How and when to use on-demand cyber security staffing
According to Cisco’s 2024 Cybersecurity Readiness Index, in Canada only 1% of organizations are at the mature stage of cyber security readiness, despite 73% believing a cyber security incident will disrupt their business in the next 12-24 months.
Today’s cyber security leaders are contending with this reality, while at the same time grappling with one in six Canadian cyber security roles sitting unfilled and facing ongoing budget scrutiny.
It’s a catch-22 that has C-suites and boards scrutinizing every resource request. Your resourcing strategies for cyber security talent play a big role in whether your request gets approved. But here’s the good news: you have viable talent options beyond the MSSP that can help you get the green light to move your cyber security initiatives forward. One of them is staff augmentation.
What is an MSSP in cybersecurity?
Managed security service provider definition: an outsourced third party that can handle monitoring of systems and devices in order to alleviate pressure from internal IT teams.
MSSPs make sense for many organizations standing up their cybersecurity operations. They excel at conducting initial assessments and creating playbooks to address the most significant risks across numerous client sites. Being positioned across multiple industries enables them to quickly detect new threats in the ecosystem and create a rapid response plan. Mix this in with a talented internal team, outside consulting, and staff augmentation, and you can have some lucrative results.
Is it time to build on your managed security services provider?
If you currently work with an MSSP, you understand that the benefit it offers does not come without cost or risk. While the MSSP helps streamline your security team, it does mean trusting someone else to take care of your sensitive data.
In addition, outsourcing key initiatives and staffing to major consulting firms (PwC, Deloitte, Accenture, etc.) can result in significant loss of institutional knowledge over time, and exponentially higher costs when seeking to augment specific skillsets (Architects, SIEM Development, Detection Engineering etc.).
So how do you decide when, where, and how to put a more flexible and cost-effective cyber security talent structure into place? One that goes beyond just the MSSP and includes staff augmentation? It comes down to transparency, control, and availability.
Transparency
Insist on transparency from all of your partners in regards to their talent’s pay rates. Specifically, what hourly rate or salary is the candidate who is completing the work personally earning?
When more of the hourly costs or spend goes directly into the candidate’s pocket, which is the case with most staffing agency arrangements, you’re getting a higher skilled individual, with the added bonus of less flight risk. There is a clear benefit to demanding full transparency and reducing your organization’s risk of utilizing under-qualified talent or constant turnover.
Data control
Ironically, outsourcing to protect your assets may expose you to higher risk. More data = a more attractive target. You may decide that that risk you know is more palatable than the one you don’t, and turning over full control isn’t what you want from a security or cost standpoint. In fact, after months of deliberation, one of our clients decided to build their full cyber security process in-house due to concerns about data control and the loss of institutional knowledge.
Talent availability
S.i. Systems is starting to see the talent supply chain responding to heavy demand. In the wake of major breaches in recent years, cyber security is now a ubiquitous term. So, it stands to reason that as exposure has increased, so too have career programs and interest in the cyber security field.
Agencies like ours that lean into cyber security staffing are investing time and energy to aggregate talent into a more organized and consumable model. Economies of scale make us better at distinguishing the performers from the pretenders, which makes it easier for our clients to bring on fully qualified and vetted talent.
MSSP + staff augmentation: a hybrid approach
There are valid and distinct business drivers for exploring a hybrid MSSP-staffing arrangement: flexibility, scalability, and cost control. Here are three examples of how Canadian organizations are taking advantage of these benefits, and layering in staff augmentation to their MSSP engagements in order to build better cyber security teams:
-
The organization outsources Level 1 activity to the MSSP, using clear scope of work (detection, escalation, remediation/recovery, etc.) protocols and SLAs to kick over Level 2 escalations to an in-house team of contractors and staff employees.
-
Organization leans on outside consulting (PwC, Deloitte, etc.) for an initial assessment including Governance, Risk, and Auditing capabilities, setting a clear roadmap for improved cyber resiliency while using internal hires and contractors to fill skill gaps and clear areas of urgent weaknesses.
-
Organization uses staffing agencies to augment internal team, sourcing key talent such as SIEM implementation Specialists, Detection Engineers, Security Architects, etc., and avoiding exponentially higher staff augmentation fees from major consulting firms.
In today’s business climate and economy, building your cybersecurity team in a cost-effective way is key. Now’s the ideal time to review your current model to see if it’s working for your organization, or if it’s time for a change. While every company is different, we highly recommend that most start with a review of their partners’ pay transparency, data control, and talent availability. That data is invaluable to making cybersecurity staffing decisions.
If you have questions about the talent market for cyber security talent, reach out to us. We love what we do and are happy to brainstorm about the hybrid approach that might work best for your situation.
