Some companies build their own software. Others outsource software development by hiring contractors or other companies to build software they need.
When we need to build new custom software, is there any evidence whether the choice to develop in-house vs outsource software development has an effect on security? All else being equal, does developing in-house tend to lead to more secure software than hiring third parties to do the software development?
One could hypothesize that maybe outsourcing software development has a greater risk of leading to insecure software, all else being equal. Maybe when you develop in-house, you own the risk, so developers are properly incentivized to make it as secure as it needs to be -- but maybe when you outsource to a third party, since the third party doesn't operate the software and doesn't bear any of the risk during operation, maybe the third-party developer isn't sufficiently incentivized to use good security development practices and maybe you're more likely to end up with poor security (since that cuts the third party's costs). Or, rather, one could worry there might be some effect like this. But is that really what happens? Is there any evidence one way or the other? Or is there any general experience or conventional wisdom from industry about the effect on security of outsourcing vs developing in-house?
I'm especially thinking of a government agency who has to make this decision, but I imagine the question is generally applicable.