact that answers it.
- Cost predictability is a partnership issue, not an IT issue. Firms budget on a fiscal calendar. Break-fix produces spikes exactly in the quarters where an incident lands.
- The crossover point is roughly 18 to 24 months. Before it, reactive support usually costs less on paper. After it, the prevented incidents change the arithmetic.
- Client-side security review is now routine. Corporate clients audit their outside counsel. The firm that cannot answer a questionnaire loses the panel seat, whatever its IT bill was.
Why Reactive IT Fails a Legal Practice Specifically
Reactive IT fails law firms because a firm’s output is time, and time lost to a systems failure cannot be recovered later. A manufacturer can run a second shift. A litigator who loses a morning to a document management system that will not open loses those hours permanently, and the associated write-offs never appear on an IT invoice, so nobody attributes them correctly.
Our team sees the same sequence at firms still on hourly support. A workstation begins failing intermittently in February. Nobody calls, because a call costs money and the machine mostly works. In April the drive fails during a filing week. The technician arrives the next business day, because there is no service level agreement compelling anything faster. Two attorneys share a laptop for three days. The invoice reads a few hundred dollars, and the partners conclude the model is working. The real cost sat in the write-offs nobody traced back.
The second failure is quieter. Under break-fix nobody owns patching. Windows updates get deferred by whoever is annoyed by the restart prompt, the practice management server drifts a year behind, and the firewall firmware stays at whatever version shipped with the box. None of that produces a ticket, so none of it produces a bill, so none of it happens.
What Changes on the Day a Client Audits You
The day a corporate client audits its outside counsel, the firm on a managed agreement can answer, and the firm on break-fix usually cannot. Panel counsel questionnaires now ask concrete things: do you enforce multifactor authentication on email, how often are backups tested and restored, who has administrative rights, when was your last vulnerability scan, do you have a written incident response plan.
Every one of those questions asks for an artifact. A managed provider generates them as a byproduct of the work: patch compliance reports, restore test logs, an access review, a scan schedule. Hourly repair work generates invoices, and an invoice is not evidence of a control.
There is a counterargument worth holding honestly. A firm with a strong in-house technologist can produce the same artifacts without an outside agreement, and some do. The distinction is not managed versus unmanaged, it is documented versus undocumented. Plenty of firms run a hybrid, keeping an internal lead and buying co-managed IT services for depth and after-hours cover. That is a legitimate third answer, and for firms above roughly 60 attorneys it is often the right one.
Where Break-Fix Genuinely Still Works
Break-fix still works for a solo practitioner or a two-attorney office running on cloud tools with almost nothing on premises. If there is no server, no on-site network gear beyond a business router, and the practice management platform is a vendor-hosted subscription, most of what a managed agreement covers has already been outsourced to the software vendors.
We say that plainly because the opposite claim, that every firm of every size needs a full agreement, is a sales position rather than a technical one. The honest test is whether a failure of any single component would stop billable work for more than a few hours. For a two-person cloud-native practice, usually not. For a 30-attorney firm with a document server, a phone system, and a scanning workflow feeding the file room, almost certainly yes.
The trap is that firms rarely revisit the decision after they grow. The support model chosen at four attorneys is still in place at 24, and nobody re-ran the test. That inertia, not the model itself, is what causes most of the damage we get called in to repair.
The Five Cost Traps Hourly Support Hides
Hourly support hides five costs that never appear on the IT line of a firm’s budget, which is why the comparison looks closer than it is.
Emergency premiums. After-hours and weekend rates commonly run one and a half to two times standard. Failures do not schedule themselves for Tuesday at ten.
Diagnostic time you pay twice for. A technician with no prior knowledge of your environment spends billable time learning it, on every visit. That discovery is amortized under a managed agreement and repurchased under break-fix.
Deferred maintenance compounding. Skipped patches and aging hardware do not stay neutral. They convert into a larger failure later, and the eventual repair is billed at the emergency rate.
Write-offs from downtime. The largest number, and the one that never reaches the IT budget because it lands in realization rates instead.
Cyber insurance friction. Carriers now ask for control attestations at renewal. A firm that cannot attest either pays a higher premium or accepts a lower limit, and both are real money.
How the Arithmetic Usually Lands
The arithmetic usually lands against break-fix somewhere between the second and third year, and the reason is the incidents that did not happen. Published comparisons put the crossover point around 18 to 24 months for a typical professional services office. Before that line, hourly support is genuinely cheaper. After it, the prevented outages and the avoided ransomware event dominate everything else.
A ransomware recovery at a mid-sized firm runs into six figures once you count the incident response retainer, the forensic report, client notification, and the weeks of degraded output. One event costs more than several years of a managed agreement. That is not a scare argument, it is the shape of the distribution: low probability, very high magnitude, and the reactive model does nothing to lower either variable.
The counterweight is real too. A managed agreement priced without regard for what a firm actually runs is money spent on scope you will never use. We have reviewed agreements charging per-user rates for a full security stack at firms that had no server, no on-site infrastructure, and 11 people. The model was right and the scope was wrong. Ask a prospective provider to map every line of the agreement to something in your environment, and strike what does not map.
What a Legal-Specific Managed Scope Should Actually Contain
A managed scope written for a law firm differs from a generic small business agreement in four places, and a provider who cannot name them has not worked with firms.
