Quick Summary
Co-managed security services combine your internal IT team with a managed security service provider (MSSP). You keep control of your environment and maintain internal expertise, while the MSSP provides 24/7 monitoring, specialist skills, and advanced tools that you cannot afford to build in-house. This guide covers what co-managed security includes, why companies choose it, how it differs from fully managed or fully in-house, and how to structure the right partnership.
Key fact: ASD's Annual Cyber Threat Report 2024-25 says ASD's ACSC responded to over 1,200 cyber security incidents in 2024-25, that 11 per cent included ransomware, and that the frequency of ransomware attacks increased during the year. Companies need 24/7 security monitoring, specialist cybersecurity skills, and advanced tools, but cannot afford to build all three in-house.
Table of Contents
- What Is Co-Managed Security?
- Fully In-House vs Fully Managed vs Co-Managed
- What Is Included
- Why Companies Choose Co-Managed
- How to Structure the Partnership
- Cost Comparison
- Common Pitfalls to Avoid
- Frequently Asked Questions
What Is Co-Managed Security?
Co-managed security is a partnership model where your internal IT team and an external managed security service provider (MSSP) share responsibility for your cybersecurity posture.
Your internal team handles:
- Day-to-day IT operations and user support
- First-line incident triage and response
- Internal stakeholder communication
- Policy development and enforcement
- On-site security tasks (hardware, physical access)
The MSSP handles:
- 24/7 security monitoring (SIEM/XDR)
- Threat detection and response
- Vulnerability scanning and patch management
- Essential Eight maturity assessment and monitoring
- Backup monitoring and restore testing
- Security awareness training
- Compliance evidence collection
Together, you share:
- Strategic security planning
- Incident response planning and testing
- Security tool evaluation and procurement
- Board-level security reporting
- Vendor management (for security tools)
Fully In-House vs Fully Managed vs Co-Managed
| Dimension | Fully In-House | Fully Managed (MSSP) | Co-Managed (Hybrid) |
|---|---|---|---|
| Control | Full control | MSSP controls security operations | Shared control, you retain strategic control |
| 24/7 coverage | No (on-call only) | Yes (MSSP NOC/SOC) | Yes (MSSP NOC/SOC) |
| Specialist skills | Limited to what you can hire | Full MSSP team of specialists | MSSP specialists + your internal generalist |
| Tool cost | You buy all tools | MSSP provides tools | Shared, MSSP provides advanced tools, you manage basic tools |
| Business context | Deep internal knowledge | Limited business context | Deep internal knowledge + MSSP expertise |
| Cost | Highest: salaries, tools and training | Monthly MSSP fee | MSSP fee plus some internal time |
| Single point of failure | HIGH (if key person leaves) | LOW (MSSP team redundancy) | MEDIUM (your team + MSSP team) |
| Scalability | Limited by hiring | Highly scalable | Scalable via MSSP |
| Knowledge retention | At risk if staff leave | Retained by MSSP | Shared between your team and MSSP |
What Is Included
A typical co-managed security engagement includes:
MSSP-Provided Services
| Service | Detail |
|---|---|
| 24/7 SIEM/XDR monitoring | Security event correlation, threat detection, automated response playbooks |
| Vulnerability scanning | Monthly automated scans with remediation tracking and trend analysis |
| Patch management | Automated patching with prioritisation for critical and extreme-risk vulnerabilities |
| Essential Eight monitoring | Continuous maturity assessment with real-time dashboard and evidence collection |
| Backup monitoring | Automated monitoring of backup completion, integrity, and restore readiness |
| Threat intelligence | Industry-specific threat feeds, alerting on relevant campaigns and indicators |
| Security awareness training | Phishing simulations, ongoing training modules, measured click-through rate improvement |
| Incident response support | On-call security engineer, containment playbooks, forensic investigation, recovery |
| Quarterly security reviews | Security posture assessment, trend analysis, recommendations, and roadmap updates |
Your Internal Team Responsibilities
| Responsibility | Detail |
|---|---|
| First-line triage | Initial assessment of security alerts, routing to MSSP for deep analysis if needed |
| Internal communication | Notifying stakeholders of security events, coordinating response actions |
| Policy development | Developing and enforcing security policies, procedures, and standards |
| On-site tasks | Physical security, hardware installation, device procurement and deployment |
| User support | Password resets, account provisioning, security-related helpdesk tickets |
| Compliance coordination | Coordinating with auditors, collecting internal evidence, managing compliance timelines |
Why Companies Choose Co-Managed
Reason 1: Cannot Afford Full In-House Team
| Specialist Role | In-House Requirement | Why Co-Managed Solves This |
|---|---|---|
| SOC analyst | Round-the-clock cover needs a roster of several people, not one hire | MSSP provides a 24/7 SOC shared across many clients |
| Security engineer | A senior, full-time salary | MSSP provides security engineering as part of the service |
| Threat intelligence analyst | A specialist salary plus paid intelligence feeds | MSSP provides threat intelligence feeds and analysis |
| Incident response specialist | A specialist who may sit idle between incidents | MSSP provides on-call IR support |
| Total | Several specialist salaries, beyond most mid-market budgets | One co-managed fee |
Reason 2: Wants to Retain Internal Control
Some companies do not want to fully outsource security because:
- They have deep institutional knowledge that an MSSP cannot replicate
- They have specific compliance obligations that require internal oversight
- They want to build internal security capability for the long term
- They have had bad experiences with fully managed providers in the past
Co-managed security gives them the best of both: internal control + external expertise.
