Research: Security Operating Model Options

Summary

No published dataset ranks security operating models. Anyone claiming one model outperforms the rest has either a narrow sample or an opinion. This report treats the options as analytical categories and tests them against published evidence on skills, detection, third-party exposure and governance.
Skills pressure is the strongest driver. In ISC2’s workforce study, 95 percent of respondents reported at least one skills gap and 88 percent had experienced an incident or operational issue linked to a skills shortage.
Detection is where sourcing choices show up. Mandiant found organizations first detected intrusions internally 52 percent of the time, against 34 percent from external notification and 14 percent from the attacker.
Outsourcing moves work, not accountability. Third parties were involved in 48 percent of breaches in Verizon’s data, and vendors were slow to close basic identity gaps.
Five options are compared. A short test at the end helps decide which fits, based on capability maturity rather than preference.
Confidence is low. The comparison rests on published evidence and professional judgment, not a benchmark of operating-model outcomes.

The question

Where should security capability sit, who should run it, and which decisions must stay with the organization? The question comes up after a merger, a growth phase, a cloud migration, a budget cut or a failed audit, and it is usually answered by default rather than design.

Method and evidence base

We defined five operating model options from common practice, then examined which published evidence bears on the choice. The options are our categories. No source uses this classification, and real organizations mix them.

Source	Sample and method	Bears on	Limits
ISC2 Cybersecurity Workforce Study (latest edition)	Survey of more than 16,000 cybersecurity professionals and decision-makers worldwide.	Skills gaps, budget, staffing, external providers	Self-reported. Respondents are professionals who chose to answer.
Mandiant M-Trends (latest edition)	Mandiant Consulting investigations across one calendar year, backed by more than 500,000 hours of incident response.	Detection source, dwell time	Reflects organizations that called an incident responder. It does not compare operating models.
Verizon Data Breach Investigations Report (latest edition)	More than 31,000 incidents and more than 22,000 confirmed breaches in 145 countries, from almost 100 contributors.	Third-party involvement, human element	Regional visibility depends on contributors and disclosure laws.
NIST Cybersecurity Framework 2.0	Voluntary framework with six functions, including Govern.	Roles, responsibilities, oversight, supply-chain governance	A framework, not outcome data.

What the evidence says

Skills, not headcount

ISC2 reports that 59 percent of respondents described skills gaps as critical or significant, up from 44 percent in the prior study. Thirty-six percent reported budget cuts and 24 percent layoffs. Seventy-two percent agreed that cutting staff significantly raises the likelihood of a breach. AI skills were the most pressing need for 41 percent and cloud security for 36 percent. ISC2 did not publish a global workforce gap figure because respondents stressed specific skills over raw numbers.

The implication for operating model choice is that the first question is which skills you can hire and keep, not how many people you need. Scarce skills such as detection engineering, cloud security and AI security are the ones most often bought.

Detection is where capability shows

Mandiant reports a median global dwell time of 14 days. As reported in press coverage of the study, organizations that detected activity internally did so in about nine days, against a median of 25 days when an outside party notified them. These figures describe who finds intrusions. They do not prove that in-house monitoring beats external monitoring, because the sample consists of cases that reached investigators.

Third parties are in the loop either way

Verizon found third-party involvement in 48 percent of breaches, up 60 percent. Only 23 percent of third-party organizations had fully remediated cloud MFA gaps. Any model that moves operations to a provider adds a privileged connection to the estate that needs its own governance.

Accountability does not transfer

NIST CSF 2.0 places roles, responsibilities and authorities, risk strategy, oversight and supply-chain risk management under the Govern function. In regulated sectors, accountability for outsourced security functions generally stays with the regulated entity; the specific requirements should be confirmed with the relevant regulator.

