apinan - Fotolia

Get started Bring yourself up to speed with our introductory content.

In-house vs. outsourced cybersecurity operations center capabilities

Cybersecurity operations centers have become an essential element of threat detection. Here's how to decide whether to build one in-house or outsource these capabilities.

The term cybersecurity operations is straightforward: In business, operations refers to all the things an organization does in order to perform its mission. But, to do that, the organization must also protect the resources needed to meet its goals, and that's where cybersecurity comes in.

Online information and resources require protection, and cybersecurity operations are the organizational processes needed to secure the overall organization -- and, in particular, its information assets -- against cybersecurity threats.

Cybersecurity operations have one overriding goal: protect the organization's information, websites, databases, business processes and communications. It does this by monitoring what goes on inside and outside the network to detect activity that may represent malicious activity or threats.

Many networks grew in response to emerging technologies and changing demands -- leaving cybersecurity without a unified master plan to follow. The internet disrupted everything, making it critically necessary for companies to beef up their security operations and to place them under one umbrella. The volume of alerts generated by intrusion detection/prevention systems (IDSes/IPSes), firewalls and other systems compelled companies to take a closer look at their security infrastructure. Not only did companies fear a lack of trained staff meant alerts weren't being analyzed, but they were also worried that the sheer number of alerts was just too great to diagnose in a timely fashion. Organizations were afraid of what they didn't know from a threat monitoring standpoint.

Outsourcing vs. in-house cybersecurity operations

For these organizations, there are two possible approaches to create a cybersecurity operations capability: outsource or build in-house.

Outsourcing cybersecurity operations can provide security analysis capabilities while an organization builds its own internal cybersecurity operations center.

Outsourcing the cybersecurity operations function is a reasonable way to monitor network alerts. At its most basic, outsourcing cybersecurity operations involves contracting with a managed security service provider to analyze network alerts for potential malicious behavior, with the MSSP discarding those that are not malicious and reporting those that may, in fact, be harmful.

Outsourcing pros

  • Trained personnel. The MSSP has experienced personnel immediately available, saving the organization the time and expense of hiring and training the people needed to do the analysis.
  • The MSSP also already has the facilities and tools required to do the job, saving more time and the upfront expense of building out an internal cybersecurity operations center.
  • Intelligent analysis. Outsourcing cybersecurity operations can provide security analysis capabilities while an organization builds its own internal cybersecurity operations center.

Outsourcing cons and questions to ask the MSSP

  • How much analysis is the MSSP going to provide? Outsourcing the cybersecurity operations function does not usually provide features that include multi-tier analysis of alerts or an incident response service. Instead, many outsourced cybersecurity operations only provide the equivalent of a Level 1 cybersecurity operations analysis.
  • The MSSP may only be able to analyze a subset of alert logs generated by an organization. Alerts from applications like databases and web applications may be outside of its area of expertise. If the MSSP is also a tools or hardware vendor, it may only be able to analyze logs from its own products.
  • What happens to alerts that the MSSP cannot clear? Who is going to provide a detailed analysis of these potential threats? An organization still needs some internal analysis capabilities to deal with the smaller number of alerts that cannot be easily cleared by the MSSP and thus returned to the client.

For some organizations, complete and permanent outsourcing of cybersecurity operations is a desirable option. This is a reasonable approach for government organizations, in particular, where obtaining, training and managing people and facilities, as well as predicting cost, are preferably handled under a services contract rather than in-house. Government organizations may also have significant compliance obligations regarding cybersecurity where it may be convenient to transfer regulatory mandates to a contractor.

SOC responsibilities
The responsibilities of a security operations center

In-house cybersecurity operations center

Building an in-house cybersecurity operations center provides the greatest degree of control over cybersecurity operations and the best opportunity to get exactly the services that an organization needs. Building an in-house cybersecurity operations center can also provide the foundation for building future comprehensive cybersecurity services, including vulnerability management, incident response services, external and internal threat management services, and threat hunting.

Compared to outsourcing the cybersecurity operations function, building in-house capability has the following pros and cons.

In-house pros

  • Tailoring the operation to meet demands. Design the security operations and monitoring capabilities that best meet the organization's requirements.
  • Building a unified security strategy. An in-house cybersecurity operations center can be the foundation for a comprehensive security, threat and incident response capability.


  • Planning and implementation. The time required to get an in-house cybersecurity operations center up and running can easily be a year and is likely longer.
  • Acquiring appropriate personnel. Hiring people who have the right skills, training and experience or developing and training existing in-house staff can be time-consuming and expensive.

As with many cybersecurity decisions, the right approach for many organizations is to find the correct balance between managing the cybersecurity operations function in-house and outsourcing it to an MSSP.

One reasonable option -- particularly for companies that intend to build an internal cybersecurity operations function -- is to take advantage of the speed that outsourcing provides while the organization builds its own cybersecurity operations. Outsourcing can provide at least some of the cybersecurity services needed today, and the organization can take advantage of the trained, experienced staff that an MSSP has at its disposal while building the services that it wants to provide on its own.

This was last published in January 2020

Dig Deeper on Network intrusion detection and prevention (IDS-IPS)

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.