Are organizations managing IT security internally, or are they outsourcing to specialized security companies? If they are outsourcing, how do they ensure the security vendor can handle all potential threats and vulnerabilities?

I have managed both kinds. While the first one is seamless there has to be a tight coupling with the vendor in the second case. They have to become part of the team rather than being seen as a service provider.

We do a combination of both.