Managed security service vs in-house security team — what is cheaper in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What does an in-house security team really cost in India?

Salary is only the visible part. A security analyst in Kochi is roughly Rs 8 to Rs 18 lakh a year fully loaded depending on seniority and whether you employ a person or a managed payroll contractor. A 24x7 operation needs at least three to five people to cover shifts, leave and weekends, so Rs 30 to Rs 80 lakh a year is the realistic run cost before any tooling, training, certification, insurance or office. Add a security operations platform, which is typically Rs 8 to Rs 25 lakh a year for a mid-size estate, and the full in-house number lands in the Rs 45 lakh to Rs 1.1 crore range. You are also buying a hiring cycle in a market where 73% of organisations cannot fill security roles and 57% of security providers struggle to hire AI-security specialists.

What does a managed security service cost, and what does it leave out?

Managed detection and response in India typically runs Rs 3 to Rs 15 lakh a year for a small to mid-sized estate, and a 24x7 managed SOC for a larger one runs higher. That buys a monitoring platform, a team watching it, alerting, triage, some containment, and reporting. What it usually leaves out is the thing most Indian SMEs actually need: testing. Managed monitoring does not find broken access control in your application, does not run a business email compromise assessment, and does not produce the penetration test report your enterprise customer will ask for during onboarding. Treat the two as separate purchases with separate invoices and separate scopes.

When does building in-house actually win?

In-house wins on context and on control of the roadmap, and it wins on cost once your estate is large enough that a dedicated team is cheaper than the service. As a rough rule, in-house becomes the cheaper option once the annual run cost of the managed contract exceeds roughly Rs 20-30 lakh, which usually means a large estate, a 24x7 requirement and a regulatory expectation you do not want outsourced. A second case is talent: if you have a security lead who will build the function, the first hire is a builder, not a monitor, and the tooling is bought on a roadmap rather than accepted as a package. A third case is data sensitivity, where Indian banks, healthcare providers and government suppliers face customer requirements that prohibit outsourcing security operations to a third party.

How do you decide, and what is a sensible middle path?

Start by naming the requirement you actually have, because a 24x7 monitoring requirement and a one-a-year penetration test requirement are different problems with different prices. A common middle path works well for Indian SMEs: a managed detection and response contract for continuous coverage, plus an annual penetration test with a retest included, plus a short piece of security training for the staff who will receive the phishing emails. That combination typically costs a fraction of one in-house hire and closes the two gaps that cause the most loss, which are unpatched internet-facing systems and business email compromise. Whatever you buy, make sure your monitoring provider and your testing provider are separate people, and that both report to you with a named contact.

What are the frequently asked questions?