Neither, as the question is usually put. A security manager and security consulting services answer two different problems, and a budget request that treats them as interchangeable is the easiest kind to refuse. Before you decide between a hire and outside help, decide what the business is buying: someone to run security day to day, an answer to a specific question, or a way to make security decisions it can defend. A security team of one, or none, needs extra capacity, because the daily work already fills the week. Neither option adds it for long. A single hire is absorbed by operations, and a consulting engagement ends on its end date. Headcount alone does not scale a security program; this is about the decision in front of you when the request is on the table.
What Does a Security Manager Actually Give You?
Presence. Someone owns the guard contract, the badge system, the incident from Tuesday night and the police call on Wednesday morning. Somebody has to, and the problem is what it crowds out. In ASIS International's 2024 survey of 1,082 security professionals, 29.6% said their senior security executive spends less than a quarter of their time on high-level planning, and another 26.9% put it between a quarter and half. More than half of security professionals say their senior security executive spends half their time or less on strategy. The role you post as strategic turns operational inside the first budget cycle, because operations arrive every day and strategy waits.
The role you post as strategic turns operational inside the first budget cycle, because operations arrive every day and strategy waits.
It is also the most expensive line on the request. In the 2025 Foushée compensation survey, run by ScottMadden with data from HR teams at companies from under $500 million to over $250 billion in revenue, weighted-average base pay for a senior regional manager, domestic security, was $209,238. That role runs a large company's regional security function. A first hire at a growing company comes in lower, but it is still a six-figure fixed cost before anyone has seen what it produces.
What Do Security Consulting Services Actually Give You?
An answer, at a point in time. A consulting engagement is good at a bounded question: assess these three sites, write the workplace violence policy, review the guard contract before renewal. It brings depth no single hire can hold across security, risk and the business at once. Its limit is the end date. The method leaves with the firm, the report stays, and the report is dated the day it is signed. By the next budget review the sites have changed, and the document that justified last year's spend says nothing about this year's.
Its limit is the end date.
One customer of ours, the senior director of facilities and security at a technology company, had spent about $80,000 on consulting across four projects the year before we started working together, work he described as fragmented. His request for a security manager at about $150,000 had been turned down. He put it to us as needing one or the other: headcount, or outside capability. Both options had a price; neither had been put to the approver as a decision with its reasoning attached.
Why Does Finance Refuse the Headcount Request?
Rarely because anyone thinks the risk is small. The approver, whether that is the CFO, legal, real estate or HR, is being asked to fund a fixed cost whose output cannot be inspected: incidents that did not happen. A consulting report has the opposite problem, a visible output with no continuation. Finance does not fund a security manager or a consultant; it funds the decisions it can see them make. A request that arrives as a role or a project shows the approver a cost. One that arrives as a decision with its reasoning attached gives the approver something to check, and a request the approver can check is easier to approve.
What Should the Request Be For Instead?
A way of deciding, shared with the people who will approve the result. For every security decision, examine three things: what is at stake, which is rarely only money (people and physical safety, continuity, executives, insurance), the options (the controls or courses of action, including doing nothing), and the context (size, geography, growth stage, what is changing). The output is the reason, written down with its basis, so the decision is revisited when the context changes instead of restarted. You could build the first number yourself. What you cannot build alone is the comparison with companies like yours, and finance trusts a number more when the team asking for budget did not build it.
What you cannot build alone is the comparison with companies like yours, and finance trusts a number more when the team asking for budget did not build it.
The same process has to be able to say do not spend. One that can show a control is not worth its licensing cost, or that one site carries more exposure than the other four combined, earns the credibility that gets the next request through. Better decisions cut both the risk the business did not mean to carry and the budget spent where it reduces little risk.
So When Is the Hire Right, and When Is Outside Help Right?
A security manager is the right answer when the operational load already exists: several sites, a guard contract, incidents that need a named owner. Measure that person on the quality of decisions, with the daily work staffed around them, or the role will be consumed by it. Security consulting services are the right answer for a bounded question with a deadline, where nobody expects the deliverable to stay current. The leader whose headcount request was just refused usually needs something else first: a standing way to decide what deserves investment, what can wait and why.
Measure that person on the quality of decisions, with the daily work staffed around them, or the role will be consumed by it.
Holtium is an annual program: a security expert who builds and maintains a security decision-making framework inside your company, working alongside your team every two weeks, with the Holtium platform the program runs on. Part of that program is governing decisions, so that every request, for a role, a contract or a control, reaches finance with what was at stake, the options compared and the context assumed, and so does every case for not spending. Whether you end up hiring a security manager, buying security consulting services for a defined piece of work, or neither this year, the decision will have a basis the business can measure in dollars and defend. Once the request is a decision rather than a role, the next question is what the ranking behind it looks like, and why a risk scored 4 out of 5 still does not tell finance what to fund.
