Outsourced capability is a function, skill, or operational task that an organization has moved to an external provider. That can include system administration, security monitoring, software development, incident response, or specialist engineering knowledge. The risk is not outsourcing itself, but losing the internal understanding needed to supervise, replace, or verify the work.
In cyber security, outsourced capability matters because attackers often exploit weak oversight of third parties, unclear responsibilities, or hidden dependencies. If critical know-how leaves the organization, defenders may struggle to spot misconfigurations, validate controls, or recover services when a supplier changes or fails. Strong defense means keeping enough expertise in-house to review vendor behavior, challenge assumptions, and rebuild essential functions if needed. A resilient organization treats outsourced work as supported by internal control, not as a substitute for it.