The best conversation I had this year about setting up an in-house SOC lasted eleven minutes and never touched on money.
The IT director had the budget line approved, the committee's sign-off, the space and even the platform chosen. What he did not have was anyone to hire.
That conversation happens in Mexico more often than people admit in public, and it changes the nature of the decision. For years this was a budget problem. Now it is a labor market problem.
How many specialists are really missing in Mexico?
The number that circulates in presentations is 300,000. It is worth taking it apart before relying on it, because it mixes two different things.
The big figure is regional. The ISC2 workforce study has been measuring a gap on the order of 328,000 professionals for all of Latin America, from Mexico to Chile. It is context, not planning.
The figure for Mexico is smaller and considerably more uncomfortable. In July, figures were published showing a shortfall of more than 77,000 specialists against demand of nearly 85,000 positions. Do the subtraction: the country has about 6,000 trained people to fill eighty-five thousand seats. In the same report, 68% of industrial employers say they cannot find security, artificial intelligence and analytics profiles.
Seventy-seven thousand sounds like less than three hundred thousand. It is worse. Three hundred thousand spread across twenty countries is a regional statistic. Six thousand people for eighty-five thousand jobs is your vacancy, in your city, this quarter.
An approved budget does not hire anyone
A few weeks ago I wrote about the arithmetic of covering the 8,760 hours in a year, and the result was seven people: six shift analysts and one experienced lead. That calculation has not changed.
What changed is that the calculation stopped being the bottleneck.
When there is a supply of talent, the budget rules: if it gets approved, you hire. When there is no supply, the budget is a necessary condition that achieves nothing on its own. You can have all the money and not have the team, and then what you bought was not a security operations center. It was an open vacancy with a console switched on next to it.
What happens in each phase when there is no one to hire?
The comparison between building and hiring is usually made like a snapshot: two cost columns, one decision. It is more useful to view it as a movie, because the staffing problem shows up in the second phase and contaminates everything that follows.
| Phase | In-house SOC | Managed SOC |
|---|---|---|
| Approve (months 0 to 6) | Capital investment: committee, budget cycle, competition with other projects | Operating expense: existing line item, signed off by the department |
| Hire (months 6 to 12) | Seven positions in a market with 6,000 candidates for 85,000 jobs. Night shifts are the last to be filled and the first to empty | Already hired. It is the phase you do not have to live through |
| Fine-tune (months 12 to 24) | 12 to 18 months until detection can tell the unusual from the normal on your network | Weeks of fine-tuning on already proven processes |
| Sustain (year 2 onward) | Real coverage is whoever is available that day, not who is on the org chart | Coverage is defined by contract and does not depend on your payroll |
| Losing someone | A shift becomes uncovered, and the clock from the previous phase resets to zero for that position | It is the provider's problem, and you never hear about it |
Look at the second row. It is the only one in the table that cannot be fixed with money, and it is the one that decides whether the other four ever come to exist.
What happens the day the only person who knows resigns?
This is the question that almost never reaches the committee, and it has a number. In the same ISC2 study, 75% of security professionals see themselves at their company twelve months from now. At two years, the figure drops to 66%.
Translated to a team of seven: one leaves before the first year, two or three before the second. On average, and with luck.
If the person who leaves is the one who knew the network, you did not lose a position. You lost the judgment. The console stays on and the alerts arrive just like yesterday, but the person who knew which of those alerts mattered in this company, and not in any other, is gone. That knowledge took a year to build and was not written down anywhere.
The first thing to disappear when that person leaves is the work that is not reactive. The practice of threat hunting, which means going out to look for what no alert flagged, can only be done by someone who knows how this network behaves when everything is fine. With a half-staffed team, it is the first thing to be dropped, and nobody notices, because it leaves no gap on any dashboard.
The same study measured the consequence, and this is the most serious figure of all: 88% of organizations had at least one significant incident directly attributed to a lack of skills on the team, and 69% had more than one. The shortage of people is no longer a human resources complaint. It is a documented cause of incidents.
Certifications are paid for, and then paid for again
There is a line item that almost never appears in the project table. Security certifications are not bought once: they expire every three years and are renewed with continuing education credits and an annual fee. Multiply by seven people and add the workdays lost to courses and exams.
And it comes with a side effect that is hard to swallow: a certified analyst is, by definition, easier for someone else to recruit. You pay for the certification. Someone else pays for the raise.
Are there still cases where an in-house SOC is the answer?
Yes. There are companies where it is still the right decision, and the difference is not size.
The in-house model works when the company can compete for that talent, not just pay for it. A brand people recognize, a career path within the department, technical work that holds up in an interview, a training budget that does not get cut in August. The 6,000 people who exist have options, and they choose. If your offer competes on equal terms with a bank's, go ahead. If it competes only on salary, you will hire whoever the others did not choose, and for the early-morning shift.
The breakdown of what each model costs, item by item, is in the managed SOC pricing guide for Mexico, and that part still holds.
The middle path, which is the one that ages best
There is a third option that is rarely raised in the first meeting: start managed and train the internal team in parallel, with the provider running operations.
The early-morning shift is covered from the first month, which is the urgent part, and your own people learn on an operation that already works instead of learning at the expense of the first real incident. If in three years the market improves and the company wants to bring it in-house, it does so with proven processes. And if it does not improve, monitoring never depended on a vacancy. This is how we operate the SOC 24/7 with several of our clients in Mexico.
The budget gets approved in a meeting. The team has to be found in a market with six thousand people and eighty-five thousand seats. Of those two things, only one depends on you.
