IT for Growth-Stage Companies (5 to 100 Employees): The Operating Manual

Every growing company hits the same wall, and it shows up earlier than most founders expect, often around 20 or 30 people. What got you here will not get you there.

The way you have been running technology stops working. The one person who has quietly run all of your technology is drowning, and they know it before you do. The "we will figure it out as we go" approach starts to leak in ways you can feel: a compliance question on an insurance renewal that nobody can answer, a phishing email someone almost clicked, a contractor who left three months ago and still has access to your files. None of it has burned the building down yet. All of it is smoke.

That is the inflection point. If you are reading this, you have probably hit it, and you are wondering what comes next. This page is the answer. By the end, you will know what your technology should actually be doing at your size, when to change it, what it should cost, and how to decide whether to hire someone or bring in a partner. No jargon. No fear-selling. Just the operating manual I wish every founder had before they called us.

I have built and launched several companies myself, and I have watched this movie play out a few hundred more times from the other side of the table. The companies that come out the other side in good shape are not the ones with the biggest budgets. They are the ones who treated their technology like an operating decision instead of a fire to put out. Let me show you what that looks like.

What your IT stack should actually do

Strip away the acronyms and an IT function at a growing company has five jobs. That is it. Five.

1. Keep people productive. Devices that work, identities that are managed, and the tools people collaborate in every day: email, chat, file storage, video.
2. Protect the business. Security, backups, compliance, and a cyber insurance posture that holds up under scrutiny.
3. Scale with the business. Onboard a new hire on day one, fully equipped. Offboard a departure the same day, fully revoked. Standards that survive you doubling headcount.
4. Cost predictably. No surprises on the monthly invoice. No capital-expense bombs that blow up a quarter.
5. Get out of the way. When technology is working, it is invisible. When it is not, it is the only thing anyone can talk about.

Here is the uncomfortable part. That is not what most IT setups at this size actually do. Most are reactive, organized around whoever answers when the printer breaks. Most are capital-expense shaped, built around the server somebody bought three years ago. And most are personality-dependent, which is a polite way of saying the whole thing lives in one person's head. That works until the day it doesn't, and that day always arrives without warning. If your technology only does job one, and only when something is already broken, you are carrying risk you cannot see. (More on the moment that one-person setup runs out of road in when you outgrow your accidental IT person.)

Here is the reframe worth sitting with. For most companies at this stage, technology is a headwind. It slows people down, eats nights and weekends, and shows up as a problem to be managed instead of an advantage to be used. It does not have to be that way. The clients we do our best work with are the ones who decide they want their technology to be a tailwind, something that pushes the business forward rather than holding it back. That single shift, from "keep the lights on" to "make this an enabler," changes every decision that follows in this manual.

The real cost question

Most CEOs ask the cost question backwards. They ask, "How much should I pay for IT support?" The right question is, "What does it actually cost to give my team everything they need to do their jobs safely?"

Those are not the same question, and the gap between them is where companies get hurt.

The "IT support" line on your budget is the small, visible piece. Underneath it sits the real bill: devices, software, identity, security, backups, compliance, and the people to run all of it. When a CEO tells me they spend $5,000 a month on IT and feel good about it, I have to be honest with them. You are not saving money. You are just not buying most of that list, and the bill comes due later as the breach you did not prevent, the compliance fine you did not see coming, or the three weeks of downtime you could not absorb.

Here is the comparison that actually matters, and it is the one your CFO can run. Cover the whole job with a single internal hire and you are looking at $135,000 to $215,000 in first-year cost for one person who still cannot reasonably handle security, compliance, and around-the-clock coverage alone. A full, all-inclusive managed model for a 50-person company runs about $10,000 to $15,000 a month, or $120,000 to $180,000 a year, for a team that covers all five jobs. Our own Agility 365 pricing lands in that range, roughly $200 to $300 per user per month with everything included. The work still gets done. It costs less because it is bundled, standardized, and you are buying with leverage instead of stitching tools together one at a time. (If you want the full math worked out for a 50-person company, here it is: How Much Should IT Support Cost for a 50-Person Company?.)

The in-house hire versus outsourced decision

Almost every growth-stage CEO assumes the answer is to hire somebody. At the 20-to-100-person stage, that instinct is wrong far more often than it is right. Let me walk the math, because it is the math that changes minds.

The math on hiring. A capable IT director costs $90,000 to $130,000 in salary, which lands around $115,000 to $165,000 a year once you load in benefits and taxes. For that, you get one person who is now responsible for the help desk, security, compliance, vendor management, projects, and being on call at 2 a.m. No single human covers all of that well. They cannot. And when they leave, and they will, you are starting over from zero with your entire technology operation walking out the door in someone's head.

