Let's start with this quote from Tate (who asked the StackExchange question), "Long-time blog readers should know that I don't rely on tools to defend my enterprise. I rely on people first, followed by tools, then processes", Richard Bejtlich
This is about right. It's almost exactly right. The one thing I would change is that tools and processes must be strategized simultaneously, and that you can scale the process with extra people (starting with at least one, though, of course!).
For example, let's say that you're trying to start a Pen Test program. You need one full-time tester. That tester must work through a process value chain (or chains). Those value chains consist of techniques (e.g., whitebox, graybox, and blackbox) and sub techniques (e.g., mobile, web, network, et al). A tool (or tools) can be mapped to each sub technique. When you need to scale, you simply add more people.
A recent Cloak & Swagger episode on YouTube made several comments that cover this question. The discussion around people vs. tools starts around 47 minutes in, but the best part is Ali's formula of "what orgs can afford" (starting around 55 minutes in) where he mentions that we can only afford people + 1 in tools.
I enjoy both of these ideas. In the book, "IT Security Metrics", the authors (Lance Hayden, et al) discuss staffing to incidents using a Poisson distribution, as well as other methods for outsourcing, and finally even include a huge piece on defining processes with people integration -- all covered in chapter 9. This is another source worth checking out.