Is it more cost-effective to hire an in-house cyber security team, or should you hire or partner with a managed IT services provider? Do you have the resources to ensure protection when cyber attacks can happen at any time, day or night? Are these questions that keep you up at night? Leaving you wondering if an in-house cyber security team or an outsourced managed solution is best for your business?
We’ve helped thousands of customers navigate these kinds of cyber complexities and build robust, cost-effective security strategies that work for their business. As our Key Commercial Account Manager, I have years of experience in guiding businesses towards the right solutions as a trusted advisor in the field of cyber security.
In this article, we’ll provide you with the knowledge and insights you need to make an informed decision between the two approaches: building an in-house cyber security team or using a managed IT services provider. By the end of this article, you’ll have a solid understanding of the pros and cons of each approach, empowering you to choose the cyber security strategy that best protects your organisation and your bottom line.
Decoding Your Options
To make the right call, you’ve got to be clear on what each approach really means:
In-House Cyber Security Team: This is where you hire cyber security professionals directly as employees. Their main job? Protecting your systems and data. Think of it as building your own dedicated security department within your company.
Managed IT Services Provider (MSP): This is where you partner with an external company to handle some or all of your IT and security. A good MSP will put proactive security at the heart of what they do. Consider this your outsourced IT and security team.
The Cost Equation: A Detailed Analysis
Cost is, understandably, a major deciding factor. However, it’s crucial to consider the total cost of each approach, not just the obvious expenses.
| Cost Factor | In-House Cyber Security (on a 24/7 basis) | Managed IT Services |
| Salaries | Salaries for multiple cyber security professionals to cover 24/7 shifts, including benefits, bonuses, etc | Monthly or annual fees for the managed service, which may vary based on the service level agreement (SLA) and the number of users. |
| Benefits | Health insurance, retirement plans, paid time off, etc., for all employees. | Typically included in the service fees. |
| Training & Development | Costs associated with ongoing training, certifications, and professional development to keep skills up-to-date. | The managed IT provider is responsible for ensuring their staff is trained. |
| Technology & Tools | Investment in hardware, software, security tools (SIEM, firewalls, etc.), and infrastructure. | Costs of technology and tools are usually included in the service fees. |
| 24/7 Coverage | Increased costs to ensure 24/7 coverage, including overtime pay or additional staff. | 24/7 monitoring and support are a core component of most managed IT services. |
| Recruitment Costs | Expenses related to hiring, including agency fees, advertising, and interview time. | Not applicable. |
| Potential for Turnover | Costs associated with employee turnover, such as severance pay, recruitment costs, and lost productivity. | Lower risk of disruption due to staff changes. |
| Management Costs | Internal resources required to manage a cyber security team. | Typically less management overhead for the client. |
The Costs of Cyber Security in Full
Cost is a big factor, no doubt. But it’s essential to look at the total cost of each option, not just the obvious price tags.
In-House Cyber Security: Crunching the Numbers
Salaries are a big chunk of the cost. It’s no secret that skilled cyber security pros earn good money – and they’re worth it, given what they protect you from. But there’s more to it than that.
You also need to consider:
- Benefits: Health insurance, retirement contributions, paid time off – these all add up.
- Recruitment and Onboarding: The costs of finding, hiring, and getting new employees up to speed – recruitment fees, advertising, and the time spent on interviews and training.
- Training and Development: Cyber security changes fast. Ongoing training and certifications are a must to keep your team effective.
- Technology and Tools: You’ll need to invest in hardware, software, and security tools (like firewalls) to equip your in-house team.
- 24/7 Coverage: This is a big one. Cyber threats don’t take days off. To get round-the-clock protection, you’ll need enough staff to cover shifts, holidays, and so on. Providing proper 24/7 coverage in-house can mean a surprisingly large team – you could be looking at needing 6 to 9 people.
According to Indeed, in the UK, the average salary for a Cyber Security Analyst typically ranges from £37,500 to £52,500 for those with 1-3 years of experience. As your needs grow and you require more experienced professionals, those with 4-6 years of experience can earn between £47,500 and £60,000. For senior roles with 7-9 years of experience, salaries can range from £65,000 to £80,000, while managerial or leadership positions can command salaries from £72,500 to upwards of £100,000.
