The Co-Managed
IT Market
Report.

Purpose, Scope, and Evidence Standard

Fox & Crow Instinct publishes this report for MSP operators, technology vendors, private equity firms, venture investors, and other channel decision-makers evaluating the Co-Managed IT market from the outside.

The analysis asks a narrow question: what distinguishes MSPs that publicly market Co-Managed IT from the rest of the MSP market?

The answer matters because size and service labels are easy to screen. MSPs use them to map competitors. Vendors use them to find partners. Investors use them as early filters. Buyers use them to decide which providers belong on a shortlist. This report tests how much those screens explain once stronger observable signals are introduced.

Scope and Boundaries

Every quantitative finding in this report comes from Fox & Crow Instinct. No external analyst benchmarks, survey statistics, vendor-program figures, or outside market-size estimates are introduced.

The analysis can observe a public service claim and compare the aggregate profile around it. It cannot observe contractual scope, internal process quality, client satisfaction, financial performance, delivery outcomes, or whether the service claim caused the surrounding profile. Those questions belong to verification.

In this report, readiness profile is an interpretive term for observable maturity, infrastructure-security, and compliance signals. Volume IV does not create a Co-Managed IT readiness score, certify capability, or label individual firms operationally ready or unready.

Data Collection and Assessment Scope

Instinct observes publicly available website, DNS, security, service, search, local, employer, and social signals. The platform organizes those observations into structured market intelligence for MSPs, technology vendors, private equity firms, and venture investors.

The analysis begins with the canonical Instinct MSP universe: 37,548 companies in the platform's sellable MSP classification set. The declared cohort consists of 1,546 companies carrying the Co-Managed IT service-taxonomy tag. Every other company forms the comparison group; “not declared” does not mean “does not deliver.”

Service-related comparisons use an assessed base of 35,820 firms whose services were captured, reducing the risk that missing service data is mistaken for absence of the offer. The headline readiness comparison uses 28,693 North American firms to address the category's geographic concentration and the platform's stronger North American enrichment.

Size Is a Poor Standalone Filter.

The visible Co-Managed IT cohort looks ordinary on size and unusual on readiness. Small firms account for 43.9% of Co-Managed IT advertisers and 43.5% of the comparison group. The declared cohort has more medium firms, fewer large firms, and fewer enterprise firms. Roughly three in ten companies remain unclassified on size, which limits precision, but the observed distribution does not support a large-firm explanation.

The readiness signals separate the cohorts much more sharply. Within North America, Co-Managed IT advertisers are about 2.3 times as likely to reach the top Fox & Crow Maturity Level (FCML) tier, 16 percentage points more likely to reach the top infrastructure-security band, and about 2.4 times as likely to sit above the observable compliance baseline.

A size-first screen therefore misses information already visible in the market. The data does not show that size is irrelevant to delivery capacity, enterprise fit, or commercial scale. It shows that size does not explain the cohort's stronger observable profile and should not stand in for readiness.

Scale describes the firm. It does not, by itself, explain the readiness profile.

What the Claim Can and Cannot Show

Co-Managed IT describes shared responsibility between an MSP and an internal IT function. The scope can be narrow or extensive, but the operating model always introduces a boundary between two teams. That boundary creates questions about ownership, access, escalation, security, and accountability.

The public service page answers only one of those questions: does the provider want to be considered for the category? The surrounding record offers more evidence.

Volume IV calls the distance between the category claim and that surrounding evidence the Claim-Readiness Gap. The concept is a qualification lens, not a score. A weak surrounding profile should trigger deeper diligence; a strong one provides corroborating evidence but does not certify delivery.

The profile is specific rather than universally stronger. Co-Managed IT advertisers over-index on FCML, top-band infrastructure security, and above-baseline compliance even after the analysis is restricted to North America. They also show stronger local-market and employer visibility. LinkedIn provides a counter-signal: raw presence is nearly identical across cohorts, and the declared group is less likely to reach the measured higher LinkedIn maturity band.

