Managed vs unmanaged VPS: what's included, and the hidden cost of DIY

Managed vs unmanaged VPS comes down to who does the ongoing work of keeping the server secure and running, not the hardware itself. Unmanaged means you get root access and are responsible for everything from there; managed means a provider or partner takes on some or all of that work — patching, monitoring, backups and incident response — for a recurring fee. Neither is automatically the right answer. This post lays out exactly who does what under each model, and a simple way to work out whether your own time is actually cheaper than paying for management. For the broader picture of server types, start with the pillar guide, cloud servers explained.

Managed vs unmanaged VPS: who does what#

That last row matters: a managed server is not the same thing as a managed application. Patching the operating system and watching disk space is a different job from fixing a bug in your app's checkout flow. Confirm which side of that line any "managed" offer actually covers.

"Managed" is a range, not one thing#

Management typically comes in levels rather than a single package. As a rough pattern, worth checking against any provider's fine print:

• A basic level usually covers initial setup, hardening, firewall configuration, backups being configured, uptime monitoring, and support during business hours. It's a solid floor, but response outside business hours and backup restore testing are often not included at this level.
• A fuller level typically adds round-the-clock patching and monitoring with an actual response (not just an alert nobody reads outside hours), off-server backups with restore tests, some tuning of the stack, and a monthly report you can actually use.
• The most complete level adds a named engineer, CI/CD and staging environments, zero-downtime release practices, periodic cost and performance reviews, written runbooks, and disaster-recovery drills — closer to an ongoing DevOps relationship than a one-off setup.

Providers structure these differently and use different names for them, so always ask exactly what's included at each level before comparing a "managed" quote to an unmanaged server's raw price — see current plans and prices for how these tiers are structured.

What to ask before you buy "managed"#

A handful of direct questions separate genuine management from a label on an invoice:

• Exactly which patches are applied, and on what schedule — is it "when someone gets to it" or a defined timeframe?
• Is monitoring 24×7, or only checked during business hours?
• Are backup restores actually tested, and how often — or does "backed up" just mean a job ran without erroring?
• Is there a written response-time commitment, or an informal "we'll get to it"?
• Does the service cover your application code, or only the server and operating system underneath it?

If a provider can't answer these clearly, that's useful information on its own.

The hidden cost of DIY#

The invoice for an unmanaged VPS is smaller. The total cost usually isn't, because the work doesn't disappear — it moves onto somebody's plate, unpaid in any explicit line item. That matters because delayed patching is a real, measurable risk: the Australian Signals Directorate's Essential Eight patching guidance recommends patching internet-facing services within 48 hours once a working exploit exists for a vulnerability, and within two weeks otherwise, on the basis that attackers commonly weaponise a public vulnerability within days. An unmanaged server only gets patched that fast if someone is actually watching for the advisory and has the time free that week.

A simple way to cost your own time#

You don't need precise numbers to make this comparison useful — a rough estimate is usually enough to see which side of the line you're on.

1. Estimate hours per month. Add up time spent on: checking for and applying OS/security updates, reviewing monitoring or logs, configuring and checking backups, and any time lost to an actual incident (outage, hack attempt, failed update). Be honest about incidents — they're rare per server, but the hours they cost are large when they happen.
2. Work out your real hourly cost. Use the fully loaded cost of whoever does this work — salary or contractor rate converted to an hourly figure — not just the sticker rate, since it should reflect what that hour actually costs the business.
3. Multiply hours by cost. That's your monthly DIY cost, before counting what that person would otherwise have built, or the cost of a mistake made while rushing a fix outside office hours.

As a purely illustrative example: if server administration takes a developer around five hours in an average month, and their fully loaded cost is A$60 an hour, that's roughly A$300 of time — before factoring in what else those five hours could have produced, or a bad month where an incident takes a full day. Compare that figure, worked out for your own team, against current plans and prices for a managed tier that covers the same work.

This calculation tends to tip further towards "managed" the smaller your team is, because a five-person team rarely has anyone whose job is specifically server administration — it's borrowed time from someone hired to do something else.

It also tends to hide in "quiet" months and show up all at once in a bad one. A month with no incidents might only cost an hour or two of patching and monitoring checks. A month with a break-in attempt, a failed update that takes the site down, or a scramble to restore a backup that turns out not to work can cost a full day or more of someone's time, plus whatever the outage itself costs the business. Averaged over a year, those bad months are usually what make DIY administration more expensive than it looked in the quiet ones — which is also why "we haven't had a problem yet" is a weak reason to keep doing it yourself.

Signs you've outgrown unmanaged#

• A security patch has been delayed because nobody had an hour free that week.
• Nobody can say when the last backup restore was actually tested, only that backups "run."
• Monitoring means "a customer told us the site was down."
• One person understands the server setup, and things stall when they're unavailable.
• Server administration is competing for the same hours as product work, every month, not just occasionally.

None of these are emergencies on their own. Together, they're a reasonable trigger to compare the real cost of your own time against a managed fee using the method above, or to at least start with the fundamentals in our Linux server hardening checklist if you're staying unmanaged for now.

What to do next#

If the responsibility table above shows more in your own column than you have time for, managed application hosting and current plans and prices set out what each level of management includes. If you're weighing this alongside a bigger DevOps question — CI/CD, staging environments, incident response — managed DevOps covers the fuller version of "someone else runs this properly."