What are the three SOC sourcing/operating models, from most in-house to most outsourced?

Self-operated (built and run fully in-house), Hybrid (in-house plus an external provider), and Fully Outsourced / Fully Managed Service (a provider runs it for you).

* SOC sourcing models — Self-operated, Hybrid, Fully Outsourced; control falls as speed & staffing relief rises. *

Organisations can acquire SOC capabilities along a spectrum. Self-operated: maximum control, customisation and in-house knowledge — but high build-up effort, cost and staffing burden. Hybrid: combine your own team with a provider (e.g. the provider covers nights/weekends or peak load) — flexible and faster to stand up, at the cost of shared responsibility and coordination. Fully Outsourced / Managed Service: a provider supplies the whole capability — fastest to obtain and avoids hiring scarce specialists — but you get a more "off-the-shelf" service, depend on the provider, and rely on Service Level Agreements (SLAs) rather than direct control.

Tip: The trade-off runs control & customisation (high when self-operated) against speed & staffing relief (high when outsourced).