Most IT quotes are hard to compare, and often that is deliberate. Two providers can look at the same business and land thousands apart, not because one is better, but because they drew the line around "included" in different places. Here is how the pricing actually works, so you can read any proposal — including ours — with clear eyes.
Almost every proposal you receive uses one of these. Knowing which one you are reading tells you what happens to your bill when your business changes.
You pay a monthly fee for each person supported, and that person is covered across their laptop, desktop, phone and email. This is the most common model and usually the easiest to forecast, because your bill tracks headcount rather than hardware. It tends to favor businesses where people carry several devices each.
You pay per workstation, server, firewall or switch. This can look cheaper on paper for a small team, but the number moves every time equipment is added, and one employee with a laptop, a desktop and a tablet counts three times. Ask what happens when you replace or add hardware mid-term.
The provider bundles a defined set of services into a single monthly figure, often across good, better and best tiers. The value depends entirely on where the tier boundaries sit. A lower tier that excludes security monitoring or backup verification is not a discount, it is a different product.
When two quotes differ significantly, it is almost always one of these — not the provider's margin.
A business running everything in Microsoft 365 is cheaper to manage than one with an on-premise server, a legacy line-of-business application and a network closet nobody has documented. Physical infrastructure needs patching, monitoring, backup and eventually replacement, and all of that is labor.
A business with no regulatory obligations needs good security. A firm subject to HIPAA, NY DFS Part 500, SEC and FINRA rules or IRS WISP requirements needs good security plus documentation proving it was in place on a given date. Producing that evidence is ongoing work, and it is a legitimate cost difference rather than padding.
Antivirus and a firewall cost very little. Managed detection and response, SIEM log retention, Zero-Trust access controls, email filtering, security awareness training and phishing simulation cost considerably more, because they involve both licensing and people watching the output. This is usually the single biggest source of spread between two quotes.
Business-hours support and genuine 24/7 coverage are different staffing models with different costs. If a proposal promises round-the-clock response at a business-hours price, ask who specifically is awake at three in the morning and where they are located.
Onboarding a well-maintained environment is straightforward. Onboarding one with unpatched servers, shared passwords, no working backup and undocumented systems takes real work first. Some providers absorb that, some quote it separately, and some quote low and discover it later — which is the version that hurts.
The lowest number in a stack of proposals is often the most expensive by the end of the year. Here is where the difference tends to hide.
Migrations, office moves, server replacements and major upgrades sit outside the monthly fee with most providers. That is entirely reasonable. It should be stated plainly in the proposal rather than discovered when you need one.
Some providers include the cost of the security stack in your monthly rate and some pass licenses through separately. Both approaches are defensible. A quote that mentions neither is incomplete, and you should ask which it is before comparing it to anything else.
Backup is not one thing. How often it runs, how far back you can restore, whether Microsoft 365 is included and whether anybody verifies restores all change the price. Only the last one determines whether the backup actually works when you need it.
Check whether emergency or out-of-hours work carries a different rate. If it does, your worst day is also your most expensive one, which is exactly the wrong time to be reading the fine print.
Ask every provider you are considering the same five questions and compare the answers side by side. Vagueness is itself an answer.
A provider who knows their own service can list the exclusions from memory. If this question produces a long pause, the exclusions are where your surprises will come from.
Ask whether you get a named team that learns your environment or a queue that starts from zero each time. Ask whether support is domestic. Both materially affect how long your problem lasts.
Find out whether the agreement flexes in both directions and whether there is a minimum commitment. Very few businesses stay exactly the same size for the length of a three-year term.
A report saying the backup job completed is not evidence that a restore works. Ask what proof exists, in what form, and how often somebody actually checks it.
Most providers in this market self-assess. Independent assessment against a published set of controls is a meaningfully different claim, and it is easy for you to verify.
We charge one flat monthly rate covering unlimited US-based help desk support, 24/7 monitoring and proactive maintenance, with no hourly billing for day-to-day support. A routine problem never turns into an unexpected invoice, which matters mainly because it means nobody on your team hesitates before asking for help.
What that rate comes to depends on everything above: your headcount, how much infrastructure you still run yourself, what your industry requires you to document, and the condition of the environment when we take it on. We would rather look at your setup and give you a real number than publish a figure that turns out to be wrong for your business.
On the last question in the list above, our answer is on the record: MJN completed the GTIA Cybersecurity Trustmark assessment, independently assessed against 177 security controls by an accredited third party. You do not have to take our word for the security depth described on this page.