The short answer
US managed IT pricing in 2026 runs $100–$250 per user per month for most small businesses (industry surveys from Kaseya, Corsica Technologies, and the MSP Alliance put the full range at roughly $50–$300). Regulated firms — healthcare, legal, financial — sit in the upper half. The average SMB spends about $15,000/year on managed services (Infrascale), and small-business contracts average roughly $2,500/month (MSP Launchpad).
What the tiers actually look like
Most providers sell bronze/silver/gold-style bundles. Labels vary; the underlying structure is consistent across the market (per-seat figures per Flamingo's 2025–26 MSP pricing survey):
| Tier | Typical price / user / mo | What's usually in it | Who it fits |
|---|
| Basic ("bronze") | $80–$120 | Helpdesk, patching, antivirus, monitoring. Backup often extra. | Unregulated firms with simple, single-site setups |
| Standard ("silver") | $140–$200 | Everything above + backup management, email security, identity management (MFA), vendor liaison | Most 10–50 person professional firms |
| Advanced ("gold") | $220–$350 | Everything above + 24/7 coverage, advanced security stack, compliance documentation, vCIO/strategy time | Regulated or multi-site firms with low downtime tolerance |
Alternative models you'll also see: per-device pricing ($30–$100 per endpoint — can beat per-user where staff share workstations), co-managed flat fees (a senior layer above your existing IT person — ATCOS's own co-managed tier starts at $750/mo), and break-fix hourly ($100–$250/hr — cheap until the month everything breaks at once).
What moves the number up or down
- Compliance scope. HIPAA covered entities and FTC Safeguards–regulated firms (every tax preparer, at any size) need written risk analyses, policies, and audit evidence. That's genuine labor — expect the upper half of the range, and be suspicious of a cheap quote that claims to include it.
- Coverage hours. Business-hours support and 24/7 emergency response are different commitments with different price tags.
- Site count and network complexity. Multi-location firms with site-to-site VPN, firewalls, and shared identity add real scope.
- Current state. A clean Microsoft 365 tenant onboards fast. Years of accumulated mess usually means a one-time remediation project first — get it quoted fixed-fee, separately.
- What "included" means. The classic padded-quote trick is a low per-user rate with everything meaningful — projects, on-site visits, after-hours, security incidents — billed separately. Normalize quotes by asking for last year's total invoices for a similar client.
Questions that expose a padded quote
- "What was your average total monthly invoice for a client our size last year?" — the per-user rate is marketing; the invoice is truth.
- "When did you last test-restore our kind of backup, and can we see the evidence?" — "we run backups" and "we verify restores" are different products.
- "Which of these compliance deliverables are documents we'll own?" — risk analysis, WISP, policies. If the answer is a portal subscription, you own nothing.
- "What happens at renewal?" — year-two increases of 10–20% are common; get the escalator in writing.
Where ATCOS lands
For calibration (and because we publish pricing): ATCOS managed IT starts at $125/user/month, co-managed escalation at $750/month, with compliance-heavy environments quoted with the documentation work included. If a competing quote is far below these numbers for a regulated firm, the difference is usually in what isn't included — which is exactly what a second-opinion review checks.