Security Insourcing vs Outsourcing: Build or Buy

Most security functions end up partly outsourced, but the decision is often made one contract at a time, driven by a hiring freeze or a renewal date rather than by a view of which capabilities the organisation must own. This guide gives a repeatable way to decide, capability by capability, whether to build a function in house, buy a managed service, or run a hybrid. It covers the decision criteria (business context, scale, talent, cost, control and exit), a worked cost model, what must stay internal whatever you buy, and the regulatory expectations that apply to outsourcing critical functions. It is written for CISOs, security architects and finance or procurement partners. Once a capability is marked for a provider, the MDR vs MSSP comparison and the Managed Security Service Provider Buyers Guide take over; for the shape of the security function itself, see the Security Operating Model and Organisation Design Guide.

Key takeaways

Decide per capability, not per function. "Outsource the SOC" hides a dozen separate choices: log platform, detection content, triage, threat intelligence, incident response and forensics each score differently.
Accountability never transfers. CISA and DORA Article 28(1)(a) say the same thing in different words: the customer remains responsible for risk and compliance, so every outsourced capability needs a named internal owner.
Context-heavy work favours in house. The NCSC notes that in-house teams bring business context to investigations, while outsourced intelligence and response can be generic or delayed; score each capability on how much it depends on knowing your environment.
Compare full costs, not salaries against a quote. Round-the-clock cover needs roughly five people per seat once leave and training are counted, while a managed service carries hidden internal costs for onboarding, integration, vendor management and a retained team.
Write the exit before you sign. Data, detection content, logs and access must be recoverable; for regulated financial entities, documented and tested exit plans are a legal requirement for critical or important functions.

The sourcing options

There are more than two answers. The table sets out the main models in order of how much the organisation does itself.

Model	What you run	What the provider runs	Typical fit
Fully in house	People, process, tooling and out-of-hours cover	Nothing beyond product support	Large organisations, unusual environments, high regulatory or sovereignty demands
In house with tooling bought as a service	Analysis, decisions and response	Platform hosting and maintenance (SaaS SIEM, EDR console)	Teams with analysts but no appetite to run infrastructure
Staff augmentation or contractors	Direction, process and accountability	Named people working under your management	Skills gaps, projects, temporary peaks
Co-managed (hybrid)	Business-hours analysis, escalations, response decisions, content tuning	Out-of-hours monitoring, first-line triage, platform care	Mid-size organisations that want context in house and 24x7 cover bought
Fully managed service	Service ownership, risk acceptance, response authorisation	Monitoring, detection, triage, often containment actions	Small and mid-size organisations, or capabilities used rarely
On-call retainer	Everything day to day	Specialist help when triggered (incident response, forensics)	Low-frequency, high-skill work for almost everyone

See the Co-Managed SOC and SOC-as-a-Service Guide for the hybrid operating detail and the Incident Response Retainer Buyer's Guide for retainers.

Decision criteria: scoring each capability

Score each candidate capability from 1 (favours outsourcing) to 5 (favours in house) on the six criteria below, then weight them for your context. The score is a conversation starter for the leadership team, not an answer machine; its value is that every capability is judged on the same terms.

Criterion	Scores towards in house when	Scores towards outsourcing when
Business context	Good decisions need deep knowledge of your systems, people and risk appetite (investigations, architecture, identity governance)	The work is the same for every customer (malware analysis, generic threat feeds, platform patching)
Frequency and scale	Work is continuous and volume is high enough to keep a team busy and skilled	Work is rare or spiky (major incident response, forensics, red teaming)
Talent availability	You can hire and retain the skills in your market and pay band	Skills are scarce, specialised or hard to keep current
Speed to capability	You can tolerate a long build (months to over a year for a 24x7 function)	You need coverage now, for a regulatory date, insurer demand or after an incident
Control and data sensitivity	Data residency, classified data or the need to act instantly on your own judgement	The provider can work within your access and data rules without exceptions
Strategic differentiation	Security is part of the product or a competitive promise to customers	The capability is hygiene that customers and regulators expect but do not judge you on

The NCSC's guidance on designing a SOC operating model makes the same point from the operations side: most SOCs outsource something, even if only detection signatures, and outsourcing makes most sense for functions used seldom or where the team lacks resources to build them. Its examples are useful anchors: threat intelligence bought in gives a wide view but can lack business context, and outsourced incident response is available on demand but can be delayed and lack context.

