How Outsourcing Creates Cybersecurity Budget, Expertise Options

By Alexander Moiseev

Alexander Moiseev

Outsourcing is a global trend in business, and cybersecurity is no exception. According to Gartner, the managed security service market grew by 6.7% in 2018, reaching $10.7 billion in revenue, and continued growth is expected in the coming years. Service providers and vendors contribute to this market by offering their customers expertise, intelligence or solutions as a service.

The advantages of outsourcing create opportunities many businesses need, but they’re typically implemented to overcome three main challenges including lack of internal expertise, poor budget planning and control.

Outsource to Afford More

Many services can provide us with more than we could otherwise afford, and IT services work the same way for businesses. Suppose a company needs to expand its data center. This company will have to buy servers, find more space in the data center and spend time on deployment. Alternatively, it can purchase workloads in the public cloud and save money it would otherwise have spent on on-premise infrastructure. Another example is a security operation center (SOC) for advanced cyberprotection. Building an internal SOC demands investment in personnel, processes and detection and response technologies. Alternatively, managed service providers and vendors offer SOC as a service with a dedicated team of experts, protection solutions and threat intelligence.

Outsource to Get Expertise

One of the main problem areas for companies in regard to their IT staff is their lack of internal expertise. According to a report, one in three CISOs (70%) say that it is difficult for companies to find experienced cybersecurity professionals.

Midlevel employees who bear the brunt of cybersecurity tasks are a key element in IT security decision-making as they assess protection demands and recommend solutions. To do this properly, there should be several experts working together to find the best solution.

Imagine that the company doesn’t have enough employees, or they don’t have enough skills in areas such as cloud computing or Internet of Things security to work effectively. In this case, outsourcing can be considered an effective alternative. Service providers accumulate cybersecurity expertise and are focused on the quality of services because their revenue depends on their customer satisfaction rating.

Because of this, the service market has become very competitive. According to Ami Partners’ evaluation, the number of MSPs is expected to almost double from 48,000 in 2016 to 74,000 in 2021. This means providers need to maintain a high level of knowledge and reputation to keep clients.

Enterprise companies already take this proven path with at least half of the CISOs (55%) confirming that they solve the personnel problem with the help of outsourcing, according to the company’s CISO perspectives on cybersecurity report. For SMBs, this approach should be even more effective as they are often more limited in human resources for IT security.

Outsource to Keep Budgets Under Control

Another benefit of cybersecurity outsourcing is facilitating necessary, but important, resource planning. This can be beneficial for companies that …

… struggle to define exact costs because they haven’t yet developed a budget planning process for IT and IT security.

By purchasing cyberprotection for endpoints as a service, an IT security administrator knows exactly what they will receive, how much it costs and how long the service deployment will take. This is the key advantage of outsourcing – transparency, clarity, predictable results and a predetermined cost.

Another outsourcing scenario is when an organization needs to cut its IT security budget. A company needs to maintain its current level of protection, so the budget should be split wisely. Managers should clearly understand how much they spent and what they receive for the price they’re paying.

Are Businesses Ready?

Cybersecurity outsourcing in some cases is considered by companies as an option during difficult times when budgets are limited. Companies with growing IT investments strive to increase internal expertise and solve security problems internally. Perhaps they still feel uncertainty toward service providers, or they think that internal resources are easier to control.

Within our channel, we already observe that the managed service market is moving toward the development of narrowly targeted services. Providers are honing their expertise and the level of provided services. If companies continue to develop such narrow expertise internally, it will most likely be unprofitable. Therefore, we will probably soon see the opposite situation occurring, where the more a company invests in cybersecurity, the higher the specialized and effective services it consumes from the outside.

Alexander Moiseev is chief business officer at Kaspersky Lab, where he previously was chief sales officer. He leads sales and marketing globally and also has worked as head of Kaspersky’s Global Partnerships and Sponsorships team, developing global sponsorship projects and its technology and innovation investments in transportation systems cybersecurity. He graduated from Moscow State University with a degree in engineering with mathematics and cybernetics. Follow him on LinkedIn or @kaspersky on Twitter.