Reason 3: Needs 24/7 Coverage
| Time Period | In-House Coverage | Co-Managed Coverage |
|---|---|---|
| Business hours (Mon-Fri, 8am-6pm) | Full coverage | Full coverage (internal team + MSSP) |
| After-hours (Mon-Fri, 6pm-8am) | On-call phone (may not answer) | 24/7 SOC monitoring and response |
| Weekends | No coverage | 24/7 SOC monitoring and response |
| Public holidays | No coverage | 24/7 SOC monitoring and response |
Reason 4: Needs Advanced Tools
| Security Tool | Bought In-House | Included in Co-Managed |
|---|---|---|
| SIEM/XDR platform | Separate licence, often the largest tool cost | Usually yes |
| Vulnerability scanner | Separate licence | Usually yes |
| Threat intelligence feeds | Separate subscription | Usually yes |
| Security awareness training platform | Separate subscription | Usually yes |
| Backup monitoring and testing | Tooling plus staff time | Usually yes |
Check each proposal for which tools are included and which are billed separately.
How to Structure the Partnership
Step 1: Define the Division of Responsibilities
Create a RACI matrix (Responsible, Accountable, Consulted, Informed) for each security function:
| Security Function | Internal Team | MSSP |
|---|---|---|
| 24/7 monitoring | Informed | Responsible + Accountable |
| Vulnerability scanning | Consulted | Responsible |
| Patch deployment | Responsible | Consulted |
| Essential Eight assessment | Consulted | Responsible |
| Incident response (first line) | Responsible | Consulted |
| Incident response (deep analysis) | Consulted | Responsible |
| Security awareness training | Consulted | Responsible |
| Policy development | Responsible + Accountable | Consulted |
| Board-level reporting | Responsible | Consulted |
| Tool procurement | Accountable | Consulted |
Step 2: Establish Communication Protocols
| Protocol | Detail |
|---|---|
| Daily | MSSP sends daily security summary (alerts, actions, trends) |
| Weekly | 30-minute call between internal team and MSSP engineer |
| Monthly | Monthly security dashboard review with internal team and MSSP |
| Quarterly | Formal security posture review with leadership, MSSP, and internal team |
| Incident | MSSP notifies internal team within 15 minutes for critical incidents, 1 hour for high incidents |
Step 3: Define Escalation Paths
Security alert detected by MSSP SIEM/XDR
↓
MSSP analyst triages and assesses severity
↓
If Critical: Page internal team on-call + MSSP senior engineer (15 minutes)
If High: Notify internal team via ticket + email (1 hour)
If Medium: Create ticket for internal team next business day
If Low: Log and monitor
↓
Internal team coordinates response with MSSP
↓
Post-incident: MSSP produces incident report, internal team implements lessons learned
Step 4: Set Performance Metrics
| Metric | Target | Measurement |
|---|---|---|
| Mean time to detect (MTTD) | <5 minutes for critical threats | MSSP SIEM logs |
| Mean time to respond (MTTR) | <30 minutes for critical threats | MSSP incident logs |
| Vulnerability patching time | <48 hours for extreme-risk vulnerabilities | Patch management dashboard |
| Essential Eight maturity level | Target Maturity Level 2 within 6-12 months | Quarterly maturity assessment |
| Backup restore test | Quarterly, with documented results | Restore test reports |
| Phishing click-through rate | <5% (after 6 months of training) | Phishing simulation results |
Cost Comparison
There is no reliable published benchmark for Australian MSSP prices, so compare quotes against the same scope. The relative picture for a typical 100-user company:
| Model | What You Pay For | What You Get |
|---|---|---|
| Fully in-house | Salaries, tools and training | Full control, but limited specialist skills and no 24/7 coverage |
| Fully managed (MSSP) | An MSSP fee | 24/7 coverage, full specialist team, but less internal control |
| Co-managed (hybrid) | An MSSP fee plus some internal time | 24/7 coverage, specialist skills, internal control retained |
The Co-Managed Value Equation
| Component | Cost | Value |
|---|---|---|
| MSSP fee | Quoted per user, device or log volume | 24/7 SOC, specialist team, advanced tools, Essential Eight monitoring |
