News & Insights
In-House IT vs Managed IT Malaysia: Cost, Coverage and Control
Choosing between an internal team and managed IT services in Malaysia is usually presented as a cost decision, and cost is the part most organisations model worst. The headline comparison of salaries against a monthly fee leaves out the items that decide whether the arrangement works: coverage outside office hours, depth across platforms nobody on staff has touched, and who is accountable when something goes wrong.
This guide sets out how to compare the two properly. It covers the full cost of each model, the arithmetic of coverage, what control you keep either way, a side-by-side comparison including the hybrid arrangement most organisations actually land on, and a worksheet you can fill in before the decision goes to your board. Strateq has provided managed services since 1983 and has built both sides of this arrangement for customers, so the framework below is written to be used with any provider.
What Each Model Actually Means
In-house IT means employed staff running your systems, using tooling you licence, under your direct management. You control priorities day to day and carry the recruitment, retention and knowledge risk.
Managed IT means a provider operating agreed services for a recurring fee against defined service levels. You control scope and outcomes through a contract rather than through line management.
Hybrid is where most mid-sized Malaysian organisations end up, and it is a legitimate answer rather than an indecisive one. A small internal team keeps architecture, vendor selection, budget authority and business relationships. The provider takes the service desk, monitoring, patching, device management and after-hours cover. The design question is not which model wins but which specific functions sit on which side of the line.
The Real Cost of an In-House Team
Salary is roughly half the picture. A defensible internal cost model includes all of the following.
1. Employment cost beyond salary: Employer contributions to EPF, SOCSO and EIS, medical cover, bonus provision, and paid leave. Leave in particular is a coverage cost, not just a payroll one, because the work does not stop while someone is away.
2. Recruitment and replacement: Agency fees or internal recruiting time, notice periods worked at reduced productivity, and the ramp-up before a new hire is useful. In a tight market for infrastructure and security skills, an unfilled role can sit open for months.
3. Training and certification: Course fees, examination costs, renewal cycles and the working days lost to all of it. Certifications lapse, so this is recurring rather than one-off.
4. Tooling: Monitoring, remote management, ticketing, patch management, backup software, and the endpoint and network security stack. A provider amortises these across many customers; an internal team pays list price for a small deployment.
5. After-hours cover: On-call allowances, overtime, and the cost of a rota that is thin enough for one resignation to break it.
6. Key-person risk: Difficult to price and worth naming explicitly. When one engineer holds the undocumented knowledge of how the environment fits together, their resignation is an operational risk, not just a vacancy.
The Real Cost of Managed IT Services in Malaysia
The recurring fee is the visible number, and three other lines belong in the comparison.
1. Transition: Discovery, documentation, tooling deployment and knowledge transfer, usually a defined project before steady state begins. A transition priced at zero tends to be a transition performed at speed.
2. Out-of-scope work: Anything the service catalogue excludes, billed as project work. Migrations, office moves, new site builds and major upgrades commonly sit here.
3. Retained internal capability: Almost nobody goes to zero. Someone has to own the provider relationship, approve changes, set priorities and hold the provider to the service levels. Budget for that role, because leaving it unfilled is the most common reason these arrangements disappoint.
Set against those, the fee replaces salaries, tooling licences, on-call allowances and training, and it converts a fixed staffing cost into a scope you can renegotiate.
Coverage: The Arithmetic Most Plans Skip
Continuous cover is an arithmetic problem before it is a budget problem. A week contains 168 hours. Against a standard 40-hour week, covering one role around the clock takes more than four people before any allowance for annual leave, sick leave, training or attrition. A team of three engineers cannot provide 24-hour cover; it can provide an on-call rota, which is a different service with different response characteristics.
Three coverage questions decide the model:
- When do incidents actually occur in your business? A hospital, a bank’s payment channels and a fuel retailer’s forecourt systems all have their heaviest hours outside a nine-to-five window.
- How many locations need someone physically present, and how far apart are they? Multi-site organisations, particularly those with branches in East Malaysia, are pricing travel time as much as engineering time.
- What happens during simultaneous absence? Festive periods concentrate leave across a small team, and that is often when retail, hospitality and payments volumes peak.
