Reputable providers size an engagement against your actual estate: number of endpoints and users, number of log sources worth collecting, whether cloud workloads are in scope, and which compliance framework (if any) the reporting needs to satisfy. A flat package price with no discovery phase is a sign the pricing was set before anyone looked at your environment.

Expect four to eight weeks for a proper managed IT onboarding: agent deployment across the estate, integration with existing systems, and a baselining period during which normal behaviour is learned before alerting begins in earnest. A provider promising full onboarding in under two weeks is deploying default thresholds rather than tuning monitoring to your environment, which means the first few months of alerts will be noisy, or worse, silent on things that matter.

Many Saudi organisations, particularly those with an existing internal IT function, are better served by a co-managed arrangement than full outsourcing. In a co-managed model, responsibilities are split explicitly: the internal team typically retains business-facing systems and change approval, while the provider takes monitoring, patching, and after-hours coverage. Ask any prospective provider whether they support co-managed arrangements and how they document the split of responsibility. A provider who insists on all-or-nothing outsourcing may be optimising for their own operating model rather than yours.

Many providers advertise NCA ECC-aligned or "compliance-ready" reporting. This is worth verifying specifically rather than taking at face value. Ask which of the ECC-2:2024 framework's four domains, governance, defence, resilience, and third-party and cloud, the provider's reporting actually covers, and in what format. "Compliance-ready" commonly means an internal controls checklist rather than the kind of evidence an NCA assessor will accept; the difference matters if you are a regulated entity working toward an actual assessment.

Ask about offboarding before you sign, not when you need it. Specifically: how configuration, documentation, and log history are returned to you in a usable format, and on what schedule access is revoked. Providers who cannot describe this process clearly are frequently the ones who make leaving slow and expensive, whether by design or neglect.