Three Layers of Evidence

Buyers begin with what providers make visible. Deeper market intelligence can search beyond the label.

One Label Covers Very Different Operating Models.

Co-Managed IT describes a relationship structure more reliably than it describes a standardized service package.

The shared feature is the presence of two operating parties: an internal IT function and an external provider. One provider may handle a narrow function such as licensing administration, backup, or escalation support. Another may carry substantial responsibility for infrastructure, security, help desk, documentation, and escalation while the internal team retains defined applications, architecture, or decision rights.

Those arrangements can look very different in practice while carrying the same public label. A market count can therefore establish who claims the category, but it cannot establish comparable contractual scope.

A Working Definition

For this analysis, Co-Managed IT is an arrangement in which an MSP and an internal IT function share responsibility for the client's technology environment, with some division of ownership, access, support, administration, or accountability.

The label still carries information. A provider that names Co-Managed IT is asking to be evaluated for work inside an environment where another IT team remains present. The rest of this report asks what observable characteristics tend to surround that claim.

The Operating Boundary Creates the Readiness Burden

The category claim therefore carries a different burden than a generic managed-service page. It promises cooperation inside an existing IT function. That promise makes the surrounding record relevant, but never conclusive.

Only 4.1% Name the Category Publicly.

Among 37,548 MSP-classified companies in the canonical Instinct universe, 1,546 publicly market Co-Managed IT.

The category count is best understood as a visibility measure. It tells us how many MSPs have made the service legible to a buyer or competitor searching for that language.

Fully Managed IT provides a useful reference point. Instinct records 1,593 firms publicly marketing Fully Managed IT, or 4.2% of the same universe. The two public labels appear at almost identical rates. That does not imply that the underlying delivery markets are equal. It shows that explicit service naming is sparse enough that absence of a tag cannot be treated as evidence of absence of delivery.

The 4.1% still defines the declared competitive field. A buyer searching the category starts with firms that have named it. An MSP mapping visible category claimants sees the same field. A vendor screening only on the service label does too.

The Assessed Base Confirms the Same Prevalence

Services were captured for 35,820 of the 37,548 MSPs. Within that assessed base, 1,467 firms carry the Co-Managed IT tag and 34,353 do not—again 4.1%. Excluding the 1,728 firms without a service-breadth assessment prevents missing service capture from being silently treated as a negative service finding.

The same taxonomy identifies 1,593 firms publicly marketing Fully Managed IT, or 4.2% of the canonical universe. The near-parity does not imply equal delivery markets. It demonstrates that explicit service naming is sparse even for a familiar MSP offer.

The 4.1% is the declared market. The delivery market is not observable from the service label alone.

Scale Does Not Explain the Cohort.

Firm size is often used as a proxy for sophistication because it is easy to collect and compare. In the Co-Managed IT cohort, it explains very little of the observed separation.

If the readiness differences were mainly a scale effect, the declared cohort should lean toward large and enterprise firms. It does not. The stronger separation appears in the North America-controlled readiness measures.

The Full Distribution Shows Where Maturity Moves

The North America control supplies the headline comparison, but the assessed-base distribution shows how the cohorts differ. Co-Managed IT advertisers are not uniformly top-tier. Most sit in FCML band 3, as do most other MSPs. The separation comes from substantially less representation in the lower band and more in the top tier.

Band 1 is essentially empty for the declared cohort. After restricting the analysis to North America, the top-tier comparison becomes 9.4% versus 4.0%, or approximately 2.3 times. The gap narrows but persists.

Security Is Broad; Compliance Is Selective

Infrastructure security captures observable email, DNS, and related posture. On the assessed base, 86.9% of advertisers reach band 5 compared with 69.9% of other MSPs; 97.0% versus 92.6% reach band 4 or higher. It is one of the cleanest measures because it is scored for approximately everyone, but the broader threshold also shows why security works better as a condition than a final selector.

