Organizations that decide they need continuous security monitoring generally start by scoping an internal team. The exercise is worth doing carefully, because the staffing arithmetic is less intuitive than it looks and it usually changes the answer.
The arithmetic
Continuous coverage means three shifts, every day, all year. Accounting for leave, sickness, training and turnover, sustaining that with any redundancy requires roughly eight to ten analysts — not the three or four that a naive shift calculation suggests.
Then add the roles that make monitoring effective rather than merely present: someone to tune detection rules, someone to lead incident response, someone to manage the platform. And add the retention problem, which in this market is significant. Trained analysts are scarce and mobile, and a team that loses two people simultaneously is not degraded, it is offline.
What the build case buys
Genuine advantages, worth naming. Deep context about your environment, so an analyst recognizes what is normal for your systems. Direct control over escalation. No boundary problem between detection and response. And institutional knowledge that compounds.
For large organizations with sustained volume and the ability to retain staff, an internal capability is often correct. Below that threshold it tends to produce a team that is permanently understaffed and a platform that is permanently under-tuned.
The middle path most organizations land on
A hybrid split: outsourced monitoring and triage for continuous coverage, with a small internal function owning context, response authority and vendor management.
This works where the boundary is defined precisely. The failure mode is ambiguity — an alert that the provider considers escalated and the client considers unactioned. Which makes the contract the important artefact: what is monitored, what triggers escalation, to whom, in what time, and what the provider is authorized to do without waiting for approval.
That last point is where most managed detection arrangements underperform. A provider who can detect but not act is a notification service, and at three in the morning the difference matters.