Essential, Business, Managed: which KA IT package for your SME?

Choosing between three packages shouldn't take two weeks of deliberation. Yet most MSP sales sheets pile up technical bullets without saying who each package is built for, nor what is not included. This article puts the three KA IT packages side by side with a single goal: helping you decide in under an hour between Essential, Business and Managed.

1. Choosing in 3 questions

Three questions are enough to pre-decide your package. No complex scoring needed.

1. How many active IT users? Not total headcount, the number of people who use a workstation, mailbox or business tool daily.
2. What IT criticality level? If your business stops without IT (e-commerce, medical practice, finance, legal, multi-site retail), criticality is high. If one day without IT is annoying but survivable, it's moderate.
3. What need for strategic steering? Do you just want it to work (Essential / Business) or also a formal contact, a monthly review and roadmap recommendations (Managed)?

Typical answers:

• 5-10 users, moderate criticality, no formal steering expected → Essential.
• 10-30 users, customer or financial data, NIS2 in sight → Business (the sweet spot).
• 25-60 users, regulated sector or high criticality, steering expected → Managed.

2. The detailed comparison

Side-by-side view of the three packages. All VAT excl., per user per month, without fixed-term commitment.

3. Essential €25: who it's for, what's included

The Essential package is designed for structures where IT is a support function, not a critical core business.

Typical profile

• Small businesses with 3 to 15 users.
• Mostly office-based activity: mail, Office suite, web browsing, light business applications.
• No critical on-site server (the core business lives in Microsoft 365 or Google Workspace).
• Low-sensitivity data or modest volumes.

What's included

• Business-hours helpdesk (phone, email, customer portal).
• Managed antivirus on all workstations.
• Basic workstation monitoring (health status, disk, RAM, updates).
• Patch management for Windows and common applications (browsers, PDF readers, Office).
• Microsoft 365 or Google Workspace account management.
• Support on Windows and Mac workstations.
• Customer portal with ticket tracking and 24/7 conversational AI.

What's not included

• EDR (advanced detection) — only in Business and Managed.
• Microsoft 365 backup — only in Business and Managed.
• Generalised MFA included — available as paid option.
• Out-of-hours on-call standby.
• Structured phishing training.
• Documented NIS2 compliance.

4. Business €50: the SME sweet spot

The Business package is the most chosen by Belgian SMEs with 10-30 workstations. It covers most current cyber requirements while remaining economical compared to a junior in-house technician.

Typical profile

• SMEs with 10 to 30 users.
• Customer, financial or business-sensitive data.
• Clear cyber requirements: customers demanding security commitments, banking partners, insurers, or NIS2 positioning.
• No formal need for strategic steering yet.

What's included on top of Essential

• Managed EDR on all workstations (behavioural detection, not just signatures).
• MFA included on critical accounts (Microsoft 365, admin access, VPN).
• Daily Microsoft 365 backup with 30-day retention (mail, OneDrive, SharePoint, Teams).
• Automated patch management for OS, applications and supervised servers.
• Infrastructure monitoring: servers, NAS, switches, firewall.
• Managed and supervised firewall (configuration, updates, rules).
• Annual phishing training with post-training test.
• Integrated NIS2 technical building blocks (see our NIS2 checklist in 12 steps).

What's not included (vs Managed)

• Dedicated account manager (CSM): no.
• Founder on-call standby for critical P1 incidents: no.
• Formal monthly review with strategic discussion: summary reporting only.
• Scheduled quarterly on-site visit: no, visits on request.

5. Managed €80: the Premium Human positioning

The Managed package is not a stack of extra ticks on top of Business. It is an explicit positioning: Premium Human. Where other MSPs promise round SLA numbers nobody can actually hold, KA IT commits to an explicit, measurable and concrete human framework.

What concretely changes with Managed

• Dedicated account manager (CSM). A single person who knows your infrastructure, your team, your constraints. Not a ticket in a shared queue.
• Founder on-call standby for critical P1 incidents. For incidents blocking the business (server failure, suspected cyber incident, ransomware), Abdelhak Kharraz personally commits to availability and mobilisation. This is a direct human commitment, not a contractually quantified SLA.
• Formal monthly review. A one-hour review per month with your account manager: incidents, metrics, recommendations, roadmap. You know where you stand and where you're heading.
• Scheduled quarterly on-site visit. Four visits per year in your calendar from the start. Visual audit, team discussion, project anticipation.
• 24/7 conversational AI as assistance. An intelligent assistant embedded in the customer portal answers first-level questions outside business hours. It is an amplifier, never a human replacement: for a serious incident, a human stays mobilised.

