How Much Does SOC as a Service Cost for a Mid-Market Company

A CFO asks the security lead for the cost of a managed SOC and gets 3 quotes back in the same week. The first is $60,000 a year, the second is $144,000 and the third is $300,000. All 3 vendors call the product SOC as a service, and all 3 quote the same company of 1,000 employees. The gap isn’t a sign that 2 of the vendors are wrong. They’re pricing different things: different response authority, different log volumes, different coverage hours and different assumptions about who owns the tools.

This guide explains what drives the price and what a mid-market buyer should expect to pay. It uses a reference company of 1,000 employees, 1,100 endpoints and 40 GB of logs a day, and it builds quote scenarios with arithmetic you can check. Price ranges come from vendor and consultancy articles, which we attribute, and which are estimates rather than audited market data. Treat every figure as a starting point for your own quotes, and confirm pricing and terms directly with each vendor.

TL;DR

The short answer, and why quotes differ so much

For a company of 100 to 1,000 employees, a managed SOC bought as a monthly retainer mostly lands between $5,000 and $25,000 a month, according to a BD Emerson pricing guide. That’s $60,000 to $300,000 a year, a range wide enough to hold nearly any quote you’ll receive. A consultancy article from Radical gives a similar spread for a smaller estate of about 100 endpoints, at $30,000 to $250,000 a year for a managed virtual SOC, depending on telemetry volume and response scope.

The spread comes from what the service does when it finds a problem. A low-cost tier forwards alerts with a severity label and leaves the response to you. A mid-priced tier triages alerts and tells you what to do. A higher tier can isolate a laptop or disable an account at 3 a.m. without waiting for you. Each step adds staff time and tooling, and each step shows up in the price. Before you compare numbers, compare what each vendor will actually do.

Pricing models side by side

What the price includes at each depth

Alert forwarding is the cheapest tier, and it leaves the work with you. BD Emerson describes low-cost tiers as services that forward alerts with a severity label, keep vendor-default detections, leave noisy rules in place and limit response to email. Analysts at these providers are often spread across many clients. This tier can fit a team that already has strong in-house responders and wants an extra pair of eyes overnight, and it rarely fits a team that has nobody to read the alert at 2 a.m.

First-pass triage adds an analyst who decides what matters. At this depth the provider investigates alerts, closes false positives and escalates real ones with context. You get fewer, better alerts, and your team still decides what to do. The extra cost buys back hours, since a team that gets 400 raw alerts a week and 15 triaged cases is spending its time differently. Ask for the percentage of alerts the provider closes without escalation, and how it measures accuracy.

Containment authority is where prices step up. A provider that can isolate hosts, disable accounts and block addresses needs pre-agreed playbooks, tested access and insurance that covers its actions. BD Emerson notes that response depth rises in cost from notification to triage to containment authority. Many mid-market buyers choose containment during off hours and human approval during business hours, which keeps the price down while still closing the overnight gap.

Full incident response usually costs extra. A breach investigation and recovery support are generally separate engagements or a retainer. BD Emerson puts out-of-scope incident work at $250 to $500 an hour beyond the contracted boundary. Ask what the base service includes when a real incident starts, how many hours of response are bundled and what the rate is after that. A low monthly price with an expensive incident clause is a common trap.

Factors that move your price

The factors interact, which is why 2 quotes for the same company can differ by a factor of 5. A vendor that counts every virtual machine, covers every log source and offers containment at night will quote far above a vendor that forwards alerts for laptops during business hours, and both can be honest. Write down your own answer to each row before you collect quotes, then send the same list to every vendor so the numbers describe the same service.

A reference mid-market buyer

Take a company of 1,000 employees, 1,100 endpoints and 40 GB of logs a day from identity, email, cloud applications, firewalls and endpoints. It runs a mix of Windows and Mac laptops, 90 servers and about 60 cloud and software-as-a-service log sources. It has a 4-person IT team, 1 security lead and no 24-hour staffing. The security lead wants detection around the clock, triage that reduces the alert load and a clear process for what happens when something is real.

That profile is common, and it’s where the quote spread appears. A vendor pricing per endpoint multiplies 1,100 by a monthly rate. A vendor pricing a co-managed retainer starts from the SIEM and log volume. A vendor pricing per user multiplies 1,000 by a different rate. Each method can be fair, and each lands on a different number, so the scenarios below turn the 3 methods into comparable annual figures using the ranges cited in this guide.

