Skip to main content
Managed Security · Market Intelligence 2025–2026

Managed cybersecurity
services in Australia:
the data-driven
case.

Australia's managed cybersecurity services market is worth approximately AUD $1.7 billion and growing at 12% annually. The organisations driving that growth are not buying managed security because it is fashionable. They are buying it because the alternative — building equivalent capability internally — costs between $3.1 million and $10.9 million per year and requires talent that the market simply cannot supply. Australia has approximately 30,000 unfilled cybersecurity positions. The arithmetic is unambiguous.

This guide assembles the authoritative evidence: market size, the skills shortage, six regulatory frameworks demanding continuous security operations, how the market labels actually work, realistic cost comparisons, the co-managed model, and Australian breach data that makes the stakes concrete. It closes with the evaluation criteria that matter for Australian buyers — not a vendor checklist, but the questions that separate genuine security from monitoring dashboards and invoices.

Written by CISM-certified practitioners and ISO 27001 Lead Implementers who advise Australian organisations on managed security, Lighthouse Assessments, and security strategy.

01 / Market size

A $1.7 billion market growing at double digits

Gartner's figures place Australian information security and risk management spending at AUD $6.2 billion in 2025, a 14.4% year-on-year increase, forecast to exceed AUD $7.5 billion in 2026. Security services — consulting, professional, and managed security — represent the largest category at approximately AUD $3.48 billion in 2025, growing at 16.1%. The managed security services subset (MSSP, MDR, SOC-as-a-service) is estimated at USD $1.1 billion (approximately AUD $1.7 billion) with a CAGR of 12.07% through 2034, according to IMARC Group.

The Asia-Pacific region is the fastest-growing MDR market globally, expanding at 19% CAGR per Gartner's DataHub Q3 2025 figures. Gartner projects that 60% of organisations are now actively using remote threat disruption and containment services, while a 2025 Barracuda MSP report found 77% of Australian organisations rely on MSPs for security management. The global managed security services market sits at approximately USD $38–43 billion in 2025, projected to reach USD $69–124 billion by 2030–2033.

These numbers reflect structural demand rather than cyclical spending. The Australian Cyber Security Strategy 2023–2030 committed $586.9 million in new investment. Federal government cybersecurity spending is running at approximately $1.8 billion over three years. Cybercrime costs the Australian economy an estimated AUD $33 billion annually. Gartner's 2025 survey found 88% of ANZ CIOs identify cybersecurity as their predominant technology investment priority for the second consecutive year.

The market is not growing because organisations want to spend more. It is growing because the regulatory and threat environment has made doing nothing measurably more expensive than acting.

02 / Skills shortage

30,000 unfilled positions and the economics of scarcity

The Australian cybersecurity skills shortage is both severe and structural. ISC2's 2024 Cybersecurity Workforce Study counted 146,481 active cybersecurity professionals in Australia, up 5.5% year-on-year — one of the strongest global growth rates but still far below demand. The ACS Digital Pulse 2025 estimates Australia needs 54,000 additional cybersecurity professionals by 2030, while CyberCX and Per Capita forecast up to 30,000 unfilled positions over the next four years.

ISACA's State of Cybersecurity 2025 paints a particularly stark picture for Australian organisations: 54% of cybersecurity teams are understaffed, 58% report unfilled positions, and 48% say hiring non-entry-level roles takes three to six months. Only 35% of Australian respondents are confident in their team's incident response capabilities. Burnout compounds the problem — 68% of Australian cybersecurity professionals say their role is more stressful than five years ago, and 42% cite high stress as a major driver of attrition.

Jobs and Skills Australia confirmed national shortages across Cyber Security Architect, Cyber Governance Risk and Compliance Specialist, and Cyber Security Operations Coordinator roles in its October 2025 ALMM report, with an average of 621 new job advertisements per month. Employment growth is projected at 14.2% from 2024 to 2029, more than double the national average of 6.6%.

The salary data makes the in-house versus outsourced calculation stark. Based on the e2 Cyber Salary Guide (January 2026), SEEK, Glassdoor, and Robert Half data:

Role Typical range (AUD)
SOC Analyst (L1)$60,000 – $100,000
SOC Analyst (L2)$100,000 – $150,000
Security Engineer$100,000 – $160,000
Security Architect$150,000 – $200,000
Incident Response Specialist$110,000 – $120,000
CISO$237,000 – $350,000+

A minimum viable 24/7 SOC requires eight to ten analysts across shift rotations, a SOC manager, SIEM licensing ($60,000 – $350,000+ per year depending on platform), threat intelligence feeds, training, and infrastructure. The fully loaded annual cost ranges from AUD $3.1 million to $10.9 million. Gartner predicted that by 2025, 33% of organisations that attempted to build an internal SOC would fail due to resource constraints. IBM's 2024 Cost of a Data Breach Report found organisations with severe staffing shortages paid AUD $2.7 million more per breach than those with adequate teams.

