Break-fix vs managed IT services
Two ways of buying IT support that look similar on an invoice and behave nothing alike in practice.
Updated October 2026
Break-fix is reactive: something breaks, you call, you pay, you wait. Managed services are proactive: systems are monitored and maintained continuously for a fixed monthly fee, and many issues are resolved before your team even notices them.
Most Malaysian SMEs start on break-fix without ever deciding to. You find a technician who is good and responsive, you call when something goes wrong, and the arrangement works until the business grows past the point where it can afford to wait.
The difficulty is that the two models are rarely compared honestly, because they are not priced the same way. Break-fix has no monthly number to put next to a managed quote. This page sets out what each model actually does, what break-fix costs in ways that never appear on an invoice, and the questions that reveal which one you are really on.
The two models, side by side
The row that matters most is the one about incentives. Most of the others follow from it.
| Break-fix | Managed services | |
|---|---|---|
| How you pay | Per incident, after the work is done | A fixed monthly fee per user, agreed in advance |
| When work happens | After something has already broken | Continuously, with most work happening before anyone reports a problem |
| Monitoring | None. The first alert is a staff member complaining | A Remote Monitoring Management System watches endpoints and servers around the clock |
| Patching and updates | Done when someone remembers, or when a problem forces it | Automated and tracked, so machines do not drift out of date |
| Security posture | Whatever was installed last time somebody looked | EDR Antivirus deployed and monitored across every covered endpoint, included on new subscriptions |
| Budget predictability | Unpredictable. A quiet month costs nothing, a bad month is a surprise | The same number every month, which makes IT a line item you can plan |
| Who the provider is incentivised to serve | Revenue rises when things break | Revenue is the same whether or not things break, so preventing failures is in the provider's own interest |
| Documentation | Usually lives in one technician's head | Maintained in an IT documentation system as part of the service |
| Asset and licence tracking | Not included | Tracked, with renewal dates visible before they lapse |
Under break-fix, a provider is paid more when your systems fail more. Nobody sets out to exploit that, but it does mean prevention is unpaid work, and unpaid work does not get scheduled. Under a fixed monthly fee the arithmetic inverts: every incident prevented is time the provider does not have to spend. That single difference explains most of what follows.
What break-fix costs that never reaches an invoice
The per-incident bill is the visible part, and usually the smaller one.
- Downtime is the invoice you never see. The repair bill is visible. The hours your team spent unable to work are not, and on most incidents they are the larger number.
- Nobody is watching the warning signs. Failing drives, filling disks, and backup jobs that quietly stopped running all announce themselves days in advance, but only to something that is monitoring for them.
- Security drifts without anyone deciding to let it. Patches go uninstalled and endpoint protection expires. Nothing feels wrong until the day it very much is.
- The budget cannot be planned. A model where cost is driven by how badly the month went is a model where finance cannot forecast, and where fixing things properly always loses to fixing them cheaply.
- Knowledge leaves when people do. If the only record of how your network is configured sits in one technician's memory, that record can resign.
For one established Malaysian enterprise, moving from reactive support to a managed arrangement took annual IT problems from 142 down to 39, a 72% reduction. The incidents were not handled faster. Most of them stopped happening.
Full detail on our case studies page.
Where break-fix is still the right call
Managed support is not the correct answer for every business, and a provider who says otherwise is selling rather than advising. Paying per incident is reasonable when all of the following hold:
- You run a handful of machines with no server, no shared storage, and no on-premise network equipment.
- A full working day of downtime would be inconvenient rather than costly.
- No customer, insurer, or auditor asks you about your security controls.
- You have someone internally who already handles updates, backups, and accounts competently.
The moment one of those stops being true, usually the first one, the arithmetic changes. A single shared server turns an individual machine failure into a company-wide stoppage, and that is the point at which monitoring stops being optional.
Five questions that reveal which model you are on
Paying a monthly fee is not the same as being managed. Some arrangements bill monthly and still behave entirely reactively. These five questions separate the two.
Does anything watch your systems when nobody is in the office?
If the answer is no, you are on break-fix regardless of what the invoice is called.
Do you know, without asking, when your backups last ran successfully?
Monitoring produces that answer on demand. Reactive support produces it after an incident.
Is patching scheduled, or does it happen when a problem forces it?
Unscheduled patching is reactive support with extra steps.
Would a new technician be able to work on your network from written documentation?
If the knowledge sits in one person's head, it is not a managed environment.
Is your monthly IT cost the same number each month?
A retainer that still bills per incident on top is a break-fix arrangement with a subscription attached.
What the first 90 days of a switch look like
Moving off reactive support is mostly archaeology before it is maintenance. Expect this order.
- An audit of what you actually have. Most SMEs coming off reactive support do not have a reliable list of their own machines, licences, and accounts. That list is the starting point.
- Monitoring and endpoint protection go on. Until systems are being watched, nothing else is measurable. This is also when the backlog of unpatched machines usually surfaces.
- The accumulated backlog gets cleared. Years of reactive support leave expired licences, unpatched servers, and undocumented configurations. This is usually the busiest part of the engagement.
- Documentation starts, and keeps going. Every change from this point is recorded, which is what stops the environment drifting back.
Businesses that have been on break-fix the longest tend to carry the most backlog, which is also why the early months feel busier than the steady state that follows.
What managed support costs
Managed IT in Malaysia is normally priced per user per month. Our published rates run from RM100 per user per month on Essential, which covers monitoring, EDR Antivirus, and automated patching, up to RM180 on Premium, which adds a 15-minute first response commitment and unlimited remote support during business hours.
Common questions
What is the difference between break-fix and managed IT services? +
Break-fix is reactive: something breaks, you call, you pay, you wait. Managed services provide proactive monitoring, predictable monthly costs, and significantly faster response times. Many issues are resolved before your team even notices them.
Is break-fix cheaper than managed IT support? +
In a quiet month, yes, because a quiet month costs nothing. Across a full year the comparison usually reverses, because the break-fix total includes the incidents that proactive monitoring would have prevented, plus the working hours lost while each one was being fixed. The more useful question is not which is cheaper in a good month, but which produces a number you can budget.
When does break-fix still make sense? +
For a very small office with no server, no shared infrastructure, and the ability to absorb a full day of downtime without real cost, paying per incident can be the rational choice. It stops being rational once a failure would stop people working, or once a customer or auditor starts asking how your systems are protected.
How do I tell which model we are actually on? +
Ask whether anything monitors your systems outside office hours, whether you know when your backups last ran, and whether patching is scheduled or triggered by problems. If monitoring and patching only happen after something goes wrong, the arrangement is reactive even if you pay a monthly fee for it.
What should we have ready before moving to managed support? +
A list of your machines and who uses them, your software licences and renewal dates, and administrative access to your own systems and accounts. If any of that is incomplete, reconstructing it is normally the first piece of work rather than a prerequisite.
Does managed IT replace our internal IT person? +
Not usually, and above roughly 45 to 50 users a combination tends to work better than either option alone: someone internal who handles daily requests and vendor liaison, with a provider covering monitoring, cover outside office hours, and senior escalation. Our IT support cost guide works through where that crossover sits.
Not sure which model you are on?
Tell us how your IT is supported today and what breaks most often. We will tell you plainly whether a managed arrangement would change anything for you, including when the answer is that it would not.
More reading: what IT support costs in Malaysia, what our service covers, the questions we hear most, or all guides and tools.