Co-Managed Network Services
Your internal IT team runs the day-to-day. We add the network engineering: the firewall (the box between your office and the internet), switches, Wi-Fi, the links between offices and remote access. Co-managed network services mean your IT keeps the keys and we design, fix and run that layer alongside them, without replacing anyone. Cisco and Fortinet certified; Aruba, Arista and Meraki managed as-is. Plans from $695 per site per month; start with a Network Risk Assessment, $3,500 for a single small site.
Track Record
We only do networks. That is not a limitation — it is why the outcomes are different.
Years of network-only practice. Architecture, security, and operations — not IT generalism.
Sites delivered. Healthcare clinics, law offices, financial branches, multi-site operations.
Design target for fully redundant builds with HA firewalls, diverse ISPs, and backed-up power.
Senior engineer–led. No junior handoffs. No ticket queue. No escalation chain.
Career aggregate. The 20+ years and 300+ sites span the operator’s full network-only practice, including prior-employer engagements. 99.99% availability, about 53 minutes of downtime per year, is an architecture design target for engagements that fund full redundancy. It is not a service guarantee or uptime SLA. Contracted response times and service levels are defined in each customer agreement.
Why Co-Managed Works
Co-managed network services exist because there’s a real gap between general IT and dedicated network engineering. Your internal IT person handles devices, Microsoft 365, and day-to-day support brilliantly. But when the firewall needs redesigning, when SOC 2 auditors want network-control evidence, when a multi-site rollout needs architecture — that’s a different kind of work — and unless it fills 40 hours a week, a full-time hire is hard to justify. Co-managed solves it. If your day-to-day IT is a general MSP, keep them; we cover the network layer alongside them. If you want the fully managed version instead, see Sacramento Fortinet MSP or Fortinet MSP for multi-site, or Fortinet MSP in San Francisco.
Your IT team keeps doing what they do well: help desk, devices, Microsoft 365, business apps, software vendor management. We layer on top: network architecture, firewall management, multi-site standardization, security posture, audit support. Two jobs, one written line between them.
We define up front who handles what — including incident response handoffs, escalation paths, change-management responsibilities, and procurement boundaries. No turf wars. No "I thought you were doing that." Everyone’s clear on the surface they own.
Every change comes with diagrams, configs, and decision records. Your IT person can read the documentation and understand what was done and why. The knowledge stays with your organization — if our relationship ever ends, you keep the runbooks. No vendor lock-in by way of mystery.
Your IT team gets a senior network engineer on call — not as a vendor relationship, but as a partner. The kind of person they can ping for a 15-minute architecture review or a 3-week project, depending on what’s needed. Real engineering depth, accessible like an internal hire.
What Co-Managed Looks Like
Concrete deliverables across the network engineering surface. Pick 2–4 of these, or all of them. Selection happens after the assessment.
A senior engineer reviews your current network end-to-end. You get a written report on segmentation, security posture, drift, and compliance gaps — with prioritized recommendations. The report is yours to keep, whether you continue with us or not. $3,500 for a single small site; larger networks are priced on the assessment pricing page. This is where a co-managed engagement starts.
FortiGate deployment, configuration, ongoing policy management, and a quarterly posture check from Edge Secure up. Auth integration with your identity provider. Site-to-site VPN (an encrypted tunnel between offices). Remote access with ZTNA, which checks who and what device for every app. Configuration backups for every managed device. The outcome: one platform, one configuration standard, every site.
If you operate across multiple locations — or run a regional or national footprint from a single HQ — we standardize the architecture across every site. Same config. Same vendor. Same monitoring. Consistency across the fleet that your internal team would have to build from scratch. If you run two or more sites, see the Multi-Site plan.
HIPAA, PCI-DSS, SOC 2 — the network controls that matter for each. Documented configurations, configuration backups and change history, ready for your auditor. A full audit evidence pack is a separate add-on ($1,500 build + $150/month refresh). We work alongside your compliance team to make audit cycles uneventful.