03 / Six regulations

Six regulations that demand continuous security operations

Australian regulatory obligations have reached a density that effectively mandates professional security operations. Each framework independently creates pressure toward managed services; together, they form an inescapable case.

APRA CPS 234
In force 1 July 2019
CPS 234 requires all prudential-regulated entities to maintain information security capability "commensurate with the size, changing nature and extent of threats." The standard demands continuous control monitoring, annual testing, and 72-hour incident notification to APRA. In June 2025, APRA issued a strongly worded letter to superannuation trustees citing weak identity and access controls and inadequate third-party oversight, setting a 31 August 2025 hard deadline for compliance demonstrations. The complementary CPS 230 (Operational Risk Management), effective 1 July 2025, adds requirements for material service provider registers and operational resilience. For mid-sized financial institutions, sustaining the continuous monitoring and evidence-based assurance CPS 234 demands is impractical without an MSSP or MDR arrangement.
SOCI Act 2018
Expanded 2021, 2022, 2024
The SOCI Act 2018, expanded through the 2021 and 2022 amendments and the ERP Act 2024 (Royal Assent 29 November 2024), covers 11 sectors and 22 asset classes of critical infrastructure. The Act imposes 12-hour reporting for critical cyber incidents and 72-hour reporting for other incidents — timeframes that presuppose continuous detection capability. Critical Infrastructure Risk Management Program (CIRMP) obligations require entities to demonstrate maturity against recognised frameworks (AESCSF, NIST CSF, ISO 27001, Essential Eight, or C2M2). Ransomware payment reporting under the Cyber Security Act 2024 commenced 30 May 2025 for all SOCI entities.
Privacy Act Reform
Statutory tort June 2025
Privacy Act reform has introduced two transformative changes. The statutory tort for serious invasions of privacy commenced 10 June 2025, enabling individuals to sue organisations for damages up to $478,550 without needing to prove loss. The recklessness threshold means demonstrably negligent security operations could be actionable. Simultaneously, from 1 July 2026, AML-CTF Act reforms will bring lawyers, accountants, real estate professionals, and dealers in high-value goods under Privacy Act coverage, affecting over 100,000 small businesses according to OAIC estimates. Combined with penalties of up to $50 million or 30% of adjusted domestic turnover, the regulatory incentive for robust security operations has never been stronger.
Essential Eight
ML2 mandatory for Commonwealth
The Essential Eight maturity model, mandatory at Maturity Level Two for non-corporate Commonwealth entities, requires critical vulnerability patching within 48 hours, event log analysis for signs of compromise, and continuous operational discipline across all eight strategies. The November 2023 update elevated monitoring requirements significantly — at ML2, event log analysis for internet-facing infrastructure is mandatory, effectively requiring SIEM/EDR capability and analyst resources. These requirements flow to the private sector through government supply chain contracts.
PSPF 2025
Zero trust deadline 1 July 2026
The PSPF 2025 annual release (24 July 2025) formally mandated zero trust architecture across Commonwealth agencies, introducing five Guiding Principles and a new Gateway Security Standard requiring deployment by 1 July 2026. These requirements extend into the private sector through government supplier and partner relationships. Organisations holding government contracts or data must demonstrate alignment with the zero trust framework.
ASD ISM
IRAP every 24 months
ASD's Information Security Manual (ISM) requires that managed service providers undergo IRAP assessment at least every 24 months (ISM-1793). ASD publishes dedicated guidance on managing security when engaging MSPs, including requirements for attributable accounts, MFA on remotely accessible services, contractual incident notification clauses, and minimum six-month log retention. ASD's joint advisory with Five Eyes partners explicitly warns that MSPs are "attractive targets for state actors" and mandates segregated logging, endpoint detection, and monitoring of MSP access.
04 / When it fails

When managed security fails: alert forwarding, lock-in, and the context gap

The managed security market is not without serious pitfalls, and Australian buyers must understand what can go wrong before committing to a provider.

