Ask five companies what their security organization looks like and you'll get five different answers: a CISO with forty people, one engineer doing security alongside everything else, or an MSP and an annual penetration test. None of those is automatically wrong. Security scales with the business — the right org for 30 people would be malpractice at 3,000, and the 3,000-person structure would sink a company of 30.
This post walks through what the security function looks like at each stage, when to make the first dedicated hire, and how to build the org from there.
What a security org actually owns
Before org charts, the functions. Whether you're 20 people or 20,000, the security org — whatever form it takes — owns the same five jobs:
- Governance and risk: policies, risk decisions, compliance obligations, answering to customers, insurers and regulators
- Security operations: monitoring, vulnerability management, watching the alerts
- Engineering: identity, secure configuration, security tooling, helping IT and developers build things safely
- Incident response: the plan and the muscle for when something goes wrong
- Awareness: training people and testing them
At 30 people these are hats, not departments — but they still need to be worn by someone with a name. Most security failures in small companies aren't tool failures; they're ownership failures. "Who owns security?" should always have a one-name answer.
Under 50 employees: security as a part-time hat
At this size, security is typically the IT lead or an MSP covering the fundamentals — MFA, patching, backups, email filtering — alongside their day job. That's fine, provided two things are true: the basics are actually getting done, and someone checks.
External help covers the rest. A virtual CISO for a few days a month gives you direction, policies and someone to answer customer questionnaires. An annual penetration test and a tabletop exercise keep you honest. This structure carries most companies comfortably — the failure mode is drifting past the point where it stops being enough.
The red flags that you've outgrown the part-time model: customers send security questionnaires that take days to answer, your cyber insurer asks detailed questions you can't confidently respond to, you handle regulated data, or nobody can say who owns security without checking.
50 to 250: the first security hire
The first dedicated security hire is the highest-leverage security decision most companies make. Two choices matter: when and who.
When. The triggers are consistent: security questionnaires are slowing down sales cycles, an insurer, auditor or regulator is applying pressure, you're holding more regulated data than you used to, or your IT lead is doing security on nights and weekends. Any one of these means the part-time model is done.
Who. Hire a generalist. The exact flavor depends on your pressure: if you build software or run meaningful infrastructure, hire an engineer-first profile who can review architecture and talk to developers. If the pressure is SOC 2 and customer audits, a compliance-first profile pays for itself faster. Either way, you want someone who can do hands-on work and talk to leadership — the pure strategist and the pure technician both struggle as hire number one.
The first 90 days should produce: an asset inventory, MFA everywhere it matters, tested backups, an incident plan, a short list of metrics, and a vendor inventory. Title matters less than authority — a "security engineer" with direct access to leadership beats a "director" buried three levels down.
250 to 1,000: the small team
The second hire is usually operations and detection: someone who owns the vulnerability program and actually watches the alerts. The third is frequently governance, risk and compliance — the person who runs the audit calendar, answers questionnaires and keeps policies alive. Which comes second depends on whether your pain is technical or paperwork.
At this stage the leader's title becomes Security Manager or Director, security starts appearing in budget and planning cycles as a line item rather than an afterthought, and a 12-month security roadmap replaces the informal to-do list.
Keep outsourcing the things that don't make sense to build: 24/7 monitoring (a three-person team can't staff a SOC — this is exactly the MSSP use case), penetration testing, and deep specialties like forensics or hardware security.
1,000 and up: the security department
Past roughly a thousand employees — earlier in regulated industries — the function becomes a department with a CISO and specialized pods:
- GRC: risk, compliance, policies, third-party reviews
- Security operations: monitoring, detection, vulnerability management — in-house or hybrid with an MSSP
- Security engineering: identity, infrastructure, tooling
- Product or application security: essential if you build software, optional if you don't
- Incident response: a named team with rehearsed plans, not a distribution list
Two things change qualitatively at this size. Security gets embedded in other processes — procurement, product development, M&A — rather than consulted afterward. And leadership communication formalizes: risk appetite statements, quarterly metrics, and board-level reporting become part of the CISO's job, reflecting the "Govern" emphasis of frameworks like NIST CSF 2.0.
Where security should report
Reporting lines generate more debate than they deserve. Reporting into the CIO works fine at small scale, as long as the security owner has real authority and access to leadership. As the org grows, independence matters more: the function that demands patching and change freezes shouldn't be graded by the team it grades, which is why larger companies move security to a CISO reporting to the CEO, a risk committee or the board.
Whatever the box on the chart, two things are non-negotiable: the authority to say "no" (or at least "not without sign-off from the top"), and a line to senior leadership that doesn't depend on anyone's permission.
Hire vs. buy at every stage
The pattern at each stage:
- Under 50: buy almost everything — vCISO, MSP, annual testing. Internal ownership is a part-time hat.
- 50–250: hire the generalist; buy monitoring, testing and specialist work.
- 250–1,000: hire core operations and GRC; buy 24/7 coverage and deep specialties.
- 1,000+: hire leadership and the core functions; buy surge capacity and niche expertise.
The full cost trade-offs of outsourcing versus hiring are covered in MSP vs. In-House IT. One rule holds at every size: decisions stay internal even when execution is outsourced. Risk acceptance and priorities are business decisions — outsiders can inform them, but they can't own them. Even a fully outsourced setup needs one internal owner with decision rights.
Budgeting for the org
There's no honest universal number, and be suspicious of anyone who gives you one. Budget follows obligations and risk: what you're required to do (regulation, contracts, insurance) plus what your exposure demands. Expect two step-changes — the first dedicated hire, and the move to 24/7 monitoring — and budget security as a program: people, tools and services together, reviewed annually. Our guide on reviewing your security program covers the questions that surface whether the spend matches the risk.
If you're not sure which stage you're really in, that's exactly the kind of question a risk assessment or a few days of vCISO time answers quickly.
Frequently asked questions
When should a company make its first dedicated security hire?
Usually somewhere between 50 and 250 employees. The practical triggers: customer security questionnaires are slowing down sales, an insurer or regulator is asking questions you can't answer confidently, or your IT lead is doing security on nights and weekends. If any of those sound familiar, the time is now.
Should security report to the CIO or IT?
It can work at small scale, as long as the security owner has real authority and access to leadership. As you grow, independence matters more: the function that demands patching and change freezes shouldn't be graded by the team it grades. What matters most is a direct line to the top — a CEO, a risk committee or the board.
Can we outsource the entire security org?
Almost. A virtual CISO, an MSP or MSSP and annual testing can cover most functions at small scale. But keep one internal owner with decision rights — risk acceptance and priorities are business decisions, and outsiders can inform them, not own them.
Key takeaways
- The five security functions exist at every company size; the only question is whether anyone owns them.
- Under ~50 employees: a named part-time owner plus external help (vCISO, testing) works — watch for the red flags.
- The first hire is usually right between 50 and 250 employees: a generalist matched to your pressure, engineering-first or compliance-first.
- Grow by function — operations second, GRC third — and keep outsourcing 24/7 monitoring and deep specialties.
- Authority and a line to the top matter more than titles and reporting boxes.
- Keep decisions internal even when execution is outsourced; outsiders inform, they don't own.