Internal expertise vs. managed security