A $1.7 billion market growing at double digits
Gartner's figures place Australian information security and risk management spending at AUD $6.2 billion in 2025, a 14.4% year-on-year increase, forecast to exceed AUD $7.5 billion in 2026. Security services — consulting, professional, and managed security — represent the largest category at approximately AUD $3.48 billion in 2025, growing at 16.1%. The managed security services subset (MSSP, MDR, SOC-as-a-service) is estimated at USD $1.1 billion (approximately AUD $1.7 billion) with a CAGR of 12.07% through 2034, according to IMARC Group.
The Asia-Pacific region is the fastest-growing MDR market globally, expanding at 19% CAGR per Gartner's DataHub Q3 2025 figures. Gartner projects that 60% of organisations are now actively using remote threat disruption and containment services, while a 2025 Barracuda MSP report found 77% of Australian organisations rely on MSPs for security management. The global managed security services market sits at approximately USD $38–43 billion in 2025, projected to reach USD $69–124 billion by 2030–2033.
These numbers reflect structural demand rather than cyclical spending. The Australian Cyber Security Strategy 2023–2030 committed $586.9 million in new investment. Federal government cybersecurity spending is running at approximately $1.8 billion over three years. Cybercrime costs the Australian economy an estimated AUD $33 billion annually. Gartner's 2025 survey found 88% of ANZ CIOs identify cybersecurity as their predominant technology investment priority for the second consecutive year.
The market is not growing because organisations want to spend more. It is growing because the regulatory and threat environment has made doing nothing measurably more expensive than acting.
30,000 unfilled positions and the economics of scarcity
The Australian cybersecurity skills shortage is both severe and structural. ISC2's 2024 Cybersecurity Workforce Study counted 146,481 active cybersecurity professionals in Australia, up 5.5% year-on-year — one of the strongest global growth rates but still far below demand. The ACS Digital Pulse 2025 estimates Australia needs 54,000 additional cybersecurity professionals by 2030, while CyberCX and Per Capita forecast up to 30,000 unfilled positions over the next four years.
ISACA's State of Cybersecurity 2025 paints a particularly stark picture for Australian organisations: 54% of cybersecurity teams are understaffed, 58% report unfilled positions, and 48% say hiring non-entry-level roles takes three to six months. Only 35% of Australian respondents are confident in their team's incident response capabilities. Burnout compounds the problem — 68% of Australian cybersecurity professionals say their role is more stressful than five years ago, and 42% cite high stress as a major driver of attrition.
Jobs and Skills Australia confirmed national shortages across Cyber Security Architect, Cyber Governance Risk and Compliance Specialist, and Cyber Security Operations Coordinator roles in its October 2025 ALMM report, with an average of 621 new job advertisements per month. Employment growth is projected at 14.2% from 2024 to 2029, more than double the national average of 6.6%.
The salary data makes the in-house versus outsourced calculation stark. Based on the e2 Cyber Salary Guide (January 2026), SEEK, Glassdoor, and Robert Half data:
| Role | Typical range (AUD) |
|---|---|
| SOC Analyst (L1) | $60,000 – $100,000 |
| SOC Analyst (L2) | $100,000 – $150,000 |
| Security Engineer | $100,000 – $160,000 |
| Security Architect | $150,000 – $200,000 |
| Incident Response Specialist | $110,000 – $120,000 |
| CISO | $237,000 – $350,000+ |
A minimum viable 24/7 SOC requires eight to ten analysts across shift rotations, a SOC manager, SIEM licensing ($60,000 – $350,000+ per year depending on platform), threat intelligence feeds, training, and infrastructure. The fully loaded annual cost ranges from AUD $3.1 million to $10.9 million. Gartner predicted that by 2025, 33% of organisations that attempted to build an internal SOC would fail due to resource constraints. IBM's 2024 Cost of a Data Breach Report found organisations with severe staffing shortages paid AUD $2.7 million more per breach than those with adequate teams.
Six regulations that demand continuous security operations
Australian regulatory obligations have reached a density that effectively mandates professional security operations. Each framework independently creates pressure toward managed services; together, they form an inescapable case.
When managed security fails: alert forwarding, lock-in, and the context gap
The managed security market is not without serious pitfalls, and Australian buyers must understand what can go wrong before committing to a provider.
Alert fatigue is endemic. A survey of approximately 50 MSSPs by Advanced Threat Analytics found 44% report false-positive rates of 50% or higher, with 22% experiencing rates between 75% and 99%. IDC research found organisations spend an estimated $1.3 million and 21,000 hours annually investigating false alarms. When overwhelmed, 38% of MSSP analysts admit to ignoring certain alert categories entirely, and 27% turn off high-volume alerting features. Enterprise environments routinely generate 10,000-plus alerts daily, with 66% of SOCs unable to keep pace.