Managed IT Services: Predictability and Expertise on Tap
With managed IT, you typically pay a regular monthly fee, which helps with budgeting. This fee often gives you access to a team with a wide range of skills. Here are some points to keep in mind:
- Access to Expertise: An MSP gives you a broad pool of IT and security knowledge. This can be more cost-effective than trying to build that same level of expertise in-house.
- Comprehensive Services: Managed service agreements usually include things like 24/7 monitoring, help desk support, and proactive security management.
- Scalability: Managed IT solutions are designed to grow with your business. It’s usually easier to scale up or down than it is to hire or lay off staff.
- Initial Setup Costs: Some MSPs might charge a setup fee to get you onboard and their services up and running.
Making the Decision: Which Path is Right for You?
I’m afraid there’s no universal answer to the managed IT vs. in-house question! The best choice, as with all tech solutions, will depend on your organisation’s unique circumstances.
Generally, you might expect to see pricing ranging from £20 to £50 per user per month for essential services like help desk support, basic network monitoring, and security fundamentals.
For more comprehensive managed IT solutions, including measures such as advanced threat detection, 24/7 security operations centre (SOC) support, and compliance management, costs can increase to £100 to £200 or more per user per month. These higher-tier services deliver more advanced security and proactive support.
Here’s a breakdown of cost considerations to help you compare the different options:
- Managed IT = Predictability and 24/7 Protection: For organisations prioritising predictable costs and round-the-clock security coverage, an MSP often represents the most efficient and cost-effective solution, particularly for mid-sized and larger businesses.
- In-House = Direct Control and Resources: If your organisation demands maximum direct control over every aspect of its IT and possesses the resources to build and maintain a high-performing in-house team with 24/7 coverage, this may be a viable option. However, be prepared for the substantial investment and ongoing operational costs.
- The Hybrid Model = Best of Both: It’s no surprise that many organisations adopt a hybrid approach, combining an internal IT function with the specialised services and 24/7 support of an MSP. This can provide a balance of control and comprehensive coverage, while keeping costs in mind and under control at the same time.
To help you get started, we encourage you to read our article: “Is My Cyber Security Tech Enough?”. This will help you to critically evaluate your current security posture and identify any gaps that need to be addressed.
Evaluating ROI and Selecting a Partner
If you’re reading this article, then chances are that you probably need to be demonstrating a return on your security investments in some way. In cyber security, ROI often boils down to avoiding and proactively preventing losses from things like data breaches, downtime, and the hit your reputation could take.
It’s essential to carefully consider these aspects to make sure you’re choosing a provider that’s the right fit for what you need, what you’ve got in your budget, and how much risk you’re comfortable with – think about things like:
- Pricing Models: Understand the provider’s pricing structure. Is it per device, per user, tiered, or a flat fee? Choose a model that aligns with your business needs and usage patterns.
- Service Level Agreements (SLAs): Carefully review the provider’s SLAs. What services are included? Do they offer 24/7 support, proactive monitoring, advanced cyber security measures, and compliance assistance? Ensure the SLAs meet your specific requirements.
- Expertise and Reputation: Assess the provider’s experience, certifications, and track record. Examine customer testimonials and case studies to gauge their capabilities and reliability.
- Flexibility and Transparency: Avoid providers that lock you into rigid, long-term contracts that don’t accommodate your evolving needs. Prioritise providers that emphasise clear communication, transparency, and a collaborative approach.
Conclusion
At the beginning of this article, we set out to explore the critical cost considerations around two core cyber security approaches: building an in-house cyber security team and partnering with a managed IT services provider. Something that should now be clearer is that the true challenge isn’t just about choosing between an in-house team or managed IT solution; it’s about aligning your security approach with the very essence of your business.
As we’ve discussed, cost is a key differentiator, but the best choice hinges on your organisation’s unique risk profile, business needs, and priorities. Factors such as the need for round-the-clock protection, access to specialised skills, and the need for scalability should weigh heavily in your decision.
So, where do you go from here? The next step is to translate this knowledge into action. Begin by conducting a cyber security risk assessment to truly understand what’s at stake. Then, use the insights we’ve provided to map out a strategy that not only addresses your immediate needs but also provides the ability to adapt to threats at all times in the best way possible.
