Which security function is typically outsourced?

• A. Policy
• B. Vulnerability testing
• C. Both Policy and Vulnerability testing
• D. Neither Policy nor Vulnerability testing

Answer: (B)

Testing for vulnerabilities is often outsourced because it benefits from external expertise, specialized tooling, and an independent, up-to-date assessment of threats. Third-party security teams bring broad experience across many environments, use advanced scanners and testing methodologies, and can spot issues that internal staff might miss due to familiarity or resource limits. Outsourcing also helps with objective risk reporting and can be more cost-effective for periodic assessments, which many organizations schedule quarterly or annually to stay current.

Policy development, on the other hand, is typically handled in-house to ensure governance, regulatory alignment, and consistent buy-in across the organization. External input is valuable, but the responsibility and ownership of security policy usually stay internal to reflect the organization's risk appetite and objectives.