Quote scenarios for the reference buyer

Per-endpoint figures use the BD Emerson ranges, and the SIEM line uses its $2 to $5 per GB estimate. The retainer is a vendor fee and excludes SIEM ingestion, so a co-managed buyer adds the last line to the retainer. At a middle assumption of $12,000 a month plus $3 per GB, the year-1 total is $144,000 plus $43,800, or $187,800. All of this is illustrative, and your quotes will differ with scope and negotiation.

Costs outside the quote

Onboarding is billed separately by many vendors. BD Emerson puts onboarding at $5,000 to $25,000, or the equivalent of a first month. The work covers connecting log sources, tuning detections, building playbooks and testing escalation paths. Ask whether the fee covers a fixed list of sources, how many tuning cycles are included and whether it’s credited if you sign a longer term. A low monthly rate with a high onboarding fee can cost more over 12 months.

SIEM and EDR licenses may sit on your invoice, not the vendor’s. In co-managed models, the provider runs tools in your tenant under your licenses, and those licenses are your cost. BD Emerson cites Microsoft Sentinel’s pay-as-you-go price of $4.30 per GB in its cheapest US region, falling to $2.30 to $3.00 per GB at commitment tiers of 100 GB a day and above. At 40 GB a day, you sit below that commitment tier, so confirm current pricing directly.

Volume overages and re-tiering can change the bill. Log volume grows as you add applications and as attackers prompt more noise. Ask for the overage rate in writing, the process for moving to a higher tier and the notice period before charges apply. A service priced on endpoints has the same issue: adding 200 laptops after a merger raises the count, and the contract should state the per-unit rate for additions.

Annual increases and bundled features add up. BD Emerson reports annual uplifts of 3 to 8% and says final invoices often land 20 to 40% above the quoted rate. Expel’s guide notes that year-1 bundled features sometimes become paid items at renewal. Ask for a cap on annual increases, a list of everything bundled in year 1 and the price of each item if it leaves the bundle. Then build a 3-year view before you sign.

What 24 hours a day, 7 days a week costs in-house

• Staffing is the largest cost. BD Emerson says a single analyst seat around the clock takes about 5 people to cover nights, weekends, holidays and leave. At an entry-level salary of about $98,000, per Expel, 5 people cost $490,000. Adding a 35% load for benefits and overhead, within the 30 to 40% range Expel cites, brings that to $661,500 a year for a single seat. That figure excludes tools and a manager, so treat it as a floor for a single seat.
• A real team is larger. Expel, a managed SOC vendor, describes 8 to 12 analysts as a basic 24-hour SOC and puts the fully loaded personnel cost at $1.6 to $2.1 million a year for its larger model. Those figures assume a 5,000-employee organization and come from a vendor with an interest in the comparison, so treat them as an upper reference for a mid-market company. A company with 1,100 endpoints won’t need that scale, though the 24-hour staffing arithmetic still applies.
• Tools sit on top of salaries. Expel lists a SIEM at $100,000 to $300,000 a year, EDR at $30 to $80 per endpoint a year and other tooling for a 5,000-employee company. A mid-market estate needs less, and it still needs a SIEM, endpoint detection and a way to automate response. License costs apply to the in-house path and to the co-managed path alike. Ask vendors which tools they require and which they’ll run in your existing stack.
• Hiring and retention add hidden cost. Expel cites recruiting costs of $15,000 to $25,000 per hire, annual turnover of 20 to 40% and 6 to 12 months before a new SOC reaches full 24-hour coverage. Radicl similarly describes 6 to 18 months to stand it up. Each of those is a cost in time, and each is a period when your risk is higher. Put a number on that gap when you compare options.

How 3 paths compare

The 3-year cost of the reference buyer

Over 3 years, the co-managed service for the reference buyer costs more than 3 times the year-1 fee, because of increases and extras. Start from a $12,000 monthly retainer, which is $144,000 a year, and apply a 5% annual increase, inside the 3 to 8% range BD Emerson cites. Retainer costs run $144,000, $151,200 and $158,760, a total of $453,960. Add SIEM ingestion of $43,800 a year, or $131,400 over 3 years, and a $15,000 onboarding fee.