The five options

Option	How it works	Holds when	Fails when
1. Centralized in-house	One security organization owns policy, architecture, operations and assurance for the whole enterprise.	The enterprise is mid-sized, technology is relatively uniform and the organization can hire and keep scarce skills.	Business units move faster than the central team, or critical skills cannot be recruited.
2. Federated	Business units run their own security teams under central policy and standards.	Units differ sharply in technology, regulation or risk, and each has real engineering capacity.	Standards drift between units, duplicated tooling grows, and nobody sees enterprise risk as a whole.
3. Hub and spoke	A central core sets strategy, architecture, risk and monitoring. Embedded security leads in the business carry local delivery.	Scale and diversity call for local knowledge but central visibility and decision rights must stay strong.	Embedded leads report to the business and not to security, or their time is taken by other work.
4. Co-managed	The organization keeps governance, architecture and risk decisions. A provider runs defined operational services such as monitoring.	Skills or round-the-clock coverage cannot be built in-house but the organization can govern a provider.	Responsibilities between organization and provider are unclear, or provider access is poorly controlled.
5. Provider-led	A provider or fractional leadership runs most security delivery. The organization retains a small oversight function.	The organization is small or early in maturity and needs a baseline quickly.	Oversight is too thin to challenge the provider, or the organization outgrows the contract.

Comparison against decision criteria

The ratings below are Cybrilliant’s professional judgment, informed by the evidence above. They are not measured results.

Criterion	Central	Federated	Hub and spoke	Co-managed	Provider-led
Access to scarce skills	Weak	Weak	Moderate	Strong	Strong
Enterprise-wide visibility	Strong	Weak	Strong	Moderate	Moderate
Business proximity	Weak	Strong	Strong	Moderate	Weak
Round-the-clock detection	Moderate	Weak	Moderate	Strong	Strong
Third-party exposure created	Low	Low	Low	High	High
Governance burden	Moderate	High	High	High	Moderate
Speed to stand up	Slow	Slow	Slow	Moderate	Fast

What to keep, whichever option you choose

Five capabilities are difficult to delegate without losing control of risk. This is judgment, not research finding.

Risk acceptance. Someone inside the organization with authority must decide which risks to take. A provider can inform that decision, but cannot own it.
Architecture authority. The right to say how systems are built, and to refuse designs that break the security model.
Incident decision rights. Who is allowed to isolate a system, take a service offline or notify a regulator must be settled before an incident.
Provider oversight. The capacity to challenge reports, test services and revoke access. Without it, a co-managed model is an act of trust.
Knowledge of what matters. Provider monitoring is only as sharp as its understanding of crown jewels and business processes, and that understanding comes from the organization.

Choosing between them

Capability maturity should drive the choice. For each of the six NIST CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover), rate three things.

Question	If the answer is	It points toward
How mature is the capability today?	Low and urgent	Buy it temporarily (co-managed or provider-led) with a plan to build.
Can the skills be hired and retained here?	No	Co-managed or provider-led for that function.
Does the function need deep knowledge of the business?	Yes	Keep it in-house, centrally or embedded.
Would a failure be visible to regulators, customers or the board?	Yes	Keep decision rights in-house even if operations are bought.
Does the business unit set its own technology and risk?	Yes	Federated or hub and spoke.

Limitations

No outcome benchmark. We found no published dataset comparing breach outcomes across these models.
Self-selected samples. The workforce study is a survey; the incident datasets cover organizations that were breached or called for help.
Categories are ours. Most organizations mix options by function. A co-managed SOC inside a hub-and-spoke structure is common.
Judgment-based ratings. The comparison table reflects professional assessment and should be tested against local conditions.
Context matters. Regulation, data residency and sector rules can rule options out. Check these before deciding.

Claim discipline: statistics are reported as published. Option definitions, ratings and recommendations are analysis and opinion, not research findings.

Sources

ISC2, Cybersecurity Workforce Study, latest edition (as reported by SecurityInfoWatch). securityinfowatch.com
Google Cloud / Mandiant, M-Trends, latest edition, including headline findings page. cloud.google.com
Help Net Security, “Attackers are handing off access in 22 seconds, Mandiant finds” (secondary report used for internal versus external dwell time). helpnetsecurity.com
Verizon, Data Breach Investigations Report, latest edition, including executive summary and methodology notes. verizon.com
National Institute of Standards and Technology, The NIST Cybersecurity Framework (CSF) 2.0. nist.gov