How common capabilities usually score

Capability	Usual answer	Reason
Security strategy, risk acceptance, policy	In house (may be supported by a vCISO)	Decisions belong to the organisation; see the vCISO Guide
Identity governance and privileged access design	In house	Tightly coupled to HR, applications and business owners
24x7 monitoring and first-line triage	Outsourced or co-managed	Shift cover cost and retention are hard below large scale
Detection engineering for your environment	Hybrid, with internal ownership of priorities	Provider content covers common threats; your crown jewels need custom logic
Major incident response and forensics	Retainer plus internal lead	Rare, specialist and time critical
Vulnerability scanning operations	Either	Running scans is commodity; prioritisation and remediation are internal
Penetration testing and red teaming	Outsourced (independence is often expected)	Fresh eyes, specialist skills, periodic demand
Awareness and phishing simulation	Platform bought, programme owned	Content is generic; culture and follow-up are local

Building the cost model

A fair comparison sets the fully loaded internal cost against the provider fee plus the internal cost that remains after outsourcing. The common error is comparing analyst salaries with a quote.

Internal build costs

People: salary plus on-costs (employer taxes, pension, benefits), recruitment fees, training and certification, and attrition replacement. Price a realistic vacancy period; see the Cybersecurity Skills Gap and Hiring Guide.
Shift arithmetic: a week has 168 hours. One full-time employee works about 37 to 40 hours a week before leave, sickness and training, so keeping one seat filled around the clock takes roughly five people, and two seats (to avoid a single analyst alone at night) about ten. Add team leads and an engineer to maintain content.
Tooling: SIEM or data lake ingestion and retention, SOAR, EDR, case management, threat intelligence feeds, sandboxing, and the engineering time to run them.
Management overhead: leadership, quality assurance, process documentation, metrics and audits.

Outsourced costs

Fees: per endpoint, per user, per data volume or per log source; check overage terms and how growth is priced.
Retained internal team: service owner, escalation responders, detection priority setting and remediation. This is rarely below one person even for small customers.
Onboarding and integration: log source connection, playbook agreement, access set-up and testing, typically weeks to months of internal effort.
Vendor management: contract reviews, performance reporting, audits and assurance evidence.
Exit cost: data export, re-platforming and a parallel-run period at the end of the term.

Cost line	In house	Managed service	Hybrid
Analyst headcount	Full shift team	Small retained team	Business-hours team
Tooling and data	Full cost	Often bundled; check data ownership and retention	Split by contract
Time to operate	Long build	Shortest	Medium
Cost scaling	Step changes as shifts are added	Linear with units priced	Mixed
Exit and switching cost	Low (you own it)	Highest; plan for it	Medium
Knowledge retained	High	Low unless contracted for	Medium to high

Model three to five years, not one: provider prices often rise at renewal, while internal teams take a year or more to reach steady performance. Run a sensitivity check on the two inputs that move most, attrition and data volume growth. Feed the result into the Security Budget and Investment Planning Guide process.

What stays in house whatever you buy

CISA's risk considerations for managed service customers are explicit that outsourcing does not transfer risk management responsibility, and the NCSC's guidance on choosing a managed service provider asks for a responsibility matrix that sets out what remains with the customer. In practice, these stay internal:

Service ownership: a named person accountable for each outsourced capability, its metrics and its contract.
Risk acceptance and response authority: who may approve isolating a production server or disabling an executive's account, and in what time.
Asset and identity knowledge: the inventory, crown jewels list and business context the provider needs; keeping it current is your job.
Independent evidence: CISA advises customers to keep their own logs and offsite backups, separate from the provider's storage, and to have direct access to security logs and monitoring data.
Provider access governance: least privilege for the provider's accounts, MFA, removal of access when work ends, and monitoring of provider activity. Provider accounts are privileged identities; see the Compromised MSP Playbook for the scenario to plan against.
Remediation: the provider can find and contain, but patching, reconfiguring and rebuilding are usually done by your teams.

Control, regulation and exit

Regulated sectors add requirements on top of good practice. For EU financial entities, the Digital Operational Resilience Act (Regulation (EU) 2022/2554) sets the clearest benchmark, and it is a useful template for any organisation:

DORA provision	Requirement	Good practice for everyone
Article 28(1)(a)	Financial entities remain fully responsible for compliance when using ICT third-party services	Named internal owner and board visibility for outsourced security services
Article 28(3)	Register of all ICT contractual arrangements, distinguishing those supporting critical or important functions	Keep a register of security services, data held and access granted
Article 28(4)	Pre-contract assessment: criticality, risks including concentration risk, due diligence, conflicts of interest	Run the scoring in this guide and a risk assessment before tender
Article 28(7)	Contracts must be terminable for significant breaches, material changes, or evidenced weaknesses in the provider's ICT risk management	Termination triggers tied to security performance, not only price
Article 28(8)	Documented, sufficiently tested exit plans with alternative solutions and transition plans to another provider or in house	Exit plan written and rehearsed before go-live
Article 30(3)(f)	Exit strategies with a mandatory adequate transition period for critical or important functions	Contracted transition support so monitoring never goes dark

See the DORA Article 30 Contract Provisions Guide for the full contract list.

