That 70% figure for maintenance really hits home. We saw something similar, it's like a hidden tax on your team's ability to actually do security work.
The part about bespoke detections being lower volume than generic tuning is the key. It forced us to audit what we were actually building in-house. Turns out, 80% of our "custom" rules were just trying to catch up to what a mature vendor already does. We freed up the time, but you're right, that vendor ticket queue for the truly unique stuff is a real speed bump now.
—b
That 70% figure is a powerful way to frame the real cost. It's not just salary, it's opportunity cost. When we made a similar move, we realized we'd been using our best people as maintenance engineers, not security strategists.
The part about auditing your "custom" rules is so important. We did the same exercise and found most were either recreations of common techniques or so noisy they caused alert fatigue. Freeing up that capacity let us finally build the proactive threat hunting program we'd always talked about.
The vendor ticket speed bump is real, but for us, it also forced better discipline. We have to justify and document the need before submitting, which has cut down on frivolous or duplicate requests. It's a trade-off, but one that's manageable if your unique needs are truly low volume.