Managed security or doing it yourself?
The decision is less about buying a security product than deciding who will do the work. Updates need testing, alerts need interpretation and a backup needs someone who can restore it. A low monthly bill can be a sensible choice when you have the skills and time; it becomes a problem when essential tasks have no owner.
Compare three operating models against the systems your business relies on. Website hosting is only one part of the picture, so avoid assuming that a hosting security feature covers email accounts, laptops and every cloud application.
Doing the work internally
An internal approach can suit a technically capable team with documented routines and more than one person able to respond. You control priorities and configuration, and can tailor the work to your systems.
The cost includes time, tools, testing and cover during holidays or illness. Someone must watch for relevant advisories, maintain access controls and verify backups. Budget for incidents as well as normal operation.
Before choosing this model, ask the team to demonstrate a recent restore, explain the update process and identify the escalation route. If only one person knows a critical password or how to rebuild the service, continuity needs attention.
An IT partner on a defined engagement
A support partner can provide skills you do not need full time. This may work well for a mixed estate of devices, email and business applications. The arrangement can be reactive, scheduled or a combination, so specify it rather than assuming all activities are included.
Agree who monitors between visits, who pays for emergency work and whether after-hours support exists. Ask how work is recorded and what happens if your usual technician is unavailable. Obtain a current quote for the actual scope rather than using a generic European hourly-rate estimate.
An hourly model is not inherently poor value. It works when the required tasks, response expectations and budget are explicit.
Managed hosting for the website layer
Managed hosting combines infrastructure with specified maintenance activities. It can reduce hand-offs when one team maintains the website environment, updates and backups. The precise scope still differs between providers.
ResaHost plans start at €69 per month excluding VAT for Basic, with Pro at €129 and Premium at €189. Basic has monthly scheduled updates and a 48-hour first-response commitment; Pro and Premium have weekly scheduled updates and a 24-hour first-response commitment. Review current terms and limits for the relevant plan.
A first response is not a guaranteed fix. Telephone support hours are weekdays 09:00–16:00 Europe/Helsinki. Do not assume that a web contact channel available at night means a human is on duty around the clock.
Compare the same responsibilities
| Responsibility | Question to put in the proposal |
|---|---|
| Updates | Which components, what schedule and what urgent process? |
| Monitoring | What is observed and who acts on an alert? |
| Backups | What is copied, retained and tested? |
| Recovery | Who restores service, during what hours and at what cost? |
| Access | Who reviews users, credentials and integrations? |
| Incident coordination | Who contacts other providers and the business owner? |
| Evidence | What records or reports show the work was completed? |
The practical security guide helps identify these tasks before you request quotations. Compare like-for-like scope instead of treating every package labelled “secure” as equivalent.
Keep ownership when you outsource
The business still decides who may access customer information and which risks it accepts. A provider can carry out agreed technical measures, but it cannot automatically take over all governance obligations.
NIS2 scope depends on the organisation and applicable national implementation; buying managed hosting is not itself proof of compliance. Relevant suppliers can also face contractual requirements from customers. Check the applicable obligations and evidence with appropriate advice. European Commission NIS2 overview.
Avoid proposals that turn a hosting certificate or server location into a promise that the whole business is compliant.
Choose the gap you actually need to close
If the website is the unmanaged part of an otherwise capable internal setup, WordPress maintenance may be the right boundary. If nobody manages employee access or devices, a broader IT engagement may also be needed.
A hybrid model is entirely reasonable: your team owns business decisions, a specialist maintains the website and another named owner manages workplace systems. Write down the hand-offs so the model does not dissolve into “ask the other supplier”.
Review publicly visible settings and verify internal maintenance tasks separately. Choose the arrangement that makes those responsibilities credible and reviewable.