Automated monitoring of every site, every device and every link runs automatically; a senior engineer responds Mon–Fri, 8 AM–5 PM Pacific. Alert routing tied to severity — you get the page, not the complaint from your operations team. A monthly network summary, and on Multi-Site a quarterly roadmap review to catch drift before it becomes an incident.
If your current network was inherited, accumulated over time, or installed by a generalist MSP that has since drifted — we redesign it to a documented standard. HA firewall pairs. Aggregated cores. Dual-homed access. The architecture that means a single device failure does not take a site down. Firewall replacement is a fixed fee: a like-for-like FortiGate swap $2,500, a firewall migration from $6,500, or from $8,900 for 100F–200F or an HA pair.
Engagement Models
The shape of the engagement depends on what your team needs and how much surface they want owned externally. Pick the pattern that matches how much you want us to own.
Defined-scope project — network redesign, multi-site rollout, vendor migration, compliance hardening. Clear deliverables, fixed timeline, fixed fee: firewall migration from $6,500, SD-WAN $7,500 + $1,750 per spoke, ZTNA quoted after scoping. Your IT team handles operations during and after; we handle the engineering project. Typical: 4–16 weeks.
Ongoing senior engineer access at a flat monthly rate: the Co-Managed Bench (8 hours a month) or Embedded Authority (24 hours a month), used flexibly for changes, troubleshooting and project work as it comes up, or Architecture Oversight (4 hours a month) for change review and a monthly architecture call. Your team has someone to call without burning a per-hour T&M relationship. Priced from the published plans and retainers; standard changes on a plan bill at $225 an hour, 30-minute minimum.
We own the network engineering layer entirely — firewall management, monitoring, change execution, compliance posture, vendor relationships for network gear. Your team owns everything else. Built for organizations with two or more sites or active compliance requirements. Multi-Site plan: $2,495 for the first site and $995 per additional site; Compliance plan $1,795 per site. See how managed firewall pricing models compare before you weigh quotes.
Start with the assessment, then pick the engagement model that fits. You can switch models mid-engagement — project work shifts to retainer once you know the relationship works, retainer expands to full co-managed once your team is ready to hand off more surface. Need an engineer on site for a project? See professional services and staff augmentation.
Our Approach
No mystery. No black box. Every step is documented, explained, and approved before execution.
A Network Risk Assessment of your current network: about two weeks for a single small site, fixed price. Configurations reviewed, segmentation validated and gaps documented, in writing.
Address critical risks first, then build toward a standardized architecture. Every change documented, tested, and scheduled with a rollback plan.
Ongoing monitoring, documented changes and, from Edge Secure up, scheduled reviews. The network does not just work today — it evolves with your operations.
Your Engineer
Your IT team works with one senior network engineer as its point of contact, someone who learns your environment, your compliance requirements and how your team already works, from assessment through ongoing operations. Your staff never re-explain the network to a new technician or a ticket queue.
Background: Founder, ex-Meta. Past engagements include Cisco, Wells Fargo, Fannie Mae, and other Fortune 500 networks — the same caliber of engineering, now applied to mid-market organizations.
We are a Fortinet Engage Advocate partner and supply FortiGate, FortiSwitch and FortiAP. We also monitor and manage the Cisco, Aruba, Arista and other enterprise gear you already run. You don’t have to rip anything out to work with us.
Best Fit
The model fits best when there is an internal IT person or general MSP doing day-to-day work, but the network engineering depth is missing. These are the typical environments.
HIPAA-aligned network segmentation, EHR uptime, secure remote access for clinicians, patient-data network isolation across multi-site clinical practices. From independent specialty practices to multi-clinic networks — we keep the network out of the way of patient care. Recurring plans for clinics run through your MSP; see HIPAA managed network.
