Who Actually Patches the Kernel? Cutting Through the Managed Hosting Sales Pitch

Every hosting vendor in the American market wants the word "managed" on their pricing page. It commands a premium of two to five times over unmanaged equivalents, and it implies something specific: that a team of professionals is operating your infrastructure so you don't have to.

What it actually means varies so wildly that the term has become nearly useless without interrogation. Some managed offerings include proactive kernel patching, application-level monitoring, and a named engineer who knows your stack. Others include automated OS updates and a ticket queue with a 24-hour first-response target — which, functionally, is self-managed hosting with a monthly fee and better marketing.

The distinction matters most at renewal time, when you're deciding whether that $400-versus-$95 monthly gap is buying genuine operational capacity or an adjective.

Five Questions That Separate Management From Marketing

Ask these during the sales process, in writing, and evaluate the specificity of the answers.

1. Who applies security patches, and on what timeline? A genuine managed provider can state a patch SLA: critical kernel vulnerabilities mitigated within 24 to 72 hours, with testing and rollback procedures. A marketing-driven "managed" host will say patches are "automated" — which may mean unattended-upgrades applying everything, including breaking changes, at 3 a.m. with no one watching.

2. Who owns the monitoring stack, and who responds at 2 a.m.? Real management includes alerting on your application, not just the server's heartbeat. Ask: do you monitor disk I/O, queue depth, and error rates, or only whether the machine pings? And critically — is there a human on call, or does the "24/7 monitoring" consist of an automated email to you?

3. What is included in backups, and has restoration been tested? Nearly every host advertises backups. Far fewer guarantee tested restores, defined retention windows, and point-in-time recovery. An untested backup is a hope, not a service.

4. Where does the responsibility line fall? The classic managed-hosting ambiguity is the application layer. If your WordPress plugin is exploited, is remediation included, or does the provider's duty end at "the server was fine"? Get the demarcation in writing — the shared-responsibility model varies more in hosting than it does in cloud.

**5. What is the actual support contract?" Managed" should mean a defined response time, an escalation path, and access to engineers rather than a tier-one script. Ask for the median first-response time and the percentage of tickets resolved without customer intervention. Vague answers here are the most reliable signal of a self-managed product in a suit.

A Simple Rubric for the Renewal Decision

Score the incumbent provider one point for each of the following: patch SLA in writing, human on-call response, tested restores, documented application-layer responsibility, and engineer-level support access.

• 4–5 points: The premium is likely justified. Your internal team is being leveraged against genuine operational capacity.
• 2–3 points: You're buying partial management. Determine which gaps your team can cover cheaply and renegotiate accordingly — or reconsider whether unmanaged infrastructure plus a part-time contractor serves you better.
• 0–1 points: You are your own sysadmin, paying for the privilege. Either demand the services you're being charged for or move.

The Underlying Principle

Managed hosting is not a scam. Genuine providers deliver real value — particularly for lean US mid-market teams that cannot staff a 24/7 operations function. The problem is undifferentiated labeling: the industry's best marketers and its best operators use the same vocabulary.

The remedy is contractual specificity. Management is not a feature listed on a pricing tier; it is a set of answerable questions. Ask them before you renew, not after the patch that never came.