I think fully outsourcing it really abdicates your responsibilities. There has been a long line of companies like Sony that outsourced their security and then

I think fully outsourcing it really abdicates your responsibilities. There has been a long line of companies like Sony that outsourced their security and then discovered that means they have no in-house ability to respond, evaluate or supervise that outsourcing. And to be painfully honest, it also encourages coverups and lying on reports. As a security engineer at another vendor who has worked with these MSPs and their clients I have seen a lot of things that went sideways and the MSP wants to cover it up and it makes responding to an incident really hard.