Typical profile

• SMEs with 25 to 60 users.
• Regulated sector (health, finance, legal, fiduciary) or high IT criticality.
• Requirement for single point of contact and formal reviews.
• Multiple sites or organisation in growth.
• NIS2 compliance expected with governance support.

What Managed is not

For the sake of transparency and to avoid hollow promises:

• Not a 24/7 human service. The founder on-call P1 is serious but it is not a rotating team. If you need humans in 24/7 rotation, that will be a dedicated setup outside the package.
• No guaranteed 1-hour SLA. No serious Belgian MSP can hold that number without massive exclusion clauses. KA IT prefers committing to real behaviour over writing a marketing figure.
• Not a certified delegated CISO service. We support cyber governance, we do not substitute for an in-house CISO or a senior governance consultant.
• Not an unlimited ticket count in all scenarios. The scope covers the SME and its declared users. Activity peaks outside scope (projects, major organisational changes) are priced separately.

6. Package evolutions and transitions

The three packages are designed to evolve with you. No penalty, no lock-in.

• Upgrade: effective at the start of the following month or immediately with pro rata. The new building blocks (EDR, MFA, backup, on-call) are activated within a few days.
• Downgrade: effective at the start of the following month. Services engaged during the current month are completed.
• Full termination: monthly cancellation with reasonable notice to correctly transfer files and access. No contractual penalty.

7. What's not included in any package (transparency)

No package covers everything. Here is what is systematically priced separately, for budget honesty.

• Microsoft 365 and Google Workspace licences. Billed at cost, with no hidden margin. You can also buy directly from Microsoft or Google.
• Hardware (PCs, servers, switches, firewalls, screens). Separate sale — Lenovo 360 Authorized Partner and Dell Technologies Authorized Partner, with HP hardware expertise. No obligation to buy through KA IT.
• One-off projects. M365 migration, network overhaul, initial EDR rollout, NIS2 documentation audit, digital signage rollout. Project fee priced after scoping.
• Out-of-hours emergencies (outside Managed P1 on-call). Increased hourly rate clarified in the service agreement.
• Managed VoIP telephony. Available as add-on, not in standard packages.
• Digital signage for retail. Dedicated package at €29 VAT excl. / screen / month (installation, configuration, remote content management).

8. 6 questions to decide

1. How many active IT users today? Not in 3 years, today.
2. What is the business impact of a 4-hour IT stoppage? Annoying / expensive / unacceptable.
3. Are you subject to NIS2? See our dedicated NIS2 checklist.
4. Do you have customers or partners imposing cyber requirements? Banks, insurers, contractors, public funds.
5. Do you need a single point of contact for IT matters? For the roadmap, annual budget, technical trade-offs.
6. What is your team's current cyber maturity? Weak (Essential), medium (Business), structured to strengthen (Managed).

9. Frequently asked questions

What is the difference between Essential, Business and Managed?

Essential (€25) = baseline IT support and antivirus. Business (€50) = + advanced cybersecurity (EDR, MFA, M365 backup, monitoring, managed firewall, phishing training). Managed (€80) = Premium Human: Business + dedicated account manager (CSM), founder on-call P1, formal monthly review, quarterly on-site visit, conversational AI 24/7 as assistance.

Which KA IT package for an SME with 15 workstations?

Business €50 is the sweet spot for 10-30 workstations. Full cyber coverage, NIS2 alignment, controlled budget: €750 VAT excl. per month for 15 users (€9,000 VAT excl. per year).

Is there a minimum commitment?

No. Without fixed-term commitment across the three packages. Monthly cancellation, no penalty. Retention comes from service quality, not from the contract.

Can you change package mid-contract?

Yes, at the start of the following month without penalty. An upgrade can happen immediately with pro rata.

What is the founder on-call P1 in the Managed package?

Personal on-call standby from founder Abdelhak Kharraz for critical incidents blocking the business (P1): server failure, suspected cyber incident, ransomware. Direct human commitment on mobilisation, not an SLA in hours.

Are Microsoft 365 licences included?

No. Billed at cost or purchased directly by the customer. No hidden margin.