It's definitely a dilemma. I guess the sweet spot would be security systems that are well understood in house but built on existing, well understood and studied

It's definitely a dilemma. I guess the sweet spot would be security systems that are well understood in house but built on existing, well understood and studied standards and theory. A starting point might be to use battle-tested open source systems but subject them to detailed in-house analysis and audit.