| Internal team (incremental cost) | Little or none if your existing team handles first-line tasks | Business context, stakeholder communication, policy development |
| Total | MSSP fee plus internal time | Comprehensive security with internal control |
| vs fully in-house equivalent | Several specialist salaries plus tools | Often lower cost, with 24/7 coverage |
Common Pitfalls to Avoid
Pitfall 1: Unclear Responsibility Boundaries
The problem: Both the internal team and MSSP assume the other is handling a critical security function, and nobody does it.
The fix: Document a clear RACI matrix for every security function. Review it quarterly and update as responsibilities shift.
Pitfall 2: Poor Communication
The problem: The MSSP detects a threat, creates a ticket, and the internal team does not see it for hours.
The fix: Establish communication protocols with defined response times. Use a shared ticketing system. Conduct weekly calls between teams.
Pitfall 3: Tool Overlap
The problem: The internal team already has antivirus and the MSSP deploys their own, now you are paying for two tools that conflict.
The fix: Conduct a tool inventory assessment before engagement. Decide which tools the MSSP will replace and which the internal team will retain.
Pitfall 4: Knowledge Silos
The problem: The MSSP knows the security environment but not the business context. The internal team knows the business but not the security tools.
The fix: Conduct joint onboarding sessions. Have the MSSP document everything in a shared knowledge base. Include the MSSP in quarterly business reviews.
Pitfall 5: No Exit Plan
The problem: If the relationship ends, the internal team does not know how to operate the MSSP's tools independently.
The fix: Require the MSSP to document all configurations, playbooks, and procedures. Include free knowledge transfer in the contract.
Frequently Asked Questions
How is co-managed different from fully managed security?
In fully managed security, the MSSP handles everything, you have little to no involvement. In co-managed security, your internal team retains responsibility for first-line tasks, policy development, and stakeholder communication, while the MSSP handles 24/7 monitoring, specialist analysis, and advanced tool operation. Co-managed gives you control + expertise; fully managed gives you convenience but less visibility.
Do I need an internal IT team for co-managed security?
Yes, you need at least one internal IT coordinator who can handle first-line triage, internal communication, and on-site tasks. The coordinator does not need to be a cybersecurity specialist, the MSSP provides the specialist skills. The coordinator needs basic IT knowledge, communication skills, and the authority to escalate incidents to leadership.
How quickly can co-managed security be set up?
Typically 4-6 weeks. Week 1-2: tool deployment and integration. Week 3-4: baseline assessment and policy alignment. Week 5-6: testing and handover. Full 24/7 monitoring begins at the end of week 6.
What happens if the MSSP misses a threat?
The MSSP should have SLAs for detection and response times with financial penalties for breach. Additionally, your internal team should conduct periodic "purple team" exercises (simulated attacks) to test the MSSP's detection capability. If the MSSP consistently misses threats, it is time to renegotiate or switch providers.
Can I start with co-managed and move to fully managed later?
Yes. Many companies start co-managed to build internal understanding and trust, then transition to fully managed once they are confident in the MSSP's capability. The transition takes 4-6 weeks during which the MSSP assumes additional responsibilities from the internal team.
Ready to Explore Co-Managed Security?
Co-managed security works best when the split of responsibilities is written down before anything is switched on. Start with a RACI for each security function, then decide which tools stay with your team and which move to the provider. If you want help working through that with your internal team, see our managed cybersecurity service.