Depth is the coverage question people forget. An internal team of five can be excellent and still have no one who has configured a particular firewall platform, tuned a specific hypervisor, or recovered a specific database engine under pressure. Providers carry that depth because they see the same platforms across many customers.
Control: What You Keep Either Way
The fear that outsourcing means losing control is understandable and mostly misplaced, provided the contract is written properly.
What stays with you in both models: IT strategy and architecture, budget authority, data ownership, the decision on which vendors and platforms to standardise on, and accountability. Under the PDPA an organisation remains responsible for personal data it engages a provider to process, and in regulated sectors accountability to the regulator is not transferable.
What genuinely changes is the mechanism. With employees, you redirect work in a conversation. With a provider, you redirect work through scope, change control and service reviews, which is slower for ad-hoc requests and considerably more rigorous for anything repeatable. Two protections make the difference: documentation of your environment delivered as a contractual output rather than held in the provider’s tooling, and exit terms agreed at signing that cover data return, documentation handover and transition assistance.
Control in an internal team has its own failure mode. Priorities set informally by whoever asks loudest is not control, and it is common in teams without an IT service management framework.
In-House, Managed and Hybrid Compared
| Dimension | In-house team | Managed service | Hybrid |
| Cost shape | Fixed, and rises in steps as you hire | Recurring and scoped, with project work billed separately | Fixed core team plus scoped service |
| Coverage outside office hours | Limited by headcount arithmetic | Contracted, and priced by the window you buy | Provider covers nights and weekends |
| Specialist depth | Limited to what you can hire and retain | Broad, drawn from a shared bench | Internal context plus external depth |
| Speed to add a capability | Recruitment cycle | Contract variation | Contract variation |
| Key-person risk | High, and concentrated | Transferred, subject to the provider’s own retention | Reduced but not eliminated |
| Day-to-day direction | Immediate | Through scope and service review | Immediate for the core team |
| Compliance evidence | Whatever your team documents | Reported against service levels, and auditable | Mixed, so define ownership per obligation |
| Lock-in | Knowledge sits with individuals | Managed through exit terms and documentation | Split by function |
Read the table as a scoping tool rather than a scoreboard. Score each row against your own environment and the pattern usually points to a division of labour rather than a winner.
Cost and Coverage Worksheet
Fill these twelve lines in before the decision goes to a board or a finance committee. The gaps are the argument.
- Total employment cost of the current team, including statutory contributions, leave and bonus provision
- Annual spend on monitoring, ticketing, patching, backup and security tooling
- Annual training and certification spend, including working days lost
- Recruitment cost and average time to fill an infrastructure role in the past two years
- Hours of cover currently provided outside office hours, and by how many people
- Number of platforms in the estate with only one person who can support them
- Number of sites requiring onsite attendance, and the travel time to the furthest
- Incidents in the past 12 months that occurred outside office hours, and their duration
- Quoted monthly fee for the equivalent scope, and precisely what the catalogue excludes
- Quoted transition cost and duration
- Cost of the internal role that will manage the provider relationship
- Exit terms: notice period, data return, documentation handover, transition assistance
Compare line 1 plus lines 2, 3 and 4 against line 9 plus lines 10 and 11. Then compare lines 5 to 8 against the service levels quoted, because that comparison, not the cost one, is what usually decides it.
Where Strateq Fits
Strateq has run IT operations for Malaysian organisations since 1983, which is long enough to have staffed both sides of this decision for the same customer at different stages of their growth.
The depth argument is the one worth testing on any provider. Strateq maintains partnerships across the platforms enterprise estates actually run on, including Cisco, Dell EMC, HPE, Lenovo, VMware, Nutanix, Microsoft, IBM, NetApp, Sangfor, Palo Alto, Huawei and Hitachi, supported by more than 800 staff across enterprise infrastructure and enterprise solutions. That is the bench an internal team of five is being compared against, and any shortlisted provider should be able to name theirs the same way.
On coverage across locations, Strateq operates from Malaysia, Singapore, Thailand, the Philippines, Hong Kong, China and the United States, which matters for organisations whose sites do not all sit in the Klang Valley. On outcomes, its public sector work includes a government client whose productivity improved by 50% following automation of performance reporting.
Fill in the worksheet, then bring the lines you cannot complete to Strateq’s managed IT services team and have them quoted against a defined scope.