Compliance provides greater separation. On the assessed base, 37.6% of advertisers sit above baseline at band 2 or higher, versus 14.7% of other MSPs. At the stricter band 3 threshold, the comparison is 19.3% versus 5.9%. The measure does not establish certification, successful audits, or regulatory compliance; it identifies a materially more compliance-oriented public footprint.

The North America-only comparison tests whether geography is sufficient to explain the headline. It is not: FCML, top-band security, and above-baseline compliance all remain materially stronger among advertisers. Broad coverage of these measures reduces the concern that richer marketing surfaces alone are creating the pattern, but it does not eliminate measurement bias.

The competitor you should worry about may not be the largest MSP in your market.

Alternative Explanations

These comparisons describe an association, so the analysis tests whether three observable factors could be producing the pattern: public-data coverage, geography, or firm size.

These checks reduce the most visible alternative explanations, but other explanations remain open. The analysis does not simultaneously control for geography, size, tenure, vertical focus, and every other characteristic. It does not establish statistical significance, and it cannot determine whether maturity enables the Co-Managed IT motion or whether pursuing the motion encourages maturity.

Geography and Tenure Add Context, Not Proof

North America accounts for 95.2% of the declared cohort compared with 74.7% of other MSPs, confirming that Co-Managed IT is predominantly a U.S. and Canadian market term in this corpus. California, Florida, Texas, New York, and Pennsylvania lead the declared count, broadly mirroring the overall MSP footprint rather than revealing a single-state distortion.

Founded-year coverage is only about 13%, so tenure is indicative at best. Within the available observations, 15.3% of advertisers versus 12.5% of other MSPs were founded by 2009; 1.3% versus 1.7% were founded in 2015 or later. The direction is consistent with a somewhat more established cohort, but the coverage is too sparse to carry the argument.

The Service Label Is Only the First Piece of Evidence.

A Co-Managed IT page establishes a category claim: the provider wants to work beside internal IT. Buyers, vendors, investors, and competitors can compare that claim with a broader public record.

Volume IV uses Claim-Readiness Gap to describe the distance between the claim and the observable readiness profile around it.

The concept is deliberately qualitative. A provider with a strong surrounding profile offers more corroborating evidence for the claim. A provider with a weak surrounding profile creates more unanswered questions. Neither condition proves how the firm performs inside a client environment.

That distinction protects the analysis from two errors. A service page cannot be treated as proof of delivery. A weak public footprint cannot be treated as proof of poor delivery. The public record is useful because it changes the quality of the questions, not because it eliminates diligence.

Co-Managed IT advertisers are more likely to have a Google Business or Maps presence and more likely to appear on Glassdoor and Indeed. Search performance also separates among firms that can be scored: 17.9% of scored Co-Managed IT advertisers reach the top SERP bands compared with 6.8% of scored other MSPs.

The scored-at-all comparison is smaller: 32.3% of advertisers and 27.0% of other MSPs have a SERP score. Among scored firms, 53.6% of advertisers sit in the worst band compared with 79.5% of other MSPs. Google Business or Maps shows the same two-part pattern: presence is 51.3% versus 36.1%, while approximately 54% versus 29% of scored profiles reach the top bands.

Employer visibility also separates. Glassdoor presence is 40.3% versus 27.1%; Indeed presence is 30.5% versus 17.6%. Recent public hiring activity is 2.4% versus 1.4%, a relative difference consistent with stronger hiring posture but based on thin job-post coverage and low absolute rates.

These are useful corroborating signals, but richer public surfaces are easier to detect. They do not deserve the same evidentiary weight as FCML, infrastructure security, and compliance.

LinkedIn prevents the profile from becoming a generic digital-maturity story. Presence is almost identical across cohorts, and the declared group is less likely to reach the measured LinkedIn maturity band 2: 9.4% versus 15.9%. Facebook moves in the opposite direction: presence is 57.3% versus 52.1%, and 33.1% versus 18.7% of scored profiles reach the top Facebook bands.

