Managed cyber security, in its fullest sense, is renting the entire security function: not one service off the menu but the whole department, the tooling choices, the watching, the response, the patching discipline, and often the advisory voice that says what to do next. For a small organisation this is frequently the honest description of what is being bought, because there is no internal security anything, and the provider is not supplementing a function but constituting it. Renting a whole function works, payroll and bookkeeping prove it daily, but it works under two conditions those trades learned long ago: the tenant keeps the decisions, and the tenant keeps the records. Applied to security: risk decisions stay yours, and the written programme stays yours. This guide walks what full-function managed cyber security should include, the failure pattern when the two conditions are skipped, and the practical division of labour that keeps a rented function from becoming a rented judgement.
What the whole function includes
A complete arrangement covers five layers: governance, an annual risk conversation producing decisions you sign; architecture, the choice and configuration of tooling from endpoints to mail to backup; operations, the daily watching, patching and triage; response, the practised procedure with the provider's team executing; and reporting, monthly evidence plus an annual review against the programme. Most contracts sell layers three and four convincingly, gesture at five, and skip one and two, which is precisely backwards: operations without governance is motion without direction, and the buyer cannot tell whether the motion fits.
The failure pattern, and its early sign
The pattern: eighteen months in, the organisation cannot answer what standard its own security meets, because every artefact, the policies, the risk register, the procedures, was produced by the provider, in the provider's template, stored in the provider's portal. Exit becomes re-constitution from scratch; the insurer's questionnaire becomes a relay race through a third party. The early sign is small and reliable: ask to see your own incident response procedure, and time how long the answer takes and whose letterhead it arrives on. Function rented, judgement and records surrendered, is the whole failure in one sentence.
The division that keeps it yours
Keep two things in-house whatever else is rented. The decisions: the annual risk conversation ends in choices, what is accepted, what is insured, what is spent, signed by the owner, on your paper. And the programme: the policy set, the procedures and their review dates live in your own system, generated from your own answers, executed by the provider but owned by you. That is exactly the seam Hardenvo Pro serves: the free sheet counts the set your facts call for, the paid plan generates and dates the documents, and the provider works from a programme that survives them. Rent the function; keep the constitution.
Questions people ask about managed cyber security
What is managed cyber security?
In full: the entire security function rented from a provider, governance conversations, tooling, daily operations, response and reporting. For most small organisations this is the honest description, since the provider constitutes the function rather than supplementing it.
What are the risks of fully managed cyber security?
Surrendered judgement and surrendered records: decisions defaulting to the vendor, and every policy and procedure living in the vendor's template and portal, making exit a re-constitution. The early test: ask for your own incident procedure and see whose letterhead answers.
What should stay in-house?
Risk decisions, signed by the owner, and the written programme, policies and procedures generated from your own answers in your own system. The free sheet counts the set; the paid plan keeps it generated, dated and exportable, whoever executes it.