In-House, Consultancy or Managed Service: Choosing the Right PKI Operating Model

Once an organisation has, or has decided to build, a Public Key Infrastructure, a second question follows that is just as consequential as the technology itself: who is going to run it. There are three broad answers. Keep it in-house and operate it yourself; retain a consultancy to support and advise your own team; or hand operation to a managed service provider. Each is legitimate, and each suits different circumstances. Choosing well depends on an honest reading of your organisation's skills, appetite for risk, and the criticality of the PKI to the business.

This article compares the three operating models across the factors that matter, so that you can judge which fits your situation.

The three models in brief

In-house operation means your own team owns and runs the PKI end to end: issuance, renewal, monitoring, maintenance and incident response. You hold complete control and complete responsibility.

Consultancy support means your team continues to operate the PKI, but with specialist expertise retained behind them. The consultancy provides advice, assurance and escalation when your internal capability reaches its limit, without taking over day-to-day operation.

Managed service means a provider operates the PKI on your behalf, taking responsibility for its running to an agreed service level, while you retain oversight and direction.

The right choice is rarely obvious, because it depends on trade-offs rather than absolutes. The sections below set out those trade-offs.

Cost profile

The three models distribute cost differently, and the headline figure is not the whole picture.

In-house operation can appear the cheapest, but the true cost includes recruiting, retaining and developing scarce PKI expertise, which is expensive and difficult to sustain for the volume of specialist work a typical estate generates. The cost is also lumpy: much of it is fixed in salaries whether or not the expertise is fully utilised.

Consultancy support converts part of that fixed cost into a predictable, retained arrangement. You pay for expert access and assurance without carrying the full cost of employing rare specialists, which tends to suit organisations whose day-to-day operation is manageable but whose depth is thin.

A managed service moves operation to a predictable service cost, trading the overhead of running the PKI yourself for a defined commercial arrangement. It is often the most predictable of the three, though not always the lowest in absolute terms.

Risk and control

Control and risk pull in opposite directions across the models.

In-house operation gives you the most control and, with it, the most risk. Everything depends on your team's capability and continuity. If key individuals leave, or if a complex incident exceeds internal expertise, the organisation is exposed at precisely the moment it can least afford to be.

Consultancy support reduces that risk while preserving control. Your team still runs the environment, but specialist expertise is available when internal capability is exhausted, which closes the gap that most often causes serious incidents.

A managed service transfers operational risk to the provider, in exchange for ceding day-to-day control. For organisations where PKI is critical but not a core competency, that transfer is often the point: the risk sits with those best equipped to manage it.

Skills dependency

This is frequently the deciding factor, because PKI expertise is genuinely scarce.

In-house operation depends entirely on the organisation's ability to recruit and retain that expertise, which is difficult and rarely economical for the volume of work involved. It also concentrates risk in a small number of people.

Consultancy support removes the need to hold all of that expertise internally, while keeping operational knowledge in-house. It suits organisations that can run the PKI day to day but cannot justify employing deep specialists for the occasions when they are needed.

A managed service removes the skills dependency almost entirely, which is attractive to organisations that neither have nor wish to build specialist PKI capability of their own.

Suitability: which model fits which organisation

No model is universally right. The question is which fits your circumstances.

• In-house suits organisations for which PKI is a core competency, that have genuine specialist depth, and that want complete control. It is the right choice where the capability already exists and the organisation is committed to sustaining it.
• Consultancy support suits organisations that operate their own PKI competently but lack depth for complex incidents, design questions or assurance. It preserves control and internal knowledge while closing the expertise gap, and it often serves as a considered step before deciding whether a managed arrangement would suit better.
• Managed service suits organisations for which PKI is critical but not core, that would rather direct their own people at their core business, and that want operational risk to sit with a specialist provider.

Many organisations move between these models over time, beginning in-house and adding consultancy support as complexity grows, or moving to a managed service as they conclude that operating the PKI themselves is not the best use of their people.

How Unsung helps

Unsung is a UK-based, specialist cybersecurity consultancy focused exclusively on Public Key Infrastructure, with a team of more than 20 dedicated PKI experts. We work on a strictly vendor-neutral basis, and we support organisations across all three models.

For organisations that run their own PKI but want specialist depth behind them, our PKI consultancy provides advice, assurance and escalation. For those that would rather hand operation to a specialist, our PKI management and hosting service takes responsibility for running the environment to an agreed standard. And for organisations still deciding, a PKI Health Check provides the independent baseline that informs the choice.

If you are weighing up how best to run your PKI, contact us to talk through which model would suit your circumstances.

‍