The profile is therefore concentrated rather than universal. The declared cohort separates most clearly on overall observable maturity, infrastructure security, compliance, local visibility, and employer presence. It does not lead on every public channel.

A Qualification Sequence, Not a Score

The sequence does not weight the measures or produce a certification. A sparse record may reflect weak visibility rather than weak delivery. A strong record may reflect sophisticated marketing rather than operating quality. Its purpose is to replace an indiscriminate first screen with an ordered set of questions.

The Biggest Pool Is the Least Selective.

The North American comparison contains 27,219 MSPs outside the declared Co-Managed IT cohort. Within that population are much larger pools of firms that already exhibit individual signals associated with the declared cohort.

The infrastructure-security pool is the largest by far. That makes it useful as a broad condition and weak as a standalone selector. If almost seven in ten non-advertisers already reach the top band, security alone does little to distinguish a short list.

Compliance is more selective. 4,154 North American non-advertisers sit above the observable baseline. Top-tier FCML is narrower again at 1,097 firms.

Those populations should not be collapsed into a single latent-market estimate. The overlap is unknown. Their value lies in screening: each identifies a different way to search beyond the service label.

Use Selectivity in the Right Order

Top-band infrastructure security is a broad condition. Compliance is a narrower qualifier. FCML ≥4 is the most selective of the three published pools. That suggests a screening logic, but not a universal formula: use the broad security condition to remove obvious mismatches, the more selective maturity and compliance signals to prioritize, and direct diligence to decide.

For a vendor, the 1,546 declared firms are the obvious discovery pool, but not the only firms worth qualifying. Search the undeclared market for selected maturity or compliance characteristics, confirm that the security baseline is present, and then investigate company-level product fit before committing enablement, co-selling, joint marketing, or market-development resources.

The data does not predict which non-advertisers will adopt Co-Managed IT. It does not show which vendor programs will create revenue, sell-through, retention, or margin. It identifies where a label-only or size-first search leaves potentially relevant firms unexamined.

For MSPs, the same logic changes competitive mapping. The declared competitor set is only the visible category. A smaller firm without a Co-Managed IT page may already exhibit parts of the readiness profile associated with the declared cohort. That does not make it a Co-Managed IT competitor today, but it makes the firm's trajectory worth watching.

For investors, the undeclared market separates service naming from observable posture. A target does not need to advertise Co-Managed IT to exhibit signals associated with firms that do. That can inform screening before operational and financial diligence begins.

Four Decisions, Four Advancement Tests

The 4.1% is the part that has named itself. The rest has to be found another way.

The Public Report Shows the Pattern. Instinct Moves the Analysis to Company Level.

Fox & Crow Instinct is the MSP Decision Intelligence Platform that produced this report.

Volume IV establishes a market-level pattern: Co-Managed IT advertisers are not larger than the surrounding MSP market, but they are more likely to exhibit stronger maturity, infrastructure-security, and compliance signals. It also identifies separate signal pools outside the declared category.

The decisions that follow are company-specific. Which MSPs in a territory already claim Co-Managed IT? Which non-advertisers meet selected maturity, security, or compliance conditions? Which declared firms create more unanswered questions between claim and observable profile? Which smaller providers would disappear in a size-first screen despite stronger corroborating signals?

Those questions require the company-level intelligence behind the aggregate findings.

Instinct remains bounded by what can be observed publicly. It does not replace client references, financial analysis, security audits, operational diligence, or delivery assessment. The report demonstrates what the observation layer can reveal. Instinct provides the company-level record and custom cohort analysis needed to apply the same logic to a specific market.

The Market Has Been Leaving Clues All Along.

Co-Managed IT is a small declared category associated with an observable profile that firm size does not explain. The declared cohort is not concentrated among large and enterprise MSPs. It shifts out of the lower FCML band, over-indexes in the top tier, presents stronger infrastructure-security and compliance signals, and is more visible in several local and employer channels.

