SOC as a Service
Managed SOC, Managed SIEM, and What 24/7 Security Monitoring Costs
One analyst seat staffed around the clock takes about 4.9 people, about $928,000 a year with benefits, before any tools. Get SOC as a service through us: the providers that fit price your environment at once, and we negotiate the contract.
Price My SOCSOC quotes are hard to compare because no two count the same thing. One prices 1,000 endpoints with 90 days of logs and alert-only response; another prices 1,000 users with a year of retention and the authority to isolate a machine at 3 a.m. We fix that: one requirement goes to the providers that fit, they price the same scope, and we negotiate the contract you sign. SOC as a service is one part of managed security services.
Sources: BLS Occupational Outlook Handbook (median pay, May 2025); MCA calculation, shown below (analysts per seat); IBM Cost of a Data Breach Report 2026, global figures as summarized by Baker Donelson (time to identify and contain; cost over and within 200 days, with the gap an MCA calculation).
What a 24/7 SOC Costs to Staff In-House
Every SOC decision starts from this arithmetic. A seat is one analyst position staffed every hour of the week: 8,736 hours a year (52 weeks × 168 hours). One analyst works about 1,776 of them after vacation, sick leave, holidays and training. 8,736 ÷ 1,776 = 4.9 analysts per seat, which at the BLS median pay is about $635,000 a year in salary, or about $928,000 with benefits.
MCA calculation. Inputs: median pay for information security analysts, $129,180 (BLS Occupational Outlook Handbook, May 2025); benefits ratio 1.46, total compensation of $78.88 an hour divided by wages and salaries of $54.06 for private industry management, professional and related workers (BLS Employer Costs for Employee Compensation, June 2026); 16 vacation days and 7 sick days, the private industry averages after five years of service (BLS National Compensation Survey, March 2026); 10 holidays and 5 training days are our assumptions. Leaves out tooling, recruiting, turnover, shift premiums and senior pay, so it is a floor. Figures as of October 2026. Free to cite with a link to this page.
Each provider prices the same log sources, endpoints, users, retention and response authority, so you compare what you will get, not a headline rate per endpoint.
One requirement goes to the providers that fit on the same day. Once you have asked a provider for pricing directly, it usually will not register an advisor on the deal, and you negotiate alone.
Log retention, response times by severity, who may isolate a machine, and how you leave with your data, in writing before you sign.
The provider you choose pays us, so it costs you nothing. You'll hear back within 24 hours. If you have already spoken to one provider, tell us which; we can still run the rest of the market.
The calculation leaves out the platform. A SIEM is usually licensed on the logs it ingests a day, and its storage grows with retention, so tooling depends on log volume more than headcount. A SOC as a service price absorbs that line too. No neutral source publishes a price range for the service, and the ranges providers publish measure different scopes, so we do not quote one. The pricing models section explains how quotes are built; the reliable number is a set of quotes for your scope from the providers that fit.
What Is SOC as a Service?
SOC as a service is a subscription under which a provider's analysts monitor, investigate and respond to security events in your environment around the clock. It is also sold as security operations center as a service, a managed security operations center, a managed SOC or an outsourced SOC. You keep ownership of your systems and data; the provider supplies the people, the processes and usually the platform.
What is managed SIEM?
A SIEM (security information and event management) tool is, in NIST's definition, an application that gathers security data from information system components and presents it as actionable information via a single interface. Managed SIEM, also sold as SIEM as a service, is that platform run for you: the provider hosts or administers it, connects your log sources, writes and tunes the detection rules, keeps the logs for an agreed period and forwards alerts. Whether its analysts also investigate and respond is set by the contract, and that is the line between managed SIEM and a full managed SOC.
What is a virtual SOC?
A virtual SOC is a security operations center without a dedicated room: analysts work remotely, often across time zones, on a shared platform. Most SOC as a service is delivered this way, and the term is also used for in-house teams that hand nights and weekends to a provider.
