Comment by dankent

It's definitely a dilemma. I guess the sweet spot would be security systems that are well understood in house but built on existing, well understood and studied standards and theory.

A starting point might be to use battle-tested open source systems but subject them to detailed in-house analysis and audit.