How do we choose between hiring and buying a service?

Use a capacity model rather than a job title. A continuously occupied seat needs 168 coverage hours per week, before handovers and leave; this is simple calendar arithmetic, not a staffing recommendation. Divide by productive scheduled coverage hours only after HR and operations account for leave, training, management, overtime rules and backup.

For a role you may hire, calculate salary, employer costs, recruitment, equipment, licenses, training, management and vacancy cover. For a service, calculate contracted fees, onboarding, retained internal hours and excluded work. Compare the same schedule and duties.

A single experienced security engineer might improve implementation and ownership more than adding another product. An MDR service might resolve an overnight investigation gap faster than building a full shift system. These are conditional inferences; actual cost and lead time require quotes, hiring-market evidence and an approved operating design.