the comparison that gets made
When an organisation decides how to deliver application control, the comparison is usually framed as external spend against internal capability. External spend appears on a purchase order. Internal capability appears as an existing salary line, or a role that was going to be filled anyway.
Framed that way, in-house always looks cheaper. The problem is that the two options are not the same thing.
what a headcount buys
Hiring a cyber or systems engineer to own WDAC buys one person's learning curve against one estate.
That engineer will be good. They will also spend the first year discovering things that are already known:
— that audit events are an unreliable basis for policy construction, because a properly signed file can appear unsigned depending on load context
— that publisher rules fail silently when the signer is not declared correctly, despite a successful deployment
— that deleting a policy file directly instead of deregistering it can prevent a machine from booting
— that native image artifacts generate events which must never become rules
Each of these is a week or a month of investigation the first time it is encountered. None of them are documented in a way that prevents the encounter. That time is the real cost of the build option, and it is paid once per engineer, not once per organisation.
what repetition buys
A provider who has delivered application control across multiple estates arrives with those questions already answered. Not because they are cleverer, but because they have already paid for the answers on someone else's programme.
The difference shows up in the shape of the work. A first-time implementation is exploratory, and the calendar is dominated by investigation. A tenth implementation is procedural, and the calendar is dominated by decisions that only the customer can make.
the arithmetic over five years
A permanent specialist is an indefinite commitment. The cost does not stop when enforcement is reached, it continues for as long as the role exists, and it is exposed to a single point of failure. When that person leaves, the organisation is not left with capability. It is left with scripts and an exception list nobody can explain.
An engagement with a provider who does this for a living is bounded. It has a defined outcome, and the accumulated knowledge sits in a platform and a documented operating model rather than in one person's working memory.
Over a five year horizon the comparison is not close. The specialist engagement is cheaper, and it is cheaper for a structural reason: expertise that is amortised across many implementations costs less than expertise that is rebuilt from scratch inside every organisation that needs it.
what should stay in-house
None of this argues for outsourcing the decisions. Someone internal still has to own the programme, approve what the organisation is allowed to run, and decide how exceptions are handled. That judgement is not transferable and should not be.
What is transferable is the mechanics. Policy construction, event triage, rule generation, deployment sequencing, and evidence capture are repeatable engineering problems that do not benefit from being solved locally.
WDACManager exists to carry the mechanics, and the delivery model exists so that organisations do not have to build a specialist function to operate it. The judgement stays where it belongs. The rest is not worth a headcount.