The distinction between alert forwarding and genuine detection and response is the single most important evaluation criterion. Many providers labelled as MSSPs or even MDR vendors simply pass raw or minimally processed alerts to the client's internal team — a practice Gartner's 2025 MDR Market Guide explicitly criticises as "misnamed technology-first offerings that fail to deliver human-driven managed detection and response services." The gap between marketing and reality is vast: over 600 providers globally claim MDR capability (Gartner 2025), but genuine MDR requires analyst triage, contextual investigation, containment, and remediation. A Forrester study found organisations using genuine MDR saw 85% fewer breaches than those relying on traditional MSSPs alone.
Vendor lock-in is a persistent risk. MSSPs using proprietary tooling create dependency where SIEM tuning, detection rules, playbooks, and historical data cannot be transferred when switching providers. Data sovereignty is a critical concern for Australian organisations: routing logs through a foreign SOC constitutes a cross-border disclosure under APP 8 of the Privacy Act, and the US CLOUD Act allows US authorities to access data held by US-headquartered companies regardless of physical storage location. OAIC surveys show 74% of Australians consider foreign processing access a misuse of personal information.
Lack of business context remains the Achilles heel of outsourced security. External teams inherently examine the network through a narrow aperture, making severity assessments with limited knowledge of which systems are business-critical, which changes are expected, and which alerts represent genuine risk.
The Medibank breach illustrates this precisely: the company's endpoint detection software generated alerts from August 2022 onward, but these were incorrectly triaged and the breach was not identified until October. Detection tools worked; the security operations process failed. This is exactly the failure mode that well-functioning managed security should prevent — and exactly the failure mode that alert-forwarding providers perpetuate. Learn more about third-party security risk management.
MSP, MSSP, MDR, SOCaaS: what the labels actually mean
The market's taxonomy is confusing by design, as vendors stretch definitions to maximise addressable market. Australian buyers need to understand the operational reality behind each label, not just the marketing copy.
For Australian buyers, labels are unreliable. The questions that matter are: Does the provider actually respond to incidents or merely alert? Is there 24/7 human-staffed analysis from an Australian SOC? Where is data stored and processed? What is the measurable outcome — alerts forwarded, or threats contained?
What it actually costs: managed services versus building internally
Realistic cost benchmarks for Australian mid-market organisations reveal the economic case for managed services clearly:
| Service | Annual cost range (AUD) |
|---|---|
| Managed SOC (24/7 monitoring) | $150,000 – $550,000 |
| MDR (Managed Detection and Response) | $37,000 – $233,000 |
| vCISO (Virtual CISO) | $60,000 – $180,000 |
| Security awareness training | $14,000 – $74,000 |
| Total outsourced security stack | $260,000 – $1,000,000 |
| Equivalent in-house SOC | $3,100,000 – $10,900,000 |
MDR pricing typically runs $10–$30 per endpoint per month (industry consensus across multiple vendors). For a 500-endpoint mid-market organisation, this translates to approximately AUD $116,000–$233,000 per year. Full-stack MDR covering cloud, identity, SaaS, and network telemetry typically doubles endpoint-only pricing. vCISO engagements in Australia start at approximately AUD $5,000 per month for basic advisory, with comprehensive packages at AUD $10,000–$15,000 per month — delivering what providers estimate as 80–90% of full-time CISO value at a fraction of the $250,000–$400,000+ annual salary.
The Australian Cyber Security Growth Network estimates outsourcing SOC functions saves AUD $1.8 million annually on average. IBM's 2025 data shows organisations using managed security services detect breaches 108 days faster, reducing breach costs by $1.76 million. The economic case strengthens further when factoring in IBM's finding that the average Australian data breach now costs AUD $4.26 million — a record high and a 27% increase since 2020.
The co-managed model is emerging as the pragmatic middle ground
Gartner published its Market Guide for Co-Managed Security Monitoring Services in April 2025, identifying more than 500 vendors in this category — a clear signal that co-managed security has moved from niche to mainstream. The guide defines co-managed services as those providing "remote maintenance and monitoring of client-owned threat detection, investigation and response (TDIR) capable platforms," encompassing managed EDR, managed XDR, and managed SIEM.
The co-managed model addresses the fundamental tension between fully outsourced security (which sacrifices business context, control, and institutional knowledge) and fully in-house operations (which most organisations cannot staff or afford). In a co-managed arrangement, the internal team retains strategic decision-making, policy governance, and business context — understanding which systems matter most, which changes are expected, and which alerts require immediate escalation — while the external provider handles 24/7 monitoring, detection engineering, threat hunting, SIEM tuning, and after-hours incident response.
The evidence supports this approach. IBM's data shows internal detection shortens the breach lifecycle by 61 days and saves nearly $1 million compared with attacker-disclosed breaches — arguing for retaining internal capability alongside external monitoring. The OAIC's finding that 74% of Australian Government breaches took more than 30 days to identify demonstrates what happens when detection relies on under-resourced internal teams alone. Co-managed models provide the 24/7 coverage needed to close this gap while preserving the institutional knowledge that external-only models lack.
