MDR vs in-house security team vs co-managed: a decision guide for 20 to 500-person companies
The three models at a glance
| In-house security team | Co-managed | MDR (managed detection and response) | |
|---|---|---|---|
| Who watches alerts | Your own staff | Your IT team plus the provider | The provider's analysts, 24/7 |
| Nights and weekends | Only if you staff shifts | Depends on the agreed scope | Covered |
| Who acts on a threat | Your team | Shared, as written in the runbook | The provider contains first (for example, isolating a computer) and your contact approves bigger steps |
| What you need in-house | Security analysts, a lead, tools, training budget | IT staff who can work with the provider | A named contact who can approve actions |
| Control | Highest | High | You keep the decisions, the provider keeps watch |
| Best fit | Larger or regulated companies that can hire and keep a team | Companies with an IT team but no security specialist | Companies without anyone watching after hours |
| Common trap | One or two people expected to cover every hour | Fuzzy split of duties | Treating it as "set and forget" and not fixing the gaps it reports |
How to decide: five questions
- Who would see an alert at 2 AM on a Sunday today? If the honest answer is "nobody," you need 24/7 coverage, and MDR is the quickest way to get it.
- Do you have IT staff with time for security? If yes, co-managed security lets them stay in charge while someone else tunes the tools and reviews the noise.
- Can you hire and keep security specialists? Covering one seat around the clock takes four to five people (168 hours a week, divided by roughly 40 hours per person), before leave and training. If that isn't realistic, don't plan on in-house 24/7.
- Who has authority to approve containment? Every model needs one named person who can say "isolate that laptop" or "reset that account" quickly. Pick them before you pick a model.
- What do your clients or regulators ask for? Some contracts ask for 24/7 monitoring or incident response readiness. Under the Data Privacy Act, Philippine companies also need a data breach response team (NPC Circular 16-03, Section 5). The Circular allows those functions to be outsourced, but the Data Protection Officer stays accountable.
A simple rule of thumb
- Nobody watching after hours, small or no IT team: MDR.
- Solid IT team, no security specialist: co-managed security, adding 24/7 MDR when you're ready.
- Large or regulated, budget to hire and keep a team: in-house, often with MDR covering nights and weekends.
Before you choose: get the basics right
Monitoring works best on a clean setup. A fixed-scope cyber health check shows which devices are covered, whether every account has MFA, and whether a backup can actually be restored. Then the people watching aren't flooded with noise from problems you could fix once. The free Cyber Health Check workbook lets you run a first pass yourself.
Usap tayo
Tell us how many people and devices you have, and who handles IT today. We'll tell you which model fits and why. Book a free 30-minute call
If something looks wrong right now, go straight to Digital Forensics and Incident Response.
Frequently asked questions
What is the difference between MDR and an in-house security team?
With an in-house team, you hire, train and schedule the people who watch your systems and respond to alerts. With Managed Detection and Response (MDR), a provider's analysts do the watching and first response around the clock, and your team approves the bigger decisions. You keep ownership of the business call either way.
What does co-managed security mean?
Your own IT people and a provider share the work. Usually the provider tunes the tools, reviews alerts and handles escalations, while your team keeps day-to-day control. It suits companies that have IT staff but not a security specialist on every shift.
How many people does 24/7 in-house monitoring take?
More than most owners expect. A week has 168 hours, and one person works about 40 of them, so covering a single seat around the clock takes four to five people before leave, sick days and training. That is the main reason companies under a few hundred people pick MDR or co-managed security.
Can we start co-managed and add 24/7 MDR later?
Yes. Many companies start with co-managed support, clean up their setup and alerts, then add 24/7 MDR when they are ready. Moving up doesn't mean starting over, because the same tools stay in place.
Who runs the 24/7 monitoring when we buy MDR from ARA Industries?
ARA Industries is a registered WithSecure partner. With 24/7 MDR, WithSecure's analysts monitor and investigate around the clock, and ARA Industries is your local point of contact for setup, reports and escalations.
