- 48% of ransomware victims treated in France in 2025 were microbusinesses, small and medium-sized enterprises (SMEs), or mid-sized companies, compared to 37% in 2024. The target has shifted toward organizations least equipped to respond on their own.
- An SME almost never has the staff to monitor its cloud infrastructure 24 hours a day. Managed services involve entrusting that monitoring and troubleshooting to someone whose job it is to do just that.
- IT outsourcing isn't a one-size-fits-all package: the scope (what the service provider manages and what you retain) is defined on a contract-by-contract basis, and it's this scope that makes all the difference.
- Outsourcing operations comes at a real cost in terms of dependence, and an SME that is honest with itself must understand what it stands to lose in terms of autonomy before it can appreciate what it gains in peace of mind.
- Ohmycad’s sovereign cloud offering is built on the Outscale Dassault Systèmes cloud managed services, with the scope defined in writing at the time of the quote, not after the first incident.
In practical terms, why does an SME need IT outsourcing?
An SME that hosts its infrastructure in the cloud rarely has a dedicated technical team to monitor it around the clock. A server that responds slowly on a Friday night, a backup that silently fails for two weeks, a security update that never goes through, these are common incidents, not extreme scenarios, and they happen when everyone is busy with other things. The Ministry of the Interior reports that 48% of the ransomware victims handled in France in 2025 were microbusinesses, SMEs, or mid-sized companies, compared to 37% in 2024: the proportion is increasing year over year, specifically among businesses that do not have a dedicated security team. Outsourced IT management addresses a structural problem, not a hypothetical risk: someone must monitor the infrastructure and intervene when it goes off track, and in an SME, that person often does not exist in-house.
What does IT outsourcing actually cover, and what does it not cover?
IT outsourcing involves entrusting the monitoring and maintenance of an infrastructure to a service provider, within a scope defined by contract. What many small and medium-sized businesses realize too late is that this scope varies greatly from one offering to another. A standard package typically covers the infrastructure: computing, networking, storage, virtual machine availability, and the application of security patches across these layers. Beyond that, everything depends on the contract: application backups with restore testing, operating system monitoring, database management, and after-hours support are options that may or may not be included. An SME that compares two managed services offerings without reading the scope line by line is comparing two different things that share the same name.
- Standard base: Computing, networking, storage, virtual machine availability, and security patches for these layers.
- According to the contract: Tested application backups, system monitoring, databases, and on-call support outside of business hours.
- On the client side: Application data, regulatory compliance, application code, and its specific vulnerabilities.
What is the SME still responsible for, even with an IT outsourcing contract?
Even with a good contract, certain responsibilities remain structurally the client’s, and glossing over them would do no one any favors. Application data and its regulatory compliance (GDPR, industry-specific regulations) remain the client’s responsibility, regardless of the hosting provider or managed services provider. Application code, its updates, and its specific vulnerabilities are covered only if the contract explicitly provides for it, which is rare in infrastructure managed services offerings. An SME that needs native managed databases (PostgreSQL, Redis in managed service mode) should be aware that this is not a feature promised by all sovereign cloud offerings: At Outscale, these components do not exist in a natively managed mode; instead, they are built as self-hosted instances with Ohmycad managed services layered on top. This is a question to ask before signing a contract, not a hidden limitation to discover later.
In-house IT outsourcing, a general-purpose service provider, or a specialized sovereign cloud provider: how do you decide?
There are three options, and none of them is inherently bad: the question is which one best fits the company’s actual size and constraints. Hiring internally makes sense once the technical team is large enough to justify a rotating on-call schedule; below that threshold, a position dedicated to infrastructure oversight often costs more than a managed services contract and creates a single point of failure if the person is absent. A general-purpose service provider is suitable for a standard infrastructure without strict regulatory constraints. A specialized sovereign cloud provider becomes relevant as soon as a contractual or regulatory requirement mandates that data remain in France under French law, or when the end customer explicitly demands it: This is the case for small and medium-sized enterprises (SMEs) that work with public sector clients, as well as those in the healthcare and defense sectors, or sectors subject to enhanced security specifications.
How much does IT outsourcing cost for an SME?
This article will not provide a specific figure, and this is not an evasion: the cost depends on the scope of coverage, the volume of infrastructure, and the level of service (on-call availability, guaranteed response time), and a figure presented without these details would be misleading. What we’ll state plainly, however, is the method: a reliable cost estimate always begins with an assessment of the existing infrastructure, never with a price quote before seeing the actual infrastructure. An SME that receives a price quote before describing its infrastructure is being given a bait-and-switch offer, not a legitimate cost estimate.
Conclusion
Managed IT services address a problem shared by all cloud-based small and medium-sized businesses: there is no one in-house to monitor the infrastructure full-time, while the focus of attacks is shifting toward companies least equipped to respond on their own. This is not a luxury reserved for large organizations.
Ohmycad’s sovereign cloud offering builds its managed services on the Outscale Dassault Systèmes cloud, with the scope clearly defined in the quote: what’s covered and what remains your responsibility, with no gray areas that come to light during the first incident.
The right approach: Have the scope of the IT outsourcing agreement clearly defined in writing before signing, not after the first incident.
Learn more about Ohmycad's sovereign cloud offering →
For more information: IT outsourcing and operations · The Trusted Cloud Label
Sources
- masecurite.interieur.gouv.fr, 2025 Overview of Cyberattacks in France (ANSSI)
- CERT-FR (ANSSI), 2025 Cyber Threat Overview (PDF)
FAQ
Frequently asked Questions
Does an SME really need managed IT services if its infrastructure is small?
The size of the infrastructure does not change the need for continuous monitoring. A small, poorly monitored infrastructure can also go down, and often with less flexibility to absorb the incident than a large one.
What is the difference between managed IT services and basic cloud hosting?
Hosting provides the infrastructure. Managed services add active monitoring and human intervention to that infrastructure: that’s the difference between renting a machine and having someone monitor it.
Does managed IT services cover the application security of my business software?
Rarely by default. The managed services agreement covers the infrastructure (computing, networking, storage, and systems). The application code remains the client’s responsibility unless explicitly stated otherwise in the contract.
Is it possible to have managed services for databases such as PostgreSQL or Redis?
Not in native managed mode on the Outscale cloud. The recommended approach is a self-hosted instance with Ohmycad managed services on top; this should be clarified before signing the contract if it is an identified need.
Need sovereign, managed, and encrypted hosting within your organization? An Ohmycad engineer will get back to you with a customized quote, not a generic price list: to be called back. The full list of offerings is on the page sovereign cloud.
