Today’s
cybersecurity executives have a lot of choices in how they wish to purchase and consume products and services.
The traditional approach of a large up-front capex investment in perpetual licenses works for some organizations, but many are looking towards managed services to reduce their up-front costs and move the overhead of managing the solution to a provider that can efficiently deliver results.
Very few security teams can boast of being fully staffed, but even so, given the propensity of security risks to multiply, those lucky few teams will soon find themselves underwater, as well.
Justifying a move to a managed service requires a realistic review of your infrastructure costs, operational support costs, staffing costs and intangible costs. You should look at those costs over at least three years. You may not own the budget for some of this, so it will require a little bit of investigation, but it is a very valuable exercise.
Here are some examples of the costs that you will want to consider:
It’s easy to forget about infrastructure costs especially if it is handled for your IT team. You’ll need to do a bit of digging here to come up with your costs, but this is an important part of the justification. Make sure that you consider growth in your calculations since environments tend to grow over time and resource requirements may change.
| Infrastructure Costs
|
| Description |
Traditional Perpetual Model |
Managed Services |
| Servers |
$10k – $40k yr |
Included |
| Database Licenses |
$20k – $30k yr |
Included |
| Backup Software |
$200/server yr |
Included |
| Virtual Infrastructure |
Depends on provider |
Included |
| Antivirus, Malware Tools |
$100 – $200 yr |
Included |
| Dev/Test Environments |
See server and database above |
Included |
| Power/Facility Costs |
$100 – $120/server yr |
Included |
Now that you have calculated the cost of infrastructure, we’ll turn to the cost of managing the underlying platforms to ensure that they stay in compliance with your internal IT practices.
| Operational Support Costs |
| Description |
Traditional Perpetual Model |
Managed Services |
| Database Admin |
$10k – $12k/database |
Included |
| Network Admin |
$1k – $2k/yr |
Included |
| Systems Admin |
$1k – $2k/yr |
Included |
A realistic view of how much time you will need to spend to manage the solution is key. All security solutions require some level of care and feeding as well as an investment in sustaining application knowledge.
When you consider a managed service, that team becomes your application experts, and you can focus your efforts on responding to the information provided versus extracting the key bits for yourself. Expertise in any domain requires experience to develop; managed services teams leverage a breadth of expertise that is very difficult for most companies to acquire.
| Staffing Costs |
| Description |
Traditional Perpetual Model |
Managed Services |
| Security Analyst |
Salary: $102k and up |
*Included |
| Recruiting Fees |
$10k and up |
N/A |
| Staffing Overhead |
27% – 33% of salaries |
*Included |
It’s important to realize that any managed service will require some time from internal resources. Typically, it is dramatically reduced (10-20% of a perpetual deployment), but any managed service that says they can deliver value without talking to you should be questioned.
It is also important to consider how many resources you would need to apply if you were to achieve maximum value from the product. A managed service can improve your ability to use more advanced features of the solution without requiring the burden of more overhead.
Finally, there is the intangible. This may not apply to everyone, but these could be very real scenarios.
| Intangible Costs |
| Description |
Traditional Perpetual Model |
Managed Services |
| Audit Penalties |
Likely if system is not well maintained |
Assets are covered; data is ready when you need it. |
| Staff Attrition |
Looking for more strategic work |
Enables growth for your existing team |
| Missed incidents/alerts |
Likely if system is not well maintained |
Reports contain useful and actionable information. |
Tripwire ExpertOps provides managed File Integrity and Secure Configuration from the cloud with the assurance of a team of experts delivering managed services to customers for nearly a decade.
To learn more about how ExpertOps can help your business,
click here.