Alert fatigue is endemic. A survey of approximately 50 MSSPs by Advanced Threat Analytics found 44% report false-positive rates of 50% or higher, with 22% experiencing rates between 75% and 99%. IDC research found organisations spend an estimated $1.3 million and 21,000 hours annually investigating false alarms. When overwhelmed, 38% of MSSP analysts admit to ignoring certain alert categories entirely, and 27% turn off high-volume alerting features. Enterprise environments routinely generate 10,000-plus alerts daily, with 66% of SOCs unable to keep pace.

The distinction between alert forwarding and genuine detection and response is the single most important evaluation criterion. Many providers labelled as MSSPs or even MDR vendors simply pass raw or minimally processed alerts to the client's internal team — a practice Gartner's 2025 MDR Market Guide explicitly criticises as "misnamed technology-first offerings that fail to deliver human-driven managed detection and response services." The gap between marketing and reality is vast: over 600 providers globally claim MDR capability (Gartner 2025), but genuine MDR requires analyst triage, contextual investigation, containment, and remediation. A Forrester study found organisations using genuine MDR saw 85% fewer breaches than those relying on traditional MSSPs alone.

Vendor lock-in is a persistent risk. MSSPs using proprietary tooling create dependency where SIEM tuning, detection rules, playbooks, and historical data cannot be transferred when switching providers. Data sovereignty is a critical concern for Australian organisations: routing logs through a foreign SOC constitutes a cross-border disclosure under APP 8 of the Privacy Act, and the US CLOUD Act allows US authorities to access data held by US-headquartered companies regardless of physical storage location. OAIC surveys show 74% of Australians consider foreign processing access a misuse of personal information.

Lack of business context remains the Achilles heel of outsourced security. External teams inherently examine the network through a narrow aperture, making severity assessments with limited knowledge of which systems are business-critical, which changes are expected, and which alerts represent genuine risk.

The Medibank breach illustrates this precisely: the company's endpoint detection software generated alerts from August 2022 onward, but these were incorrectly triaged and the breach was not identified until October. Detection tools worked; the security operations process failed. This is exactly the failure mode that well-functioning managed security should prevent — and exactly the failure mode that alert-forwarding providers perpetuate. Learn more about third-party security risk management.

05 / Service taxonomy

MSP, MSSP, MDR, SOCaaS: what the labels actually mean

The market's taxonomy is confusing by design, as vendors stretch definitions to maximise addressable market. Australian buyers need to understand the operational reality behind each label, not just the marketing copy.

MSP
IT operations focus
A Managed Service Provider delivers broad IT operations — network management, cloud services, helpdesk, patching — with security as an ancillary function. MSPs operate from Network Operations Centres, not Security Operations Centres, and provide baseline controls like antivirus and firewalls without specialist detection or response capability. Security is not their primary competency.
MSSP
Monitoring, not response
A Managed Security Service Provider operates from a dedicated SOC and focuses exclusively on security: 24/7 monitoring, SIEM management, vulnerability scanning, firewall management, and compliance reporting. The critical limitation is that MSSPs primarily focus on prevention and monitoring — they identify issues and generate alerts but generally do not investigate or respond to threats. Response remains the customer's responsibility.
MDR
Detection and response
Managed Detection and Response represents a fundamentally different service model. Gartner's 2025 Market Guide defines three core MDR capabilities: a remotely delivered technology stack enabling real-time detection and active response; 24/7 human-staffed analysis engaging daily with individual customer data; and turnkey SOC functions delivering cyberattack disruption and containment. The critical differentiator is that MDR providers detect and respond — they filter alerts, investigate with human expertise, and take containment actions. Not all MSSPs offer MDR, though many claim to.
SOCaaS
Full SOC on subscription
Security Operations Centre as a Service outsources the entire SOC function — people, processes, and technology — on a subscription basis. It can be fully managed or co-managed, typically including SIEM, SOAR, EDR, threat intelligence, and analyst expertise. SOCaaS is the broadest model; MDR is typically a subset of it, focused on detection and response rather than the full operational governance function.
vCISO
Strategic leadership
A Virtual CISO provides strategic cybersecurity leadership on a fractional basis — security strategy, governance, risk management, board reporting, and compliance oversight. vCISO services complement rather than replace operational services. For organisations without a security executive, a vCISO delivers the governance and strategic direction that operational teams lack. Most mid-market organisations need both vCISO and MDR/SOCaaS services.
Managed XDR
Extended telemetry
Managed Extended Detection and Response combines MDR analyst services with an XDR technology platform integrating telemetry across endpoints, networks, cloud, email, and identity. It provides broader visibility than endpoint-only MDR and is increasingly the default for organisations with complex hybrid environments. Full-stack Managed XDR covering cloud, identity, SaaS, and network telemetry typically doubles endpoint-only MDR pricing.

