Our Helpdesk Closes at 5:30 and We Trade Until 9. What Are the Actual Options?

There are four real options: a wider band of contracted hours, a paid on-call arrangement, a desk that does not close, or a decision to carry the gap and plan around it. The published end of the market gives you a number to anchor on. inSUPPORT lists a Retail support tier at $100 per user per month, reaching Thursday and Friday to 9:00pm and Saturday morning. The office week is $68. Both are support rates, and insurance, backup and education are quoted separately.

If you have asked around, you have probably had the same conversation three times. The hours on offer were the office week. The answer to the follow-up was a promise of flexibility, and none of it came back in writing. Nobody answers this properly until it is put to them as named options.

None of the four is better in the abstract. They differ on whether the cost is fixed or contingent, on who decides at seven in the evening, and on how gracefully each fails. Which fits depends on two things you already know. Your uncovered hours, and who is rostered in them.

Each one below is weighed on its cost, on what happens when you ring at seven on a Thursday, on how it fails, and on what you could write in an incident response plan afterwards. The Retail tier is the worked case, because its hours and price sit on a page you can check.

TL;DR: the four options and what each one really costs

• ✅ Four options, one comparison. A wider contracted band, paid on-call, a desk that does not close, or a gap you carry on purpose. Most things sold as after-hours IT support are one of those four under a different name.
• ✅ Price the fixed ones per user per month. The published support rates are $68 for the office week, $100 for a Retail band reaching Thursday and Friday to 9:00pm and Saturday morning, and $135 for round the clock. Support component only. Insurance, backup and education are quoted as their own line items.
• ✅ On-call looks cheapest because its cost is contingent. Ask whether you are buying monitoring, a queue worked the next morning, or a person who will log in tonight. All three get called after-hours support.
• ✅ Whichever you pick, the Australian Signals Directorate's incident response plan template wants a name, a role and an availability against every contact, over a 24/7 period. Cannot fill that column in? Then you have not chosen yet.
• ✅ Trading nine to five? None of this is for you. The honest answer is the cheapest band and the hours you already have.

Contents

• Option One: A Wider Band of Contracted Hours
• Option Two: On-Call, Paid When You Use It
• Option Three: A Desk That Does Not Close
• Option Four: Carry the Gap On Purpose
• Putting the Four Side by Side
• The questions that come up once you start asking

Option One: A Wider Band of Contracted Hours

Start here, because it has the fewest moving parts. A band is one clause: the days and hours your provider is contracted to answer. inSUPPORT publishes three of them on its IT support pricing page. The Retail band runs Monday to Friday 8:30am to 5:30pm, with Thursday and Friday through to 9:00pm and Saturday 8:30am to noon, at $100 per user per month for the support component. That tier exists because the company came out of retail IT: its parent is Retail Innovation Group Australasia. The Business band is the office week, at $68. The gap between those two rates is the whole decision, and it is a fixed monthly number you can forecast.

At seven on a Thursday the call lands inside cover. Of the four options, this is the only one where the point is that simple. What a band does not tell you is what the call reaches. Ask what the person answering at 7:30pm is authorised to change. Then get the answer into the agreement rather than the sales conversation. An hours clause is enforceable. A verbal promise of flexibility is not.

Where a band breaks is obvious, and worth naming before you sign. It ends. The published Retail window stops at noon on Saturday and does not run on Sunday at all. A venue doing Sunday lunch would be buying cover it cannot use in the hour it most needs one. So read any band against your own worst hour, not your busiest week. If the two do not meet, a wider band is not your answer.

For the incident plan, this is the easiest of the four to write up. The hours are a clause. The contact is a company rather than a person. The availability you record against it is the band you are already paying for. You can put that sentence in front of a board without qualifying it.

• Find the hours clause in your current agreement and write it out in full, including the days that run differently from the rest.
• Ask what the person answering at 7:30pm on a Thursday is authorised to change on their own, and have that written into the agreement.
• Check the hour after the band closes. A fault at 8:55pm and a fault at 9:05pm are the same fault at two different prices.

Option Two: On-Call, Paid When You Use It

On-call looks cheapest, because nothing leaves the account in a quiet month. The same fact makes it the hardest of the four to compare. The cost only shows up in the months you needed it. A contingent rate suits a business whose after-hours trouble is genuinely rare. It suits a weekly problem badly. A Thursday night trading pattern is a weekly problem.

The part worth slowing down on is what you are buying. After-hours IT support can describe at least three different arrangements. One is monitoring: something watches the environment overnight and raises an alert. The second is an out-of-hours queue you can write to at any time, worked when the desk opens. The third is a person who will log in tonight and change something. Only the third gets your tills back before close. All three can appear in a quote under the same words.

On-call fails more quietly than the others, and the failure costs more than the rate does. When ringing has a price attached, ringing becomes a decision. The person making that decision is on the floor at seven with a queue at the counter. A terminal that will not connect gets logged as something that can wait, because waiting is cheaper than calling. So the one thing a rate card quietly prices out is somebody having a look. That is the night you needed one.

