Break-fix IT — hourly-billed, reactive, called only when something breaks — was the dominant model for SMB technology support for thirty years. In 2026 it is shrinking quietly but persistently, and the driver isn't fashion. It's that the threat model has outgrown the model itself.
A business calling its IT person only when something breaks has, by definition, no patching cadence, no monitoring, no incident-response readiness, no backup verification. The cyber-insurer questionnaire has nothing to mark green. The supplier-onboarding form has no answers to give. The first sign of a ransomware incident is staff unable to log in on a Monday morning — because nothing was watching at 11pm Saturday night.
The managed-services model, where the engagement is a monthly retainer covering proactive work as well as reactive, exists because the threat environment requires it. Boutique managed services exists because the business model can be done well at scale, but it can also be done well — sometimes better — small.