The 3-year total is $600,360, which averages $200,120 a year. That’s the number to put in front of a CFO, and it sits about 7% above the year-1 average of $187,800. As a stress test, if the whole bundle lands 20 to 40% above the quote, as BD Emerson says invoices often do, the total rises to between $720,432 and $840,504. Even at the high end, the figure is well below the $661,500 a year for a single in-house seat before any tools.

Contract terms that control cost

Term length and renewal. Multi-year terms usually lower the monthly rate, and they lock you in if the service disappoints. A common middle path is a 12-month initial term with a price cap on renewal, or a longer term with a termination right if service levels slip. Ask for the renewal price in the first quote, and ask what changes at renewal if you add or remove assets. Put the answer in the contract itself.

Scope and unit definitions. Define what counts as an endpoint, a user and a log source in the contract, and state the price for additions and removals. Vendors differ on whether servers, virtual machines and mobile devices count. A clear definition protects you when the count changes and removes ambiguity when the invoice arrives. Ask for an example invoice from a similar customer, with names removed, so you can see how the units appear in practice. Check that the example matches the contract’s definitions.

Service levels and credits. Look for time to acknowledge, time to triage and time to contain, with credits when the provider misses them. Ask how it measures those times and whether you can verify them. A service level with no remedy has no force. The remedy needn’t be large, and it should be automatic and defined in advance. Ask for the last 12 months of the provider’s actual results against those targets, and check the sample size.

Data and exit. Ask where your logs and cases are stored, how long the provider keeps them and how you take your data and detection content when you leave. In a co-managed model, the SIEM and rules sit in your tenant, which makes exit easier. In a vendor-hosted model, ask for an export of cases and playbooks, and a deletion confirmation after you go. Ask how long the export takes and what format it uses.

Questions to ask each vendor about price

• What exactly is the unit we’re paying for? Ask the vendor to define endpoint, user, log source and gigabyte in writing, and to say what happens when the count changes mid-term. Request the price for each addition, and the credit for each removal. These definitions decide whether the quote you compare is the invoice you pay, so settle them before you sign. Keep the definitions in a 1 page schedule that finance and security both sign.
• What’s included in response? Ask how far the provider goes, from notification to containment, and which actions it can take without your approval. Ask how many hours of incident response are bundled and what the rate is after that. Expect a clear answer. A vendor that talks only about alerts and dashboards hasn’t answered the question. Ask for a sample escalation record that shows what the provider did and when. Real examples beat a description of the process.
• What are all the upfront and recurring fees? Ask for a full price sheet covering onboarding, connectors, log retention, data egress, reporting, tuning and annual increases. Ask which year-1 bundled features become paid at renewal. Then ask the vendor to sign the sheet as an exhibit, so the numbers carry into the contract. Compare the sheets across vendors on the same 3-year basis, with the same unit counts, before you look at discounts. Ask finance to check the arithmetic.
• Who staffs the service and from where? Ask how many analysts watch your environment, whether they’re dedicated or shared, where they sit and what the analyst-to-client ratio is. Ask for the average time analysts have been with the provider. Turnover at the provider affects service quality, even if it never shows up in the price. Ask whether your analysts will be named, whether you can meet them and how the provider handles a departure on your account.

Normalize the quotes before you compare

Which path fits which buyer

Choose a fully managed service when nobody on your staff can respond at night, your log sources are manageable and you want a predictable fee. Choose a co-managed service when you already have a SIEM and some in-house skill, and you want a partner to run detection and triage while your team handles response. Radicl notes that co-managed models still need internal staff, which is the cost trade-off behind its $250,000 to $500,000 range.

Build in-house only when the economics and the talent market support it. A single 24-hour seat costs about $661,500 a year in the illustrative model, and a realistic team costs far more, with 6 to 18 months before it works. Companies with unusual data, strict sovereignty rules or a security product of their own sometimes justify the cost. For most mid-market buyers, the sensible question is how much of the work to outsource, rather than whether to outsource any of it.

Mistakes that inflate the bill

Comparing monthly prices without comparing scope. A $5,000 service and a $25,000 service are different products. The cheaper service may forward alerts with a label, while the expensive service may triage and contain. Build a table of what each vendor does at each stage of an incident, and price the gaps. Then you can see whether the cheaper quote saves money or merely moves the work to your team. Include your own hours in the comparison.