For Australian buyers, labels are unreliable. The questions that matter are: Does the provider actually respond to incidents or merely alert? Is there 24/7 human-staffed analysis from an Australian SOC? Where is data stored and processed? What is the measurable outcome — alerts forwarded, or threats contained?

06 / Cost comparison

What it actually costs: managed services versus building internally

Realistic cost benchmarks for Australian mid-market organisations reveal the economic case for managed services clearly:

Service Annual cost range (AUD)
Managed SOC (24/7 monitoring)$150,000 – $550,000
MDR (Managed Detection and Response)$37,000 – $233,000
vCISO (Virtual CISO)$60,000 – $180,000
Security awareness training$14,000 – $74,000
Total outsourced security stack$260,000 – $1,000,000
Equivalent in-house SOC$3,100,000 – $10,900,000

MDR pricing typically runs $10–$30 per endpoint per month (industry consensus across multiple vendors). For a 500-endpoint mid-market organisation, this translates to approximately AUD $116,000–$233,000 per year. Full-stack MDR covering cloud, identity, SaaS, and network telemetry typically doubles endpoint-only pricing. vCISO engagements in Australia start at approximately AUD $5,000 per month for basic advisory, with comprehensive packages at AUD $10,000–$15,000 per month — delivering what providers estimate as 80–90% of full-time CISO value at a fraction of the $250,000–$400,000+ annual salary.

The Australian Cyber Security Growth Network estimates outsourcing SOC functions saves AUD $1.8 million annually on average. IBM's 2025 data shows organisations using managed security services detect breaches 108 days faster, reducing breach costs by $1.76 million. The economic case strengthens further when factoring in IBM's finding that the average Australian data breach now costs AUD $4.26 million — a record high and a 27% increase since 2020.

07 / Co-managed model

The co-managed model is emerging as the pragmatic middle ground

Gartner published its Market Guide for Co-Managed Security Monitoring Services in April 2025, identifying more than 500 vendors in this category — a clear signal that co-managed security has moved from niche to mainstream. The guide defines co-managed services as those providing "remote maintenance and monitoring of client-owned threat detection, investigation and response (TDIR) capable platforms," encompassing managed EDR, managed XDR, and managed SIEM.

The co-managed model addresses the fundamental tension between fully outsourced security (which sacrifices business context, control, and institutional knowledge) and fully in-house operations (which most organisations cannot staff or afford). In a co-managed arrangement, the internal team retains strategic decision-making, policy governance, and business context — understanding which systems matter most, which changes are expected, and which alerts require immediate escalation — while the external provider handles 24/7 monitoring, detection engineering, threat hunting, SIEM tuning, and after-hours incident response.

The evidence supports this approach. IBM's data shows internal detection shortens the breach lifecycle by 61 days and saves nearly $1 million compared with attacker-disclosed breaches — arguing for retaining internal capability alongside external monitoring. The OAIC's finding that 74% of Australian Government breaches took more than 30 days to identify demonstrates what happens when detection relies on under-resourced internal teams alone. Co-managed models provide the 24/7 coverage needed to close this gap while preserving the institutional knowledge that external-only models lack.

The model is particularly suited to mid-market organisations with existing small IT or security teams. With 54% of Australian cyber teams understaffed (ISACA 2025), the co-managed approach provides access to specialist expertise — threat hunters, detection engineers, incident responders — that mid-market organisations cannot recruit in a market with a 30,000-person shortfall. It also reduces key-person risk: if a critical internal security team member departs, the co-managed provider ensures continuity.

08 / Breach evidence

Australian breaches that prove the case for continuous monitoring

The breach evidence from 2024–2026 is unambiguous. The OAIC recorded 1,113 notifiable data breaches in 2024, the highest since the NDB scheme began, with a further 532 in the first half of 2025. ASD's Annual Cyber Threat Report 2024–25 documented over 1,200 cyber security incidents, an 11% increase, with a particularly alarming finding: 39% of ransomware incidents were discovered by ASD rather than the victim organisations themselves. This single statistic demonstrates a systemic monitoring deficit across Australian organisations.