The first is document management. Firms run practice-specific platforms, and a provider who has never supported one will treat the application as somebody else’s problem the moment a problem is not clearly network related. Ask directly which platforms the provider supports in production today.
The second is retention and legal hold. General business backup policy keeps 30 or 90 days. Matter files outlive that by years, and a hold can freeze a mailbox indefinitely. The agreement should say what happens to a departed attorney’s mailbox and for how long.
The third is confidentiality boundaries. Ethical walls between matters have a technical expression: file permissions, mailbox delegation, and access review. Somebody has to maintain them, and under break-fix nobody does.
The fourth is managed security services scoped to the threats that actually target firms. Business email compromise aimed at wire instructions during a real estate closing is the recurring one we respond to, and it is defeated by mail flow rules and verification procedure rather than by antivirus. Our fuller breakdown of what to demand from a provider sits in our guide on managed IT services for law firms, and the general case for the model is covered in why firms move off break-fix support.
Firms comparing regional providers often start with a shortlist; ours for the New Jersey market is in our review of the best managed IT service providers for law firms in NJ. The same evaluation logic applies to other professional practices, which we walk through in our guide for accounting firms.
What the Switch Actually Looks Like in Practice
A firm moving off hourly support should expect the first 60 days to feel like an audit rather than a service upgrade, because that is what it is. The provider inventories every machine, every account, every piece of network gear, and every system that touches client data. Firms are routinely surprised by what surfaces: former staff accounts still active, a backup job that has been failing silently for months, a line-of-business application running on an operating system that stopped receiving security updates two years ago.
That discovery phase produces a remediation list, and the remediation list produces a one-time cost that sits outside the monthly fee. This is the moment where transitions stall. A managing partner who approved a per-user rate now sees a separate proposal for replacing four workstations and rebuilding a domain controller, and it reads like a bait and switch. It is not, but the sequencing makes it feel that way, so ask for the assessment before signing anything and let the remediation number be part of the original decision rather than a surprise after it.
The opposing view has merit and deserves stating. Some firms use that same assessment as leverage, take the findings, and hand them to their existing hourly provider to fix at a lower rate. Providers know this happens, which is why several now charge for the assessment and credit it against the first invoice if the firm signs. Either arrangement is reasonable. What is not reasonable is a provider who quotes a monthly rate without ever having looked at the environment, because that number is a guess, and the difference between the guess and reality lands on the firm as change orders in month three.
Frequently Asked Questions
Is managed IT always more expensive than break-fix for a law firm?
No. Managed IT costs more in the first year for most firms and less over a three-year horizon once prevented incidents and reduced downtime are counted. Firms under about five attorneys running entirely on cloud platforms are the common exception, where hourly support remains reasonable.
What does managed IT typically cost for a law firm?
Published market ranges put law firm managed IT at roughly 125 to 225 dollars per user per month, rising toward 300 for compliance-heavy practices with deeper security requirements. The spread reflects security scope, support hours, and how much on-premises infrastructure the firm still runs.
Does break-fix support satisfy ABA Model Rule 1.6(c)?
Break-fix support does not, by itself, evidence the reasonable efforts the rule contemplates, because it produces no record of safeguards between incidents. The rule asks about efforts to prevent unauthorized disclosure, and preventive work is precisely what the reactive model omits.
Can a firm keep its internal IT person and still use a managed provider?
Yes, and for firms above roughly 60 attorneys that hybrid is often the better structure. A co-managed agreement leaves the internal lead owning firm-specific applications while the provider carries monitoring, patching, security tooling, and after-hours coverage.
How long does moving from break-fix to a managed agreement take?
Most transitions run 30 to 60 days: an environment assessment, documentation of what exists, remediation of anything urgent, then onboarding into monitoring and patching. The remediation phase is where firms on long-deferred maintenance see a one-time cost before the flat fee starts.
Who Is Behind This Advice
Mindcore has supported professional services firms through this exact transition for years, including the uncomfortable middle stage where a firm has outgrown hourly support but has not yet written the agreement that replaces it. Most of what we know about the failure modes above came from being the provider called in after the second bad outage rather than before the first, and that vantage point shapes how we scope an engagement now.
Matt Rosenthal, Mindcore’s CEO, focuses the practice on matching the support model to what a business genuinely runs, rather than selling the largest agreement a client will sign. For firms weighing these two models, that means an honest reading of whether reactive support is still adequate, including the answer that sometimes it is.
Talk Through Your Firm’s Support Model
The choice between managed IT services vs break-fix for law firms comes down to a question the invoice cannot answer: on the day a client, a carrier, or opposing counsel asks what safeguards protect their information, can your firm produce a record. Reactive support keeps machines running and leaves that question open. A managed agreement answers it as a byproduct of work already being done.
The test we would run first is simple. List every system that would stop billable work if it failed this afternoon. For each one, name who is watching it right now, when it was last patched, and when its backup was last restored successfully. Most firms cannot complete that table, and the gaps in it are the real comparison, more than any per-user rate.
If the exercise leaves you uncertain, our team will walk your environment and tell you plainly which model fits, including whether your current arrangement is already sufficient. Book a free strategy call and we will map your systems against both models, or read more about our approach to managed IT services first.