Making exit real

Own the data: logs, cases, investigation notes and reports are yours, exportable in documented formats, with retention you set.
Own the content: custom detections, playbooks and tuning built for you are either your property or exported on exit.
Own the platform where you can: running the provider inside your tenant or SIEM makes switching a people change rather than a data migration.
Contract the transition: notice periods, a parallel-run window and continued service during transition.
Revoke cleanly: the NCSC guidance includes clauses for removing obsolete accounts and infrastructure; script and test the revocation of every provider account, key and agent.

Concentration matters too. If several capabilities, or several of your key suppliers, depend on one provider, its failure becomes yours; see the Cloud Concentration Risk and Exit Strategy Guide.

Running the decision: a phased approach

List capabilities: break each function into the capabilities in the tables above and record current state, cost and pain points.
Score and weight: score each capability on the six criteria with security, finance, procurement, legal and a business representative in the room; CISA recommends a cross-functional group for this decision.
Model costs: build the three to five year comparison for the top candidates, including retained team and exit costs.
Check constraints: regulation, data residency, insurer requirements and existing contracts.
Decide and document: record the decision, rationale and the review trigger for each capability.
Pilot before committing: run a time-boxed proof of value or a limited-scope contract, with success criteria agreed up front. Use the Managed Security Services RFP Template for the tender.
Review on a cycle: revisit each decision at contract renewal, after major incidents and when the organisation changes size or regulatory scope.

Rolling back is part of the plan. Insourcing a previously outsourced capability needs the same exit discipline in reverse: hire and train before the notice period starts, run in parallel, and only then terminate.

Decision guidance by organisation size

Small organisations (no dedicated security team): outsource monitoring and most operations; keep a named owner, the asset list, admin account control and your own backups. The NCSC guidance aimed at smaller customers lists checks such as 2SV for provider access, least privilege and tested off-site backups.
Mid-size organisations (small security team): a co-managed model is the usual fit: buy 24x7 triage, keep detection priorities, escalation and response decisions in house, and use retainers for major incidents.
Large organisations: insource the capabilities that depend on context and scale, such as detection engineering, identity security and incident command, and buy specialist or surge capacity. Re-test the decision when mergers or new regions change the picture.
Highly regulated or sovereign environments: data location, personnel vetting and supervisory access rights may rule out some providers or force an in-house core regardless of cost.

Measuring whether the choice works

Outcome metrics, not activity: mean time to detect and to contain for confirmed incidents, against the targets set in the decision record.
Escalation quality: percentage of provider escalations that were actionable, and false positives returned to the provider for tuning.
Coverage: share of critical assets and log sources onboarded and alerting as designed, checked by periodic detection tests.
Total cost per capability: actual against modelled cost, including the retained team.
Exit readiness: date of the last exit rehearsal or data export test.
Knowledge retention: internal staff able to run the capability for a week without the provider.

See the Security Metrics and KPIs Programme Guide for metric design.

Framework mapping

Decision area	NIST CSF 2.0	NIST SP 800-53 Rev 5
Risk response options, including transfer and sharing	GV.RM-04	PM-9
Security requirements in contracts	GV.SC-05	SA-4, SA-9
Supplier assessment before and during the contract	GV.SC-06, GV.SC-07	SR-6
Monitoring provider activity	DE.CM-06	SA-9, PS-7
Exit and post-contract provisions	GV.SC-10	SA-9
Workforce planning for retained and insourced roles	GV.RR-04	PM-13
Coordination with providers for contingency	GV.SC-08	CP-2(7)

Common failure patterns

Outsourcing a problem you have not defined: a provider cannot tune detections for assets you have not inventoried or risks you have not prioritised.
No retained team: escalations arrive at 3am to a mailbox nobody watches, or to staff without authority to act.
Salary versus quote comparisons: ignoring retained staff, onboarding and exit makes outsourcing look cheaper and insourcing look faster than either is.
Data held hostage: logs and detections live only in the provider's platform, so switching means starting again.
Provider access left wide open: standing administrator rights for provider staff without MFA or monitoring turn the provider into the easiest route in.
Decisions never revisited: a choice made at 200 staff still applies at 2,000, or a hybrid model drifts into full dependency without anyone deciding it.

Practitioner checklist

Break each security function into capabilities and score each on context, frequency, talent, speed, control and differentiation.
Build a three to five year cost model that includes the retained team, onboarding, vendor management and exit.
Name an internal owner with response authority for every outsourced capability.
Keep your own logs, backups and asset inventory independent of any provider.
Govern provider accounts as privileged identities: least privilege, MFA, monitoring and clean revocation.
Contract data and content ownership, termination triggers and a transition period.
Write and rehearse the exit plan before go-live.
Pilot with agreed success criteria before a long commitment.
Measure outcomes and review each decision at renewal or when the organisation changes.

Security Insourcing vs Outsourcing Guide: Decide What to Build, Buy or Hand to a Provider