GUIDE · SECURITY
Managed security vs in-house: the cost at 20 people
For the person at a 20-person SaaS or e-commerce team asked to compare managed security vs in-house and fit the answer on one slide. It prices the first hire properly, sets out what the first 18 months of coverage should contain, and names the gap neither option pays for. Every figure is a market range with its caveat, not a quote.
The short answer. At 20 people the real choice is not hiring a security engineer. It is buying the boring coverage — patching, backups, access reviews, logging — and keeping one person accountable for the decisions. A senior security hire is rarely the first dollar well spent at this size, because most of the work is maintenance, not research.
What does a first security hire actually cost at 20 people?
Salary is the smallest line on the page. Loaded with benefits, tools, training, management time and ramp, a first security engineer in the US costs about $175,000 to $290,000 a year — $15,000 to $24,000 a month — before they close a single finding.
Base pay for three to six years, at the depth needed to work alone, runs about $130,000–$180,000 in the US. The Bureau of Labor Statistics' occupational data is the public anchor; treat any single survey figure as a quote. UK bands run £65,000–£95,000, Canada C$105,000–C$150,000 and Australia A$130,000–A$180,000.
You also need someone to cover their holidays. Ramp is the other cost: three to six months before the hire is useful, nine to twelve before they own a program.
| Cost line | Annual figure (US) | What it covers |
|---|---|---|
| Base salary | $130,000–$180,000 | Three to six years, able to work alone |
| Employer overhead | 25–40% of base | Benefits, payroll tax, insurance, pension match |
| Tools and licenses | $12,000–$36,000 | EDR, log storage, cloud posture, scanner, password manager |
| Training | $2,000–$6,000 | Plus five to ten days out of the office |
| Management time | 100–200 hours | Two to four hours a week from a founder |
| Fully loaded, year one | $175,000–$290,000 | $15,000–$24,000 a month before a control improves |
US estimates; other markets shift the mix but not the shape. Add $12,000–$36,000 a year if you buy contractor cover for holidays.
What does a 20-person company actually need in the first 18 months?
Not a program. Nine controls, ranked by risk reduced per dollar. Most cost hours, not money, and none needs a security engineer to own it — just a calendar and someone who keeps it. The list follows the NIST Cybersecurity Framework and CISA's cybersecurity best practices.
- MFA, then SSO. Email, identity, hosting, DNS, registrar and code host. SSO costs $3–$8 per user a month and removes most shared passwords.
- Patching cadence. Internet-facing systems on a fixed window, deferrals written down, two to four hours a month. The OWASP Top Ten beats a scanner's severity count.
- Backups with a restore test. One timed restore a quarter, written down. An untested backup is a hope.
- Asset inventory. Domains, hosts, repositories, SaaS accounts and data stores, each with an owner. A spreadsheet is enough.
- Access reviews and offboarding. Quarterly admin review, same-week leaver checklist. Departed accounts are the quietest finding.
- Logging someone reads. Authentication and cloud audit logs, checked weekly. Unread logs are storage.
- Endpoint posture. Disk encryption, screen lock, updates and EDR on every laptop, about $5–$12 per device a month.
- Vendor review. A short questionnaire and a named owner for every tool with customer data or OAuth access.
- An incident runbook. One page: who calls whom, how to isolate a host, who talks to customers, where the insurer sits.
If you only do five, do the first five. They close the cheapest routes in and the most expensive ways to lose data.
The four routes
What does each route cost a month, and who owns the 2am call?
Cash is the easy column. The last two decide whether the route survives a bad week.
| Route | Monthly cost | Coverage hours | Response time | Who owns incidents | Not covered |
|---|---|---|---|---|---|
| In-house hire | $15,000–$24,000 loaded | About 40 a week, business hours | Same day when awake; none contracted | Your hire, alone | Holidays, sickness, 2am, AppSec or detection depth, an audit opinion |
| Part-time contractor | $1,500–$6,000 | 10–25 a month | 1–3 business days, contract-dependent | The contractor, while engaged | Monitoring between visits, out-of-hours, continuity if they leave |
| Managed retainer | $500–$3,000 | 2–10 a month plus monitoring | 4 business hours to 2 business days | The provider owns the queue; you own the decisions | Architecture reviews, your SOC 2 story, custom app code, 24/7, regulatory accountability |
| Nothing (accepted risk) | $0 cash; the cost arrives as an incident | None | Whoever notices, often a customer or your host | You, informally | Everything: patching, backups, access, logging, vendor review |
Market ranges for a 20-person company, US dollars. Independent specialists bill $100–$200 an hour.