The math on outsourcing. For roughly $10,000 to $15,000 a month, all in, you get a team that covers all five jobs, knowledge that persists when individuals change, onboarding and offboarding that actually keeps pace with your hiring, and around-the-clock coverage that one person physically cannot provide.

When does hiring make sense? When you need a genuine technology leader, a CTO-level person who is a business executive first and a systems person second. That is a different role, a different price, and a different conversation. What you usually do not need at 50 people is to hire a sysadmin and hope they grow into all six jobs at once. (We built an actual side-by-side worksheet for this decision, the kind you can take to your CFO: In-House IT Hire vs. Outsourced MSP: A CFO's Worksheet.)

The security reality at this stage

If you have not been asked hard questions about cyber insurance in the last twelve months, you are not lucky. You are next in line. Your underwriter simply has not gotten to you yet.

Here is what changed. Cyber insurance carriers now require something that looks like a real security program before they will write or renew a policy at a sane price. Multifactor authentication on everything. Email filtering. Endpoint protection. Backups with copies that cannot be altered or deleted. A documented plan for what you do when something goes wrong. If you cannot check those boxes, you either do not get covered or you pay three to five times what the company down the street pays. The federal government's own baseline guidance has said the same thing for years: multifactor authentication is one of the single most effective controls a business can deploy (CISA guidance on MFA). (For the full picture of what underwriters now check, what it costs to fail, and how to get ready in about 90 days, read Cyber Insurance Renewal Just Got Harder.)

For a CEO, the takeaway is simple. Security stopped being optional. It is no longer the thing you get to after the next funding round. It is now a precondition for being insurable, and being insurable is a precondition for being in business.

The encouraging part is that this is tractable. A growth-stage company that decides to prioritize it can be in line with what underwriters want inside about 90 days. It is a project, not a moonshot. And the same investment that satisfies your insurer is the investment that actually protects your business, which is the point. (For the human version of what a bad day looks like when those controls are missing, read What Happens to Your Business During a Ransomware Attack.)

The trigger points: 30, 50, 100

Technology debt compounds quietly. The trick is knowing what should already be true at each stage, so you fix things on a schedule instead of in a crisis.

At 30 employees, you should already have universal multifactor authentication, email filtering, endpoint protection, and automated backup running. If any of those are missing, that is a this-month problem, not a someday problem.

At 50 employees, you should have automated onboarding and offboarding, documented runbooks so the knowledge is not trapped in one person, a real password manager instead of a spreadsheet, and a process for managing your vendors. Missing those is a this-quarter problem.

At 100 employees, you should have a compliance baseline that fits your industry, whether that is SOC 2, HIPAA, PCI, or something else, plus formal incident response and a backup-and-recovery plan you have actually tested. Not discussed. Fire-drilled.

The pattern is the thing to internalize: roughly every 50 people, a new layer becomes mandatory. If you are still running the 20-person playbook at 80 people, you are not lean. You are carrying debt that gets more expensive the longer you hold it. (The full stage-by-stage breakdown is its own cluster post: Your IT Stack at 30, 50, and 100 Employees.)

Where Microsoft 365 fits

Most growth-stage companies should be running on Microsoft 365, and specifically on Business Premium. Not because Microsoft wins every individual category, but because the bundle is the best value in business software right now, and value at this stage means one platform decision that unlocks most of your operating model.

Business Premium includes the Office apps, Entra ID for managing who can access what, Intune for managing devices, Defender for protecting those devices, Purview for compliance, and Teams for collaboration. One bundle, one bill, one support relationship (Microsoft's own breakdown of what Business Premium includes).

Think about what that single decision can replace: a separate file-sharing tool, a separate chat tool, a separate identity provider, a separate password manager, a separate device-management product. The bundle is broad enough to absorb most of them. What it does not replace are your industry-specific applications, your CRM, your accounting system, the software your business actually runs on. Those keep doing their jobs alongside it.

The reason this matters to you and not just to your technical staff: companies that pick a platform and commit move faster than the ones who try to assemble the perfect collection of best-of-breed tools and spend the next two years integrating them. Decisiveness here is a competitive advantage. (Why Business Premium specifically, and how it stacks up against the heavier E5 tier, is its own cluster post: Why Microsoft 365 Business Premium Is the SMB Operating System.)

And if your team is genuinely committed to Google Workspace, you are not stuck or out of options. We regularly layer Microsoft's security components, Entra ID for identity and Defender for protecting devices, over the top of a Google shop. You keep the productivity tools your people already know and still get enterprise-grade protection wrapped around the accounts, the endpoints, and everything in between. The platform your team types in and the platform that secures it do not have to be the same vendor.

