Is there a missing tier of Web hosting?

There are a lot of old Web sites out there these days. Plenty of organizations have had a presence on the Web for upwards of ten years, and like it or not, their Web sites are showing their age. It seems like I run into more and more groups who have old, crufty Web sites running many applications written in a variety of languages. What I’m wondering is what the best option is for these organizations is in terms of Web hosting?

If they are just running static HTML and maybe some PHP or CGI applications, then shared hosting is perfect. They just need a place to upload files and perhaps Web-based database administration. Shared hosting is cheap, and it’s up to the hosting provider to make sure the servers aren’t running a some Russian mafia member’s IRC server to control a zombie army.

Organizations with enough invested in the Web to have their own systems administrators are in OK shape, as well. They can go with managed hosting, or colocation, or even just buy some connectivity and run the servers out of their office. Their budget is large enough to pay somebody to make sure their Web sites work, so they’re really beyond the scope of what I’m talking about.

I’m talking about those people in the middle. Maybe they have a relatively low traffic Web site that has some old CGI scripts, a Java Web application, and a ColdFusion application or two. Their setup is too complicated for shared hosting, but they don’t have the staff or the budget to take on managing their own Web servers. What’s the best option for them right now? Do they need to subscribe to managed Web hosting and then outsource their system administration to an outfit like Pythian?

It seems like what I see most often for these groups is that they have their own server running out of date hardware and infrequently patched software, being tended by the person in the office who’s in charge of making sure that people can get email and that their antivirus software is up to date. Usually these servers are down a lot and are sitting ducks for whatever malware happens to cross their paths. Surely there must be a better way.

Feedback much appreciated.