MediSecure (April 2024) saw 12.9 million Australians' health data compromised through a ransomware attack on an inadequately monitored legacy system. The company lacked resources for proper incident response and went into voluntary administration — unable to afford even individual notifications. The superannuation fund attacks (April 2025) against AustralianSuper, Rest, Australian Retirement Trust, Hostplus, and Insignia Financial exploited credential stuffing against portals lacking mandatory MFA, with $750,000 stolen from ten AustralianSuper members before the pattern was detected. Automated anomaly detection would have flagged the unusual login patterns immediately. HWL Ebsworth (May 2023, investigation ongoing through 2024–2025) saw 1.45TB of data leaked affecting 65 government agencies, illustrating supply chain risk when a third-party organisation holding sensitive data lacks robust security operations.

The financial data is equally compelling. IBM's 2024 report placed the average Australian breach cost at AUD $4.26 million, with detection and escalation costs alone averaging AUD $1.65 million. Australian organisations take 266 days on average to identify and contain incidents — eight days longer than the global average. Organisations not using security AI and automation experience breaches costing AUD $1.74 million more and taking 99 extra days to contain. ASD reported the average self-reported cost of cybercrime for businesses reached $80,850 — a 50% increase — while ransomware attacks on the healthcare sector doubled year-on-year.

09 / How to evaluate

How to evaluate a managed cybersecurity provider in Australia

Australian CISOs and CIOs should structure provider evaluation around several non-negotiable criteria.

Data sovereignty is foundational. Determine whether regulatory obligations require data residency (stored in Australia) or data sovereignty (subject to Australian law), map all data flows including subprocessor locations, and verify contractually — not just in sales materials — where logs are stored, processed, and who accesses them. Routing logs through a foreign SOC constitutes a cross-border disclosure under the Privacy Act, and the US CLOUD Act creates exposure for US-headquartered platforms.

Verify 24/7 capability in practice, not on paper. Ask where SOC analysts are physically located during each shift, whether after-hours coverage routes to an offshore follow-the-sun model, and what the staffing ratio looks like at 2am on a weekend. Submit a simulated critical alert outside business hours and measure the actual response. SLAs must define "response" precisely: an automated acknowledgement email and a human analyst picking up the phone are critically different actions. Best-practice benchmarks for critical incidents are response within 15 minutes and containment actions initiated within one hour.

Transparency of tooling determines exit flexibility. Providers using open or commercial platforms (CrowdStrike, Microsoft Sentinel, Splunk) allow organisations to retain operational capability when changing providers; proprietary platforms create lock-in where detection rules, tuning, playbooks, and historical data are lost on exit. Negotiate data portability clauses upfront — they become exponentially harder to negotiate after signing.

For APRA-regulated entities, verify CPS 234 alignment including continuous control monitoring evidence, incident notification workflows, and third-party management documentation. For critical infrastructure operators under the SOCI Act, confirm the provider's CIRMP framework alignment and incident reporting capability within mandated timeframes. For Commonwealth suppliers, IRAP assessment status and Essential Eight maturity alignment are baseline requirements. ASD's ISM (ISM-1793) mandates that managed service providers undergo IRAP assessment at least every 24 months.

The evidence converges on a clear position: for the vast majority of Australian mid-market and enterprise organisations, some form of managed cybersecurity service is no longer optional — it is an operational and regulatory necessity. The critical insight is not simply "outsource security" but "outsource intelligently." The distinction between alert forwarding and genuine detection and response remains the single most consequential evaluation criterion. With AUD $4.26 million as the average breach cost and 266 days as the average detection timeline, the cost of choosing poorly — or not choosing at all — is now precisely quantifiable. Start with a Lighthouse Assessment to understand what your organisation actually needs before buying anything.

Managed security

Know what
you actually
need,
before you buy it.

The Cliffside Lighthouse Assessment gives you an independently verified picture of your security posture and an honest view of which managed services will reduce your risk, which are redundant given your current controls, and what your regulatory obligations actually require. No vendor pitch. No lock-in. Transferable report.

What you get from the Lighthouse Assessment
  • Independently verified evaluation of your current security posture
  • Honest gap analysis across monitoring, governance, and compliance obligations
  • Recommendation on which managed services address your actual risk profile
  • Cost-benefit framing against your specific regulatory obligations
  • Transferable report, yours to use with any provider or share with your board