Run your own security operations or buy monitoring as a service

Reference article · 8 min read

Most agencies reach this decision after an incident, an insurance renewal, or an audit finding that nobody is watching the logs overnight. Intrusions do not keep business hours, and an attacker who gets a password in the evening can be well into an environment before the next business day begins.

The question is rarely whether monitoring should be continuous. It is who watches, and what happens in the minutes after something is found. Detection can be bought, and so can investigative help. The decisions cannot be bought outright: taking a system offline, preserving evidence, calling counsel and the insurer, notifying a state or federal authority, and telling the public stay with the agency no matter whose analysts see the alert. Judge each option on both halves.

An in-house security operations capability

In-house means agency staff run the tooling, tune detections, triage alerts, and act on them. The advantage is context and control: your own staff know which server the billing run touches at midnight and which vendor account legitimately signs in from out of state, and nobody outside the agency decides what is worth investigating. Telemetry stays in systems the agency administers, which simplifies some data handling questions. The capability also stays after a contract ends.

The constraint is staffing. Covering every hour of every week takes multiple full-time positions for a single seat once leave, training, and turnover are counted, and one analyst alone on a night shift is not a team. Recruiting and retention compete with private employers. The model fits agencies that already staff something around the clock, such as dispatch, utility operations, or a service desk, and that have tooling in place and someone whose job is to tune it.

It does not fit a small IT department where security is one duty among several, and it goes wrong expensively when tooling is bought but never tuned, because an ignored alert queue leaves a record of warnings nobody acted on. A defensible middle is in-house staff for business hours and for decisions, with the overnight watch bought.

A managed detection and response provider

An MDR provider watches your telemetry with its own analysts and detection content and escalates what matters. Some will take containment actions, such as isolating a device or disabling an account, when the contract grants that authority.

Coverage can usually begin sooner than hiring allows, the cost appears as a contract line rather than a set of positions that must be recruited and retained, and the provider's analysts see activity across many environments. Cost is predictable to the extent the contract matches your environment; per-asset pricing, added log sources, data retention, and incident response hours are the usual places the number moves.

The limits are real. Detection quality is capped by the telemetry you send, so a provider watching only endpoints will miss identity attacks and cloud mailbox abuse. Outside analysts do not start with your context, and the tuning period is work for your staff, not just theirs. Contracts differ widely in whether the provider investigates or only forwards alerts, and forwarding moves alert fatigue rather than ending it. Detections and tuning built inside a provider's platform can be difficult to take with you, so exit terms matter. Where criminal justice, tax, health, or student data is in scope, screening obligations for provider personnel and subcontractors belong in the contract.

MDR fails where nobody can receive the escalation. It converts a staffing problem into an on-call problem. If a call in the middle of the night reaches voicemail, the money has bought a well-documented breach.

A shared regional service

Shared service means several agencies pool monitoring: a county serving its cities and towns, a council of governments, a joint powers authority, or a county office of education. Costs are split, and the peers on the other end understand public records law, procurement calendars, and public safety systems as a commercial provider often does not. Where the host is genuinely staffed, the service can be as capable as a commercial one, and the relationship usually survives a lean budget year better than a contract does.

The weak point is governance rather than technology. Funding is shared, but priorities are not. One member in a ransomware event can absorb the team for weeks, and service expectations among neighbors are often informal. Depth of coverage also varies; a host that does not staff nights is offering business-hours monitoring by another name. Before joining, ask for a written service description, hours of coverage, an escalation path with names, and an answer about what happens when two members have incidents in the same week.

State-provided and national services

Many states offer security services to local agencies as part of a statewide cybersecurity program, funded through state appropriations and federal grant programs whose availability changes over time. What is offered varies widely by state, from endpoint licensing and log collection to a state operations center that watches local networks. Nationally, the Multi-State Information Sharing and Analysis Center, operated by the Center for Internet Security, has long served state, local, tribal, and territorial governments, with services that have included network monitoring sensors, malicious domain blocking, advisories, and incident support. Which services are available at no cost, and to whom, has changed with its funding, so confirm current terms with the organization and with your state rather than relying on a description like this one.

The appeal is cost, often nothing beyond staff time, and alignment with state reporting expectations. The limits are scope and control. Boundary sensors do not see inside your network or your cloud tenant, you do not set priorities, and enrollment can move with grant cycles. In a state that runs a well-staffed center for local agencies this can be a substantial part of the program; more often it is a layer to build on rather than the whole of it.

How to decide

Work through these in order. The answers, rather than a preference among the models, should pick the option.

1. Can you name the person who takes the call in the middle of the night, their backup, and what each is authorized to disconnect without asking anyone? If not, no model works yet, and fixing it costs nothing but a decision. This is the single most common point of failure in all four options.
2. What telemetry exists today? Identity, endpoint, network, and cloud or SaaS audit logs set the ceiling on what any watcher can see. If most of those sources are missing or not retained, the first money belongs in logging, not in analyst hours.
3. Does the agency already staff something continuously? If dispatch, utility operations, or a service desk already runs around the clock, in-house or a hybrid is realistic. If nothing is staffed at night today, building that for security alone is usually the most expensive route to coverage.
4. What data classes are in scope, and what do they require of outside personnel? Criminal justice, federal tax, health, and student data impose screening, contract language, and sometimes location requirements. A provider unwilling to accept those terms is out regardless of how good its detections are.
5. What is already paid for? State and national services, a regional body you can join, and licensing you own but have not enabled change the size of the gap you are buying for.
6. What survives a lean year? Positions are hard to fund and slow to refill, contracts are easy to cut at renewal, and grant-funded services end when the grant does. Choose the failure mode you can manage.
7. Who holds your incident response retainer, and does your insurance carrier require an approved firm? Settle this before a monitoring contract assumes it.

Read together, the pattern is usually this. If questions one and two are unresolved, nothing else matters yet. If they are resolved and no one is staffed at night, some form of bought watch is the realistic route, with agency staff holding the decisions. If continuous staffing already exists and the data classes make outside access difficult, in-house with targeted outside help is workable. A shared regional service is worth pursuing when the governance questions have written answers; without them, treat it as mutual aid rather than coverage.

What this means for your solicitation

Write requirements around behavior, not product names. Ask offerors to state which response actions they are authorized to take and which they will not. Require notification targets by severity, regular reporting on detections and tuning changes, and named log sources at onboarding with confirmation that each is flowing. Require retention that satisfies your records schedule, an exit clause returning detections, tuning, and historical data in usable form, and screening and location details for analysts and subcontractors. Price incident response as a separate retainer so the cost of a bad night is known in advance. Score the hour after detection, not the detection alone.

Where HQT fits

Monitoring architecture, logging and telemetry design, detection engineering, solicitation requirements and evaluation criteria, and the escalation and response procedures behind whichever model an agency chooses.

Frequently asked questions