What in-house actually costs
The scanner licence for a typical 200-500 device UK estate runs to a few thousand pounds a year. That is the number in the business case. What is missing: someone has to deploy and maintain the sensors, keep authentication working, reconcile the asset list, tune out the noise, prioritise what matters, chase the people who own the fixes, validate that fixes worked, and report to management.
In our experience that is 1.5 to 2.5 days a week of skilled effort for a mid-market estate, done properly. If it is done as a side-of-desk task by someone who also runs the helpdesk, it is not being done — the scans run, the reports generate, and nothing gets fixed. We regularly take over estates with thousands of open vulnerabilities and a perfectly healthy scanning schedule.
- Cost the remediation workflow, not the tool: sensor maintenance, auth coverage, prioritisation, chasing owners, validation re-scans, reporting.
- Don't assume your IT generalist can absorb it. Vulnerability management fails quietly — the dashboard stays green while the backlog grows.
The skills problem
Running the scanner is trainable. The hard part is judgement: knowing that a CVSS 9.8 on an isolated test box matters less than a CVSS 7.5 on the server that processes payments, that this 'critical' finding is a false positive, and that that patch will break the accounts package if deployed before month-end.
That judgement comes from having broken things and fixed things before. A junior analyst with a scanner produces ticket queues, not risk reduction. If you go in-house, the person running it needs enough seniority to push back on both the business ('yes, this really does need patching this week') and the tool ('no, we are not fixing 400 informational findings').
What outsourcing actually buys you
A good managed service is not 'someone else watches the dashboard'. It is: asset reconciliation against your CMDB, authentication coverage monitored and fixed, prioritisation tuned to your business context, a named owner for every remediation action, validation that patches actually closed the finding, and a monthly report your leadership will actually read.
It also buys you the awkward conversations. An external provider can tell your IT team their patch cadence is too slow, or tell the board that the ERP vendor's supported-version policy is the real risk, without the internal politics.
Where outsourcing goes wrong
The failure mode we see most: the provider scans, produces a monthly PDF, and emails it into a void. Nobody internally owns remediation, so nothing moves. Twelve months later the vulnerability count is unchanged and the renewal is questioned. That is not vulnerability management — it is expensive scanning.
The second failure mode is the provider who cannot touch your environment. Remediation still needs someone with admin rights and change control access. If the contract does not make clear who patches what, you have bought a report generator.
- Ask any provider: who owns the fix, how do you validate closure, and what does your escalation path look like when a team refuses to patch?
- Don't sign a contract that measures success by scans completed. Measure age of open vulnerabilities and time-to-remediate by severity.
The honest comparison
In-house done properly: licence plus roughly half an FTE of senior time, plus the management overhead of keeping that person trained and retaining them. For a mid-market firm that is typically £40-60k a year all-in, and it lives or dies on one person.
Outsourced done properly: a managed service fee that is usually lower than the in-house all-in cost, with the resilience of a team rather than an individual. The trade-off is that you still need an internal owner — someone who chairs the monthly review, unblocks the internal politics, and holds the provider to the numbers.
The hybrid that works best in practice: outsourced scanning, prioritisation, validation and reporting, with remediation executed by your internal IT team or your existing IT support partner, measured against agreed SLAs.
How to decide
Ask three questions. Do we have someone senior enough to run this with judgement, and can we spare them half their week? If they leave, does the programme survive? And is our current backlog shrinking month on month — not the scan count, the actual open findings?
If any answer is no, the in-house model is costing you more than the managed service would, just in a less visible budget line.
- The scanner licence is the smallest cost either way — the real cost is the remediation workflow.
- In-house done properly takes 1.5-2.5 days a week of senior effort for a mid-market estate.
- Outsourcing fails when nobody internally owns remediation — a monthly PDF is not a programme.
- The strongest model is usually hybrid: outsourced prioritisation and validation, internal remediation against SLAs.
- Measure age of open findings and time-to-remediate, never scans completed.