Look what happened to G.E. They outsourced everything they possibly could and had a decade or two of unparalleled profitability. But, over time the well of ideas and competencies for products and services dried up and they went from being a powerhouse to a cautionary tale.
Don't export knowledge or know-how to save a few bucks. It always comes back to bite you.
Institutional knowledge informs why a solution works better than a shiny. The contract org will push through what works best for them, more than what’s best for your org long term. Contract orgs like checking off Hundreds of NIST or CIS controls as if that in and of itself means anything substantive.
The same logic could be used to justify duct tape software across the enterprise. There is some point where the cost-benefit leans in favor of outsourcing. Institutional knowledge may be under-priced by today's business execs, that is certainly possible. But we also shouldn't build a homegrown solution for every problem.
This. I have seen consulting companies keeping consulting contract only because the only guy that knew their system inside out was this single consultan that had been there so long that he became the effective sysadmin with the last word on everything related on the subsystem that he had been managing for years.