Ignoring the SIEM bill. In co-managed models, license and ingestion costs can rival the retainer. At 40 GB a day and $3 per GB, ingestion is $43,800 a year in our example. Ask for a log-volume forecast from the vendor, and test it against your own numbers. Reducing noisy sources before onboarding can cut that bill without reducing detection. Ask the vendor which sources produce the most volume and the fewest useful alerts, and decide together what to drop.

Signing a long term with no exit. A 3-year term with an automatic renewal and no data export clause is expensive to leave. If the provider’s quality drops, you’ll pay for service you don’t use while you build a replacement. Negotiate a termination right tied to service levels, and keep copies of your detection content and case history. Review the clause with counsel before signature, and diary the notice date for renewal so it doesn’t pass unnoticed.

Skipping a tabletop before you buy. Walk through a realistic incident with the shortlisted vendor, such as a compromised account on a Saturday night. Ask who calls whom, what the provider can do on its own and what it needs from you. The exercise costs a few hours and shows gaps in authority, contact lists and approvals that no price sheet reveals. Repeat the exercise after onboarding, using the real playbooks and the real contact list.

FAQs

How much does SOC as a service cost for a mid-market company?

Plan on roughly $60,000 to $300,000 a year for a managed service, with a middle case near $144,000 to $190,000 once SIEM ingestion is included. BD Emerson puts mid-market retainers at $5,000 to $25,000 a month, and Radicl’s range for a smaller estate is $30,000 to $250,000. Scope, log volume and coverage hours decide where you land, and vendors set their own prices, so get at least 3 quotes. Ask each vendor to price the same scope.

Is per-endpoint or per-user pricing better?

It depends on your estate. Per-endpoint pricing suits companies with a clean device inventory, and BD Emerson cites $8 to $25 a month for mainstream detection and response. Per-user pricing, at $8 to $15 a month for 200 to 1,000 users in the same guide, can suit staff who use 1.5 to 2 devices each. Run both against your counts and compare the totals. Ask each vendor how it counts servers, virtual machines and shared accounts, since that decides which model is cheaper for you.

What does it cost to build a 24-hour SOC in-house?

A single analyst seat around the clock takes about 5 people. At about $98,000 each, with a 35% load, that’s $661,500 a year, before tools, a manager and recruiting. Expel, a vendor, estimates a basic 12-analyst SOC at $1.2 to $1.8 million for a 5,000-employee company. Both are estimates, and a mid-market team should expect the cost to be a large multiple of a managed service. Add recruiting and a 6 to 12 month ramp to the comparison.

Why do final invoices exceed the quote?

BD Emerson reports that final invoices often land 20 to 40% above the quoted rate, because of onboarding fees, log volume growth, out-of-scope incident work and annual increases of 3 to 8%. Ask for a full price sheet, overage rates, the incident response rate and a cap on renewals. Then model 3 years, so the first-year price doesn’t mislead you. Compare the result with each vendor’s quote on the same basis, and ask finance to review it.

Does the quote include incident response?

Often not. Full incident response and forensics are usually separate engagements or a retainer. BD Emerson puts out-of-scope work at $250 to $500 an hour. Ask how many response hours are bundled, which actions the provider can take on its own and what the rate is after the bundle. Confirm the answer in the contract rather than relying on a sales deck. Ask for a sample incident summary from a past customer, with names removed.

Is co-managed cheaper than fully managed?

Not always. The retainer may be lower because you own the tools and handle part of the response, but you pay license and ingestion costs and you need internal staff. Radicl puts co-managed models at $250,000 to $500,000 when internal people and tools are counted. Compare total cost, including your own time, instead of the retainer alone. Include the cost of the staff who will handle escalations, since that time comes from your own budget.

How long does onboarding take?

It varies by vendor and by the number of log sources, so ask for a plan with dates. Onboarding covers connecting sources, tuning detections, building playbooks and testing escalation, and BD Emerson puts the fee at $5,000 to $25,000. Expect the service to improve over the first months as the provider learns your environment. Agree on milestones, and tie the end of onboarding to a test. Ask what the vendor needs from your team and by when.

What should we negotiate first?

Start with the definitions of the unit you pay for, then response authority, incident response hours, price caps on renewal and exit terms. Those items move the total more than a small discount on the monthly rate. Ask for the full price sheet as a contract exhibit, and get legal and finance to review it. Prices and terms are negotiable, and every figure in this guide is an estimate to test against real quotes.