The last row is not free; it is unpriced. The invoice arrives as a customer email or a rebuild week.
Where does each option leave a gap?
Both routes leave a hole. The mistake is buying the option that covers the work you can see.
The retainer gap
A provider covers recurring work against a written scope. It will not sit in your architecture review or be in the room when you pick a payment provider. It cannot own your SOC 2 narrative — that is a set of management assertions about your company. Ask a retainer to own it and you get a template back.
The in-house gap
One security hire is a program with no deputy. They take leave, they get sick, they leave — and the access map and context leave with them. One person also cannot be a detection engineer, an AppSec reviewer, a cloud architect and a compliance lead at once.
The hybrid most teams land on
Keep one named internal owner — CTO, engineering lead or operations manager — with two to four hours a month for decisions and sign-off. Buy the recurring coverage, and specialist depth by the day.
The split: two to four internal hours a month, four to ten retainer hours, one specialist review a year. The internal person needs authority, not expertise.
Five questions to ask a managed provider
Ask these before price. Failing answers show where the contract stops.
1. Who responds at 2am, and what can they do?
Fails if it is "our 24/7 SOC" with no named escalation path and no authority to isolate a host, or "email us in the morning".
2. What is the SLA in business hours, and from what event?
Fails if it is "24 hours" with no defined start. Ticket creation, acknowledgement and start of work are three clocks. Fails again if the contract says "best efforts".
3. Is the report templated, and can I see last month's?
Fails if they will not send a redacted sample, or it is a scanner export with severity counts and no owner. A report you cannot forward is a report you paid for twice.
4. What is excluded from the retainer?
Fails if the answer is "everything is included" or "unlimited". Unlimited hours means undefined hours, and undefined hours means the queue decides. Look for a short exclusion list and an overage rate.
5. Who holds the credentials, and how are they revoked?
Fails if there is a shared admin login, a password in a document, or "we keep a copy". Look for named accounts, MFA and a written revocation window.
What does Keelpost cover, and what is excluded?
We are a small studio, not a security operations center. Support runs 09:00–18:00 GMT+8, Monday to Friday. We do not monitor overnight or run a 24/7 SOC, and we say so up front.
We do not sell compliance certification either. Keelpost does not hold ISO 27001 or SOC 2. We can document controls, but we cannot be an audit opinion.
Our offer is narrower than the retainer row above. Care plans start at $129 a month for one hour and a two-business-day response, $249 for two hours and one business day, $449 for four hours and four business hours. The care plan table lists every limit. A one-off audit from $490 covers one site and delivers a PDF plus a plain-English summary. Access is revoked within 30 days of project close.
Not included: 24/7 monitoring, code review of your product, cloud architecture design, legal or DPO advice, and certification. If a customer needs a named in-house security lead, a retainer will not satisfy them.
Our own access and data handling is on the trust page. If you already have the internal owner, see what a care plan covers, or how to answer a security questionnaire without overstating it.
Weighing a penetration test against a vulnerability scan? The difference is scope and cost. To see a redacted report first, ask for a sample.
FAQ
Questions buyers ask before they email
Is managed security cheaper than hiring a security engineer?
Can a managed provider replace an in-house security engineer?
Do we still need someone internal if we buy a care plan?
What should a managed security retainer include at 20 people?
Is a $129/month plan real security or just maintenance?
Keep reading
The next question buyers ask
Security
Pentest vs Vulnerability Scan
The practical difference between a vulnerability scan, a security audit and a penetration test: depth, evidence, market cost and when to buy each.
Read the guideTrust
Vendor Security Questionnaire
The 12 questions enterprise buyers ask small vendors, the answers that pass review, and how to prepare evidence before the questionnaire arrives.
Read the guideNEXT STEP
Put the coverage in place before the next questionnaire.
Send the stack, team size and deadline. We will tell you what is included, what is not, and what it costs.