The three mistakes I see most often

Mistake one: hiring the wrong shape of person too early. The "IT guy" you hire at 35 people becomes a bottleneck at 60 and a flight risk at 80. The better path is to bring in an outside team until your operational scale genuinely demands an internal leader, and then hire a director or CTO who leads, rather than a technician you hope will grow into six jobs.

Mistake two: treating security as a cost center until the day it isn't. The CEO who underfunds protection right up until the morning they cannot is making a risk-management decision without realizing it. Reframe it for your board the way it actually is. This is not IT spend. It is insurance against an event that can end the company.

Mistake three: letting "cheap" pick your stack. The lowest-bid provider is rarely the right partner. You are not buying a commodity. You are buying the team that protects your business while you are on vacation. Buy on outcomes and trust, and treat the monthly rate as one input, not the whole decision. (The real, fully loaded cost of the cheap option is its own story in the true cost of cheap IT.)

What good actually looks like

Here is the picture, so you know what you are aiming at. The growth-stage CEO who has their technology in order:

• Knows their monthly technology cost to the dollar and can defend every line of it.
• Has not personally touched an IT problem in the last 60 days, because the team or partner caught it before it ever reached them.
• Onboards a new hire on day one, fully equipped and credentialed, with nobody scrambling.
• Offboards a departure in under four hours, with access revocation actually verified, not assumed.
• Holds a cyber insurance policy they can afford, with an underwriter who does not sweat them at renewal.
• Can answer "what happens if the office burns down tonight?" with a real plan instead of a blank stare.

None of that requires being a big company. It requires treating technology like the operating function it is. From the outside, the companies that have this look exactly like the ones that don't. The difference stays invisible right up until the moment it is the only thing that matters.

Your next move

Everything in this manual points to one choice: whether your technology stays a headwind you fight every week or becomes a tailwind that pushes the business forward. Here are two honest ways to start making the turn.

Take the 10-minute IT Stack assessment. It scores where you stand across the five jobs and tells you exactly where you are exposed, with a number you can take to your leadership team. It is the fastest way to turn this page from reading into action. Start the assessment.

Or talk to us. If you want a real conversation about what an outsourced operating model would look like for your specific size and industry, give us 30 minutes and we will come prepared with specifics. Talk to Summit.

One more thing, because it matters: you do not have to be a 50-person company to start. Some of the best partnerships we have began with a handful of users and grew from there. If your technology is in the way of where you are going, the conversation is worth having. We will either be a fit or we won't, and you will know quickly either way. Either way, you walk away knowing exactly what it takes to put the wind at your back.

---

Frequently Asked Questions

How much should IT support cost for a 50-person company? Plan for the all-in number, not just the help-desk line. Covering the whole job with one internal hire runs $135,000 to $215,000 in first-year cost. A bundled managed-services model delivers the same coverage for about $200 to $300 per user per month, everything included, which is roughly $10,000 to $15,000 a month for a 50-person company.

When should I hire an IT director instead of using an MSP? Hire internally when you need a technology leader who sits in business strategy, not a technician to run day-to-day systems. Below roughly 100 people, a partner usually delivers broader coverage for less than one loaded salary. Above it, a leadership hire plus a partner is common.

What is the difference between Microsoft 365 Business Premium and E5? Business Premium is built for small and midsize businesses and bundles productivity, identity, device management, and security at an SMB price. E5 is the enterprise tier with advanced security, analytics, and voice features most companies under 300 people do not yet need. Start with Premium.

Do I need cyber insurance at 30 employees? Yes, and more to the point, you need the security controls that make you insurable: multifactor authentication, email filtering, endpoint protection, and reliable backups. Without them, coverage is expensive or unavailable, and the underlying risk is real regardless of headcount.

What happens to my data if my MSP goes out of business? With a modern cloud-first setup, your data lives in your own Microsoft 365 tenant that you own, not on your provider's hardware. A good partner documents everything and hands over administrative control cleanly. Always confirm you hold the keys to your own tenant before you sign.

How long does it take to migrate from Google Workspace to Microsoft 365? For most companies under 100 people, a well-run migration takes a few weeks of planning and a cutover window measured in days, not months. The variables are mailbox size, file volume, and how many third-party tools you are consolidating. It is a project, not an ordeal.

Can I keep my on-premises file server and still hire an MSP? You can, but the better question is whether you should. Moving file storage into your cloud tenant usually improves security, backup, and remote access while removing a piece of hardware you have to babysit. A good partner will tell you when keeping it is genuinely the right call.

What is the fastest way to lower IT spend without adding risk? Consolidate. Most growing companies are paying for overlapping tools nobody fully uses. Standardizing on one platform like Microsoft 365 and one managed partner typically cuts total spend while improving coverage, because you stop paying fo