There is a document that exposes the rest of it. The Australian Signals Directorate's incident response plan template asks for primary and secondary internal points of contact over a 24/7 period. An availability is recorded against each. So is the availability of any third party that manages your systems. An on-call arrangement with one mobile number and no named secondary leaves that field blank, and a blank field is the answer to the question you were asking.

• Ask which of the three arrangements the quote actually covers, and have it named in writing rather than described.
• Get a response commitment alongside the rate. A price with no time attached is not cover.
• Name a secondary contact, and record what each contact is available to do rather than only when they answer.

Option Three: A Desk That Does Not Close

Buying round-the-clock cover removes the hours question entirely, which is worth something on its own. inSUPPORT prices it as the Complete tier at $135 per user per month for the support component, and its pricing page describes that as round the clock, follow the sun support, 24 hours a day and 7 days a week. Seven in the evening sits inside cover. So does three in the morning on a Sunday.

The cost shape is the trade. You buy the hours for every user on the list, including people who have never once worked past five. Where the risk sits on a shift roster rather than across the whole payroll, that is real money spent on hours nobody uses. So divide the monthly figure by the people genuinely on shift in the uncovered windows. Not by headcount. Done that way, the comparison against a narrower band becomes a number rather than an argument.

The weak point here is subtler. Answering around the clock is not the same as deciding around the clock. ASD's template asks for escalation and de-escalation triggers, with a minimum level of authority recorded against each. It also notes that smaller incidents can be managed without activating the full response team. Those two lines are the question to put to any always-open desk. What can the overnight contact change on their own, and where is the line they are not allowed to cross?

Get that answer and the plan writes itself, because you can record an authority against an availability instead of a phone number. Miss it and you have bought a desk that can see everything at three in the morning and decide nothing. That is not cover. That is a witness.

• Ask what the overnight contact is authorised to change without waking somebody senior.
• Ask for the escalation thresholds in writing, and for who holds the authority at each level.
• Divide the monthly cost by the people who actually work the uncovered hours before you compare it with a narrower band.

Option Four: Carry the Gap On Purpose

Carrying the gap is a legitimate answer. It is the only one of the four with no monthly invoice. It is also the easiest to end up with without ever choosing it. Choosing it honestly means writing something down, and ASD is direct about where the duty sits. Managing responses to cyber security incidents is the responsibility of the affected organisation, and every organisation should have an incident response plan that is tested and reviewed.

That plan does not need to be long. It needs the two or three systems that stop your revenue rather than merely stop work. It needs the primary and secondary contacts over a 24/7 period, with the availability recorded against each. And it needs the trigger that says this one cannot wait until Monday. Written down, a gap is a known exposure somebody has signed off. Unwritten, it is a Saturday nobody has thought about.

It also needs a way in that does not depend on one person's phone. Microsoft's guidance for Microsoft Entra ID is to keep at least two emergency access accounts. Those accounts are excluded from the conditional access policies that would otherwise block the sign-in during the exact emergency they exist for. Their activity is monitored, and the credentials are validated at least every 90 days. A documented plan with no working administrator account fails at the first step. It fails at the worst hour.

And the national line is open while yours is not. ASD runs the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), 24 hours a day and 7 days a week. Its advice is to report a potential incident as soon as possible, even if you think it may be a false alarm. In 2024 to 2025 that line answered more than 42,500 calls, an average of 116 a day. It is technical advice at eight o'clock on a Saturday. It is not somebody who can sign in and fix your point of sale. The plan has to name who that is.

A chosen gap still does not get to choose when it is tested. In the same year ASD notified entities more than 1,700 times about potentially malicious cyber activity, an 83 per cent increase on the year before. So the first you hear of something can be a call from outside, on a day you did not pick. Put a review date on the plan and keep it. The alternative is reviewing it the morning after the night that proved it wrong.

• Have whoever carries the risk sign off the uncovered window in writing, not in a corridor.
• Fill in the availability column against every contact, including the third parties who manage your systems.
• Test the way in once a quarter, while nothing is broken and nobody is waiting.

Putting the Four Side by Side

The comparison comes down to one question asked four ways. You can run it in an afternoon with documents you already hold. Which hours do you trade uncovered? Who is rostered in them? Which of the systems running in those hours carry money rather than merely carry work? And what would you defend to a board if one of them failed at the worst possible moment? Answer those and two of the four drop out on their own.

The arithmetic is already done and does not need repeating. The companion piece on what an outage costs under three support models walks the wage cost of an uncovered hour, and the monthly difference between two published tiers. Take that page into the meeting. This one is about the choice arithmetic cannot make for you: the trade between a fixed cost, a contingent one, and a risk you decide to keep.

Three honest shortcuts, because most businesses do not need the long version. If you trade nine to five, buy the cheapest band. Extended hours are money spent on an hour you do not use. If your after-hours trouble is genuinely once a year, on-call is the right shape, and what you negotiate is the response rather than the rate. And if your revenue arrives in the evening every week, a contracted band is the only one of the four that prices that pattern honestly.