Confidential client data, secure document management network paths, and the kind of compliance posture client security questionnaires actually scrutinize. We operate the network behind the scenes so it does not become a liability surface.
PCI-DSS aligned network controls, audit-ready evidence, separation of cardholder data networks, and the kind of architecture documentation regulators and auditors expect. From regional credit unions to growth-stage fintech.
If you run two or more locations — or a regional or national footprint from a single HQ — we standardize the architecture across every site. Same vendor, same config, same monitoring. Reduces cost-of-incident and makes site expansion a documented, repeatable process.
Architecture firms, engineering consultancies, accounting practices, and similar professional services where the network has to be reliable but the firm is too small to justify a full-time network engineer. We function as the network engineering function, on retainer.
Networks supporting OT (operational technology), production lines, warehouse management, and logistics flow. Outages translate directly to lost throughput. We build these networks so operations teams can take uptime for granted.
FAQ
Not if scope is defined up front. We sit down with your IT lead before any engagement to map out who owns what surface, what escalation paths look like, and how communication flows during incidents. A good default: your IT keeps everything they currently do; we own the network-engineering layer; the boundaries are written down. Co-managed only fails when scope ambiguity isn’t resolved early.
Closer than people assume. The work is the same; the difference is structure. Hiring a fractional engineer directly means W-2 / 1099 negotiations, payroll, equipment, and an employment contract to unwind. Co-managed network services come with a documented scope, a written agreement with defined response times (not an uptime guarantee), notice in the first 90 days and you leave 30 days later with no early-termination fee, monitoring that runs whether or not anyone is on the clock, configs backed up and documentation that returns to you within 30 days, and the ability to scale up or down without renegotiating an employment contract. You still work with the same senior engineer as your point of contact; the difference is that everything is written down, so none of it leaves when the engagement ends.
Yes, intentionally. Documentation is part of every engagement — not just configs and diagrams, but decision rationale (why we chose this design, what alternatives we considered). That is the point: your IT person comes out of every project understanding the network better than before, and the write-up is theirs to keep.
That happens, and it’s a fine outcome. We design every engagement so the work is documented enough for a future internal hire to pick up. If you reach the point where a monthly retainer of fractional engineering isn’t enough, hiring full-time is the right move. The engagement can stay open at reduced scope (project work only) after a full-time hire arrives, for major redesigns or surge capacity.
Ongoing co-managed operations follow the published Edge plans ($695 to $1,795 per site per month; Multi-Site $2,495 for the first site and $995 per additional site) and the engineering retainers, starting with the Co-Managed Bench at $1,720 per month. Project work is fixed fee per project; firewall migrations have a published starting price and SD-WAN migration a published fixed price on their pages, and ZTNA is quoted after a short review of your users, rules and applications. Engineering outside a plan bills hourly at professional-services rates with a one-hour minimum; plan customers' standard changes bill at $225 an hour with a 30-minute minimum. Real numbers come out of the assessment, from $3,500 for a single small site.
Every plan includes automated monitoring and alerting. Human response is Mon–Fri, 8 AM–5 PM Pacific, at the response time in your agreement; outside those hours, alerts still fire and emergency work is billed at the after-hours emergency rate when an authorized contact asks. Because the engineer is named and senior, “response” means actual investigation and the start of mitigation, not a first-level acknowledgment that gets escalated, and not a promise of final repair or uptime.
Start the Co-Managed Engagement
Whether you ultimately want a one-shot project, an engineering retainer, or full co-managed operations, the starting point is the same: a senior engineer reviews your current environment end-to-end and delivers a written report with ranked findings and a 30/60/90 roadmap. It is yours to keep. $3,500 for a single small site; larger networks are priced on the assessment pricing page. See a sample report (PDF). From there, we structure the engagement to fit your team and your scope.
Response from a senior engineer within 1 business day.
A direct conversation — no sales team, no runaround.
An honest assessment of whether we are the right fit.
Clear next steps if we are — no pressure if we are not.