The profile is not universal. LinkedIn runs against the pattern. Search, local, employer, and social observations are more exposed to detectability. Tenure coverage is sparse. Size remains relevant to many commercial questions, and nothing in the analysis verifies delivery. Those boundaries make the central result narrower—and more useful.

A Better Way to Read the Market

Declared: the 4.1% tells us which firms have made the category visible. That is the buyer's discoverable market and the obvious competitive or partner set.

Observable: the surrounding maturity, security, compliance, and market-presence signals improve qualification. They show where size and label-only screens discard information already available in the public record.

Verified: direct diligence must establish scope, staffing, controls, references, economics, and accountability. Public evidence can prioritize that work; it cannot complete it.

For buyers, that means beginning with visibility but refusing to end there. For MSPs, it means watching the profile around competitors rather than their headcount alone. For vendors, it means moving from the declared pool into selective undeclared cohorts without manufacturing a latent-market total. For investors, it means separating scale, observable readiness, and verified operating quality into different stages of the decision.

The market leaves clues. The advantage belongs to the reader who knows which clues can screen, which can corroborate, and which still require proof.

Data Collection and Assessment Framework

Market Universe and Comparison Bases

The canonical universe consists of companies in Instinct's sellable MSP classification set. The declared group carries the Co-Managed IT service-taxonomy tag; the comparison group includes every other canonical MSP. The full universe establishes declared category participation. The assessed base reduces the risk that a missing service label is confused with a missing service assessment. The North America control addresses the geographic concentration of the label and carries the headline FCML, infrastructure-security, and compliance comparisons.

All reported figures come from aggregate counts. Percentages for other MSPs on the assessed base are derived by subtracting the declared cohort from the assessed total within each bucket. No company identities or company-level rows enter the published analysis.

Primary Measures

Bias Controls and Boundary Conditions

Public claim vs. verified delivery. The Co-Managed IT tag comes from public market language. It identifies advertisers or category claimants. Delivery quality and contractual scope remain outside the measurement.

Detectability. Richer public surfaces can make some signals easier to observe. The headline comparison therefore relies on FCML, infrastructure security, and compliance, which are scored for approximately the full relevant population. Search, local, employer, hiring, and social measures carry more detectability risk and are treated as supporting signals.

Geography. The declared cohort is heavily concentrated in North America, where Instinct enrichment is also strongest. The three headline readiness measures are rerun on a North America-only base. The gaps remain material.

Unknown values. Unknown means unassessed or unavailable. It is never converted into zero, low, inactive, or weak.

Undeclared signal pools. The North American non-advertiser counts for FCML ≥4, infrastructure-security band 5, and compliance band ≥2 are calculated separately. Their intersection is not available in the current analysis, so no combined latent-market total is published.

Small-count suppression. Corpus buckets below five are suppressed as <5 and are not converted to exact counts.

Association, not causation. The analysis cannot determine whether maturity enables the Co-Managed IT motion, whether pursuing the motion encourages maturity, or whether another characteristic influences both.

Service-breadth overlap. Co-Managed IT contributes to the service-breadth measure itself. The band-5 comparison is therefore contextual and partly mechanical, not an independent proof point.

Coverage, Exclusions, and Resolution

Data Governance and Currency

All published findings are aggregate. No MSP names or company-level rows appear in the report. Readers receive the cohort definitions, bases, controls, coverage limits, and available aggregate counts required to evaluate the findings. Company-level validation, custom cohorts, and deeper market analysis remain separate from this public report.

Aggregate Reproducibility Record

Published by Fox & Crow Group, Inc. Data: Fox & Crow Instinct, The MSP Decision Intelligence Platform. The Co-Managed IT Market Report: What 37,548 MSPs Reveal About Why Size Is a Poor Proxy for Readiness. Volume IV, August 2026. All rights reserved. © 2026 Fox & Crow Group, Inc.