In-house versus managed security: an honest cost comparison for Australian SMBs

For most Australian small and mid-sized businesses, a managed service is cheaper than building the same level of cover in-house, mainly because round-the-clock monitoring needs a roster of five or more people once leave and training are counted. In-house security makes sense when you already have IT staff who can own security in business hours, or when your systems are unusual enough that outsiders struggle to understand them, and many businesses end up with a hybrid: internal ownership plus a co-managed provider for overnight monitoring. In the illustrative example below, moving from a half-time internal security role plus tools to a managed MDR and SOC service saves about $39,000 a year and pays back a $20,000 transition cost in about six months.

This guide supports the selection method. The numbers match the default of the payback calculator. All figures are illustrative, ex GST; salaries and on-costs are examples, not market data.

Why 24/7 is so expensive to staff yourself

A week has 168 hours. If one full-time person works about 38 hours a week, covering every hour with one person on shift needs 168 ÷ 38 ≈ 4.4 full-time equivalents before leave. Allowing roughly 20% of paid time for annual leave, personal leave, training and public holidays, that becomes about 4.4 ÷ 0.8 ≈ 5.5 people, for a single analyst on shift with nobody to escalate to. A managed provider spreads that roster across many clients.

That is why the honest comparison is not "a security engineer versus a provider", but "the cover we would actually have in-house versus the cover the provider gives".

What to include on each side

In-house cost item	Notes
Salaries	Security engineer or analyst time, as a share if they also do IT
On-costs	Superannuation guarantee, payroll tax where applicable, workers compensation, leave loading
Tools and licences	EDR, SIEM or log platform, vulnerability scanning, email security, backup
Training and certifications	Courses, exam fees, conference time
After-hours cover	On-call allowances or an overnight service anyway
Recruitment and turnover	Hiring costs and the gap when someone leaves
Management time	Someone has to supervise the role

Managed cost item	Notes
Recurring fees	Per user, endpoint, device or log volume
Onboarding	One-off
Response outside scope	Hourly charges or retainer
Internal coordination	A few hours a month to read reports and approve changes
Overlap during transition	Paying for old tools while the new service starts

Illustrative comparison and payback

Line	In-house	Managed
People	Half of a security engineer's time, $75,000 incl. on-costs	Internal coordination, absorbed by IT manager
Tools and licences	$18,000	Included in fee
Overnight and weekend monitoring	None	Included (MDR and SOC)
Annual cost	$93,000	$54,000
One-off transition	–	$20,000 (onboarding, 2 months overlap, project time)

Yearly saving = $93,000 − $54,000 = $39,000. With the saving growing 3% a year (for example with wages), the calculator gives:

Payback = $20,000 ÷ $39,000 ≈ 0.51 years (about six months);
Savings over three years = $39,000 + $40,170 + $41,375.10 = $120,545.10;
Net saving over three years = $120,545.10 − $20,000 = $100,545.10.

Note the comparison flatters the in-house option: it has no overnight cover. Adding that in-house would cost far more than the managed fee.

When in-house or hybrid is the better fit

Situation	Why it may fit
You already have capable IT staff	They can own security in business hours; buy overnight monitoring only (co-managed)
Unusual or operational technology	Plant control systems, specialised clinical or engineering systems need local knowledge
Strict data location or access rules	Keeping monitoring in-house can simplify where data goes, though onshore providers exist
Security is part of your product	A software or data business may need deep in-house skills anyway

A common hybrid: internal IT owns patching, access and projects; a provider does 24/7 MDR and escalates; a vCISO runs governance a few days a quarter; an independent firm does the penetration test.

Risks on each side

In-house: key-person risk (one person knows everything), alert fatigue, difficulty keeping skills current, no cover during leave.
Managed: scope gaps, shared attention across many clients, dependence on the provider's own security, exit friction.

Both need an internal owner. Outsourcing the work does not outsource accountability: under the Privacy Act and the Cyber Security Act, obligations stay with your business.

Frequently asked questions

Can our IT support company do security too?

Often, yes. Check whether it has 24/7 capability or subcontracts it, and treat it like any other provider in the due-diligence checklist.

What if the payback is negative?

Then the managed option costs more than your current in-house setup. That can still be the right choice if it buys cover you do not have, such as overnight response. Decide on cover first, then price.

How do I estimate on-costs?

Add superannuation guarantee, payroll tax if you are above your state's threshold, workers compensation and leave. Your accountant or payroll provider can give your actual figure.

Is it worth hiring a security person if we use a provider?

For businesses of a few hundred staff, often yes, to manage the provider and own security decisions. For smaller ones, a fractional vCISO usually covers that role.

Sources

ASD's Australian Cyber Security Centre — guidance for businesses on managed service providers and security operations
business.gov.au — hiring and employment costs, cyber security resources
Australian Taxation Office — superannuation guarantee and business deductions