The model is particularly suited to mid-market organisations with existing small IT or security teams. With 54% of Australian cyber teams understaffed (ISACA 2025), the co-managed approach provides access to specialist expertise — threat hunters, detection engineers, incident responders — that mid-market organisations cannot recruit in a market with a 30,000-person shortfall. It also reduces key-person risk: if a critical internal security team member departs, the co-managed provider ensures continuity.
Australian breaches that prove the case for continuous monitoring
The breach evidence from 2024–2026 is unambiguous. The OAIC recorded 1,113 notifiable data breaches in 2024, the highest since the NDB scheme began, with a further 532 in the first half of 2025. ASD's Annual Cyber Threat Report 2024–25 documented over 1,200 cyber security incidents, an 11% increase, with a particularly alarming finding: 39% of ransomware incidents were discovered by ASD rather than the victim organisations themselves. This single statistic demonstrates a systemic monitoring deficit across Australian organisations.
MediSecure (April 2024) saw 12.9 million Australians' health data compromised through a ransomware attack on an inadequately monitored legacy system. The company lacked resources for proper incident response and went into voluntary administration — unable to afford even individual notifications. The superannuation fund attacks (April 2025) against AustralianSuper, Rest, Australian Retirement Trust, Hostplus, and Insignia Financial exploited credential stuffing against portals lacking mandatory MFA, with $750,000 stolen from ten AustralianSuper members before the pattern was detected. Automated anomaly detection would have flagged the unusual login patterns immediately. HWL Ebsworth (May 2023, investigation ongoing through 2024–2025) saw 1.45TB of data leaked affecting 65 government agencies, illustrating supply chain risk when a third-party organisation holding sensitive data lacks robust security operations.
The financial data is equally compelling. IBM's 2024 report placed the average Australian breach cost at AUD $4.26 million, with detection and escalation costs alone averaging AUD $1.65 million. Australian organisations take 266 days on average to identify and contain incidents — eight days longer than the global average. Organisations not using security AI and automation experience breaches costing AUD $1.74 million more and taking 99 extra days to contain. ASD reported the average self-reported cost of cybercrime for businesses reached $80,850 — a 50% increase — while ransomware attacks on the healthcare sector doubled year-on-year.
How to evaluate a managed cybersecurity provider in Australia
Australian CISOs and CIOs should structure provider evaluation around several non-negotiable criteria.
Data sovereignty is foundational. Determine whether regulatory obligations require data residency (stored in Australia) or data sovereignty (subject to Australian law), map all data flows including subprocessor locations, and verify contractually — not just in sales materials — where logs are stored, processed, and who accesses them. Routing logs through a foreign SOC constitutes a cross-border disclosure under the Privacy Act, and the US CLOUD Act creates exposure for US-headquartered platforms.
Verify 24/7 capability in practice, not on paper. Ask where SOC analysts are physically located during each shift, whether after-hours coverage routes to an offshore follow-the-sun model, and what the staffing ratio looks like at 2am on a weekend. Submit a simulated critical alert outside business hours and measure the actual response. SLAs must define "response" precisely: an automated acknowledgement email and a human analyst picking up the phone are critically different actions. Best-practice benchmarks for critical incidents are response within 15 minutes and containment actions initiated within one hour.
Transparency of tooling determines exit flexibility. Providers using open or commercial platforms (CrowdStrike, Microsoft Sentinel, Splunk) allow organisations to retain operational capability when changing providers; proprietary platforms create lock-in where detection rules, tuning, playbooks, and historical data are lost on exit. Negotiate data portability clauses upfront — they become exponentially harder to negotiate after signing.
For APRA-regulated entities, verify CPS 234 alignment including continuous control monitoring evidence, incident notification workflows, and third-party management documentation. For critical infrastructure operators under the SOCI Act, confirm the provider's CIRMP framework alignment and incident reporting capability within mandated timeframes. For Commonwealth suppliers, IRAP assessment status and Essential Eight maturity alignment are baseline requirements. ASD's ISM (ISM-1793) mandates that managed service providers undergo IRAP assessment at least every 24 months.
The evidence converges on a clear position: for the vast majority of Australian mid-market and enterprise organisations, some form of managed cybersecurity service is no longer optional — it is an operational and regulatory necessity. The critical insight is not simply "outsource security" but "outsource intelligently." The distinction between alert forwarding and genuine detection and response remains the single most consequential evaluation criterion. With AUD $4.26 million as the average breach cost and 266 days as the average detection timeline, the cost of choosing poorly — or not choosing at all — is now precisely quantifiable. Start with a Lighthouse Assessment to understand what your organisation actually needs before buying anything.