Managed SOC vs Managed SIEM vs MDR vs XDR
The labels overlap, and providers use them differently. The test is the scope written into the contract: which sources are watched, what the provider may do, and how fast.
| Service | What it is | What it watches | Who responds | Fits best |
|---|---|---|---|---|
| SOC as a serviceManaged SOC, outsourced SOC | Provider analysts run detection, investigation and response 24/7 | Logs in a SIEM plus endpoint, network, cloud and identity sources | Provider triages, investigates and contains under pre-agreed rules; your team remediates | Companies with many log sources and no team awake at night |
| Managed SIEMSIEM as a service | Provider runs the log platform, its rules and its retention | Whatever log sources are connected | Your team, unless an analyst service is added | Teams that can investigate but do not want to run the platform, and compliance log retention |
| MDRManaged detection and response | Detection and response centered on endpoints, often on the provider's own agent | Endpoints first, then identity and cloud | Provider investigates and takes containment actions | Companies whose main risk is ransomware on laptops and servers. See managed detection and response |
| Managed XDRExtended detection and response | MDR stretched across several layers on one platform | Endpoint, email, identity, network and cloud telemetry, correlated | Provider, through that platform's sensors | Companies standardizing several security layers on one platform |
| MSSP bundleManaged security services provider | Several managed services from one provider, often with a SOC at the center | Varies by contract | Varies by contract | Companies buying monitoring with managed firewall services or SASE and SD-WAN. See the managed security services hub |
SIEM vs SOC: what is the difference?
A SIEM is software; a SOC is the team and the process that use it. The SIEM collects logs and raises alerts. The SOC decides which alerts matter, investigates them and responds. Buying a SIEM without people to work its alerts at night produces a dashboard nobody is watching when it matters.
SIEM vs XDR: what is the difference?
SIEM starts from logs: it ingests whatever sources you connect, in almost any format, and is the usual home for the log record auditors ask for. XDR starts from telemetry that its own sensors collect on endpoints, email, identity and the network, correlates it in one platform and can act through those sensors. Many SOCs run both: XDR for fast detection and response on the layers it covers, SIEM for everything else and for the record. Workloads moving through cloud migration services add cloud logs that one or both must take in.
Send us your log sources, endpoint count and who answers alerts at night today. We tell you which service fits before any provider quotes it. If an in-house team is the better answer, we will say so.
SOC Tiers: Level 1, Level 2 and Level 3
Most SOCs, in-house or outsourced, sort the work into three tiers. The tiers matter when you buy, because a quote can staff the first one well and the other two thinly, and the price will not tell you which.
Level 1: triage
Watch the alert queue around the clock, close false positives, add context to the rest and escalate what looks real. Most of a SOC's headcount sits here, and it is the work automation absorbs first.
Level 2: investigation
Work the escalated alerts: what happened, which systems and accounts are involved, and whether it is an incident. Containment under pre-agreed rules usually starts at this tier.
Level 3: hunting and response
Look for threats that raised no alert, write and tune detection rules, and lead the response on confirmed incidents. In a quote, ask who does this work and how many hours a month you get.
What 24/7 SOC Coverage Means
A 24/7 SOC means a qualified person is looking at your alerts every hour of the week, including the hours your own team is asleep. A business-hours team, however good, covers less than a quarter of the week.
MCA calculation: a 40-hour business week against the 168 hours in a week. Free to cite with a link to this page.
The BLS notes that information security analysts sometimes have to be on call outside normal business hours for emergencies. A 24/7 SOC replaces the pager with a staffed shift. When you compare offers, ask whether nights and weekends run on the same tiers as weekdays or on an on-call escalation, how many analysts are on shift at 3 a.m., and what the response time is at that hour.
What Is Included in SOC as a Service, and What Costs Extra
The base price covers a defined scope. Most of the difference between two SOC as a service quotes sits in the lines below, which is why we put every one of them in the requirement.
| Item | Usually in the base price | Often extra, or worth asking |
|---|---|---|
| Log sources | A named list or a count of sources and standard integrations | Sources beyond the list, custom parsers for in-house applications, some cloud and SaaS connectors |
| Log retention | A set period of searchable logs, often stated in days | Longer searchable retention, archive storage, and retrieval from the archive |
| SIEM platform | Included when the provider runs its own platform | Your own SIEM license and its ingestion charges, if you bring one |
| Endpoint agent | Sometimes bundled | A separate license