30-second overview
Your security operations model determines who monitors threats, investigates incidents, maintains the platform and authorises response actions. An in-house model gives the organisation direct operational control but requires sustained investment in people, processes and technology. Co-management adds specialist capacity while retaining selected responsibilities internally. A fully managed service assigns defined operational activities to a provider while the organisation retains accountability for risk, governance and authorised response decisions.
Choose the operating model before selecting or expanding the technology: decide how security operations will run, which responsibilities the organisation will retain and which it will share with or assign to a provider.
For further guidance, request a complimentary scoping call with Lumen security specialists.
How security operating models evolve
A board member asks: “If a material cyber incident occurred outside business hours, how quickly could we detect and contain it, who would make the critical decisions and how would we know that the response worked?”
The security leader can describe the platforms, providers and teams involved. The more demanding question is whether the operating model consistently provides the required coverage, control and accountability.
This complexity rarely results from one decision. Tools are added to address emerging threats, services close individual gaps, and responsibilities spread across internal teams, technology providers and security partners. Each decision can make sense at the time. Together, these decisions can create an operating model that is harder to sustain, govern and measure.
The operating model establishes how security operations will run and which responsibilities the organisation will retain, share or assign to a provider.
This guide examines three broad routes:
- build the capability in-house;
- co-manage it with a specialist partner; or
- use a fully managed service.
Each route can support broadly similar security objectives when appropriately designed, resourced and governed. The routes differ in how control, specialist capacity, coverage and operational responsibilities are allocated, while accountability for risk and governance remains with the organisation.
Why the operating model matters
According to a 2025 IDC InfoBrief sponsored by Lumen, “detection dominates the top gaps of an organisation’s cybersecurity program, especially early threat detection as well as detection of more advanced threats. The next top two gaps include hiring and retaining cybersecurity talent and ensuring visibility across a growing attack surface.” Addressing these gaps can support improvements in cybersecurity programmes, depending on implementation and organisational circumstances.
| 42% Detection | 37% Talent | 34% Visibility |
| Real-time monitoring and threat detection are the primary gaps in cybersecurity programs.1 | Hiring and retaining skilled cybersecurity professionals remains a critical challenge.1 | Maintaining visibility across expanding attack surfaces is crucial for effective security.1 |
Together, these findings identify three operating requirements to examine when comparing an in-house, co-managed or fully managed model: detection capability, access to specialist talent and visibility across the expanding attack surface.
Set the destination before choosing the route
Before comparing operating models, define what the security capability is intended to deliver.
Define the required operating outcomes before considering the size or composition of the toolset. The operating model should:
- support earlier threat detection;
- prioritise risks according to defined business and security criteria;
- correlate relevant security events to provide additional investigative context;
- apply relevant global threat intelligence in accordance with applicable Asia-Pacific policies, regulatory requirements and organisational controls;
- provide role-relevant information to analysts, security leaders and business stakeholders; and
- combine AI-assisted analysis with human expertise and oversight, where appropriate.
These objectives provide consistent criteria for considering each route and keep the decision focused on organisational requirements rather than product features.
Start with a realistic readiness check
Examine the operational pressures already shaping the security capability. The answers can reveal operating-model requirements that a technology demonstration alone does not address.
| Area | Ask Yourself | Signals to Consider |
|---|---|---|
| Alert activity | How much alert activity must the security team investigate, and how much results in confirmed incidents? | Analysts spend significant time reviewing alerts that do not result in confirmed incidents. |
| Staffing and skills | How is the required monitoring coverage maintained, and what are the main hiring, retention and training considerations? | Maintaining the required coverage depends on a small number of individuals. |
| Integration | How many security tools contribute data to monitoring and investigation workflows, and where do manual steps remain? | Tuning security platforms and maintaining integrations require recurring operational effort. |
| Cost and scale | Which requirement is growing fastest: staffing, tools or storage? | Rising personnel or technology costs make it more difficult to expand the capability sustainably. |
| Current model | How are monitoring, investigation, escalation and response responsibilities managed today? | Stakeholders provide inconsistent explanations of what is covered, what is not covered and where accountability sits. |
Three leaders, three routes
Three security leaders can pursue broadly similar objectives through different operating models because their resources, responsibilities and governance requirements differ. The following scenarios are fictional illustrations of operating-model choices, not customer case studies or testimonials.
Route one: Jane builds in-house
Jane is the CISO of a large security team responsible for talent, 24/7 coverage, governance, platform operations and cost. She wants direct control over technology, workflows and response.
An in-house model can suit an organisation with distinctive requirements, mature processes and sufficient resources to sustain and improve the capability.
Her organisation must recruit and retain specialists, maintain coverage, operate its platforms and adapt as its environment and relevant threats change.
Automation and AI-assisted capabilities can support event analysis and orchestration, while experienced analysts oversee critical decisions.
Jane’s organisation must determine whether it can sustain and improve the capability without platform administration displacing investigation, threat hunting and other security priorities.
Considerations for the build route
✅ Can the organisation recruit and retain the expertise it needs?
A sustainable approach to recruiting, developing and retaining specialist skills are the evidence to look for despite normal staff turnover.
✅ Can the organisation maintain the required coverage?
Coverage that does not depend disproportionately on a small number of individuals.
✅ Can the organisation continuously tune the environment?
Evidence that tuning is sustained alongside investigation and threat hunting without consistently displacing those activities.