One thing before you decide. A covered hour is only worth what the person in it can actually do. Hours are the easy half of this decision. The harder half is what is running inside them, which is the ground the piece on why support hours and trading hours drift apart covers from the other direction. Whoever you are shopping with, it is the question to ask last. It is also the one that changes the answer.

1. Put the hours clause from your agreement and your real trading hours in one table, and mark every window where the two do not meet.
2. Count the people rostered in each uncovered window, and list the systems in those hours that take money.
3. Price the fixed options per user per month against that roster rather than against your whole headcount.
4. Pick one of the four, write down why, and put a review date against the decision.

The questions that come up once you start asking

Which option fits a business that trades Thursday nights and Saturday mornings?

A wider contracted band, almost always. That pattern is weekly and predictable, and a band is the option that prices a predictable pattern honestly. The published Retail tier is the worked example. It is $100 per user per month for the support component, covering Monday to Friday 8:30am to 5:30pm, Thursday and Friday through to 9:00pm, and Saturday 8:30am to noon. Check that window against your own hours before you assume it fits. It closes at midday on Saturday and does not run on Sunday. If your trouble is once a year rather than every week, on-call is the cheaper shape, and what you negotiate then is the response commitment rather than the hourly rate.

Can we handle after hours ourselves instead of paying for cover?

Up to a point, and the point is narrower than it looks. Restarting a terminal or a switch is something a trained duty manager can do. Writing that down is worth doing whichever of the four you choose. What an internal workaround cannot do is tell an ordinary fault apart from the beginning of an incident. Nor can it change an identity or network platform safely at eight in the evening. ASD's own position is that managing a cyber security incident is the responsibility of the affected organisation, and its plan template names who you call rather than assuming somebody will work it out on the night. Know where your own line sits.

How quickly can after-hours IT support actually start working?

Quicker on paper than in practice, because the hours are the last part to switch on. Moving between published tiers with your existing provider is usually a contract variation. Ask when it can take effect, and check the current band for a minimum term. Moving to a new provider takes longer, since the environment has to be documented and brought under control first. With inSUPPORT, onboarding takes control of the Microsoft environment, audits the gaps, and then runs the agreed remediation programme over a period set by what that audit finds. Either way, the arrangement is only live once the contacts, the availability against each of them, and the way in have been written down and tested. Until then it is a quote.

Where should we start if we do not know which of the four we need?

Start with the hours and the roster. Twenty minutes of work narrows four options to one or two. Then look at what is actually running in the uncovered windows. No hours clause answers that part, and it is the part that decides whether the cover is worth buying. A Cyber Strength Audit documents what is configured across identity, patching, backup, email and endpoint. It names the settings that have drifted since anyone last looked, and ranks what it finds by what would hurt the business first. You should finish it knowing which failures would genuinely cost you a Saturday.

Citations

• "How we help during a cyber security incident, Australian Signals Directorate", Gives the Australian Cyber Security Hotline as 1300 CYBER1 (1300 292 371), contactable 24 hours a day and 7 days a week, and advises reporting a potential incident as soon as possible even if you think it may be a false alarm. Last reviewed 23 October 2025. cyber.gov.au
• "Cyber security incident response planning: Practitioner guidance, Australian Signals Directorate", States that managing responses to cyber security incidents is the responsibility of the affected organisation and that all organisations should have an incident response plan that is regularly tested and reviewed. Its template records primary and secondary points of contact over a 24/7 period with an availability against each, the availability of third parties that manage systems or networks, and escalation and de-escalation triggers with a minimum level of authority. Last reviewed 12 December 2024. cyber.gov.au
• "Annual Cyber Threat Report 2024-2025, Australian Signals Directorate", Records more than 42,500 calls answered on the Australian Cyber Security Hotline in FY2024-25, an average of 116 a day and up 16 per cent on the year before, and more than 1,700 notifications to entities about potentially malicious cyber activity, an 83 per cent increase. cyber.gov.au
• "Manage emergency access admin accounts, Microsoft Entra ID, Microsoft Learn", Recommends maintaining at least two emergency access accounts, excluding them from conditional access policies that block or restrict sign-in, monitoring their sign-in and audit activity, and validating the accounts at least every 90 days. Dated 4 June 2026. learn.microsoft.com

Related Reading

• Managed IT Services
• Why Your IT Support Closes When Your Shop Is Busiest
• What an Outage Costs Under Three Support Models
• IT Support Pricing
• Cyber Strength Audit

Content reviewed by Probably Genius for accuracy and relevance.

inSUPPORT provides managed IT and cyber security services. It is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence. Where cyber insurance forms part of a plan, it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment, the policy terms and the Product Disclosure Statement and Target Market Determination. This article is general information about IT and security practice, not financial product advice, and it does not take account of your objectives, financial situation or needs.