Route two: Alicia co-manages
Alicia is a Security Director whose internal team holds valuable organisational knowledge and retains responsibility for strategy, governance and selected response decisions. She needs additional specialist capacity and coverage.
A co-managed model can preserve that internal context while a specialist provides agreed capabilities such as monitoring, investigation support, threat intelligence or platform expertise.
This can free internal analysts to focus on work requiring organisational knowledge, provided responsibilities are deliberately assigned rather than informally assumed.
Without clear ownership, handovers require additional coordination and teams can interpret platform-tuning responsibilities differently.
Alicia’s turning point is agreeing responsibilities, escalation paths and decision rights before an incident occurs.
Considerations for the co-managed route
✅ Which activities remain internal, and which are assigned to the provider?
A documented responsibility model that both teams understand and can apply consistently.
✅ Who validates critical decisions and authorises response actions?
Named decision rights agreed before an incident occurs.
✅ How are investigations transferred, escalated and closed?
Defined handover and escalation paths, with an accountable party identified at each agreed stage.
✅ How are investigations transferred, escalated and closed?
A clearly accountable party for each responsibility, with the allocation reviewed at agreed intervals.
Route three: Kim uses a fully managed service
Kim is a CISO with limited internal resources who needs specialist expertise and sustainable coverage without adding a heavy day-to-day management burden.
A fully managed service can provide established processes, specialist skills and threat intelligence without requiring every component to be built internally.
The provider takes on defined operational responsibilities within the agreed scope, while Kim’s organisation retains accountability for security risk, governance and authorised response decisions.
Kim needs clearly defined coverage, priorities, escalation paths, approval points and service boundaries, supported by sufficient investigation information and reporting to maintain oversight.
Kim’s turning point is selecting a service that assumes agreed operational responsibilities without weakening organisational visibility.
Considerations for the fully managed route
✅ Will the model provide the coverage the organisation requires?
Coverage terms that reflect the organisation’s operating requirements and risk profile.
✅ Is ownership clear for investigations, escalation and outcomes?
Service boundaries, approval points and retained responsibilities are documented and understood.
✅ Can the provider demonstrate how an incident is investigated?
Documented investigation processes showing how related events are correlated to develop an evidence-based view of potential attack activity.
Reality check: does the current operating model still fit your requirements?
Many organisations combine elements of several approaches. Use this checklist to identify signals that the current operating model needs review.
☑ Activity is visible, but its relationship to outcomes is unclear
Establish a clearer connection between operational activity and the organisation’s defined security outcomes.
☑ Experienced people spend significant time on upkeep
Review whether maintenance work is crowding out investigation, threat hunting and other priorities.
☑ Investigations require additional coordination during handovers
Clarify handover processes, escalation paths and ownership.
☑ Accountability is not explained consistently
Document responsibilities and processes so that accountability does not depend on individual knowledge.
A practical test: Can stakeholders consistently explain how overnight monitoring is managed, what falls outside the agreed coverage and who holds the relevant decision rights? If answers vary, review the operating model, responsibility boundaries and decision rights.
Choose the operating model that fits your requirements
Evaluate each route against evidence of risk reduction, detection and response performance, operational accountability and business resilience.
The same 2025 IDC InfoBrief sponsored by Lumen states that “As organisations plan to strengthen their cybersecurity infrastructure, the top security outcomes are risk reduction and faster time to detect/ respond to attacks. When communicating cybersecurity investment to stakeholders, use the narrative of primary security outcomes and supporting benefits.”1
Returning to the board member’s question, no single operating model suits every organisation. The right route—building in-house, co-managing with a specialist or using a fully managed service—should align with the organisation’s required outcomes, resources, risk profile and governance requirements. In every model, clear responsibilities, decision rights and oversight are essential.
Discuss your security operations model
A scoping conversation with Lumen security specialists can help you assess coverage requirements, priorities and responsibility boundaries, and consider whether Lumen Defender℠ Advanced Managed Detection and Response aligns with a co-managed or fully managed approach.
About Lumen DefenderSM AMDR
Lumen Defender℠ Advanced Managed Detection and Response is a managed security service that provides continuous threat monitoring, detection, investigation and response within the agreed service scope through Lumen security operations. Depending on the selected platform and service package, Lumen can deliver fully managed or co-managed operations, supported by threat intelligence and defined escalation and response processes.2
Sources
1IDC InfoBrief, sponsored by Lumen, The New Cybersecurity Equation: Risk, Response, and Business Outcomes (Doc #US53083025, February 2025)
2 Response actions are subject to the agreed authorisation arrangements and retained customer responsibilities.
The cited InfoBrief reports an October 2024 survey of 260 US cybersecurity decisionmakers, published in February 2025. These historical US findings should not be treated as representative of APAC organisations or as evidence of results achieved using Lumen services. Percentages and descriptions should be read in the context of the research methodology and respondent base set out in the source.
This content is provided for informational purposes only and may require additional research and substantiation by the end user. In addition, the information is provided “as is” without any warranty or condition of any kind, either express or implied. Use of this information is at the end user’s own risk. Lumen does not warrant that the information will meet the end user’s requirements or that the implementation or usage of this information will result in the desired outcome of the end user. This document represents Lumen products and offerings as of the date of issue.
Services not available everywhere. Business customers only. Lumen may change or cancel products and services or substitute similar products and services at its sole discretion without notice. ©2026 Lumen Technologies. All Rights Reserved.
Questions about Lumen service? Email apac.mail@lumen.com or call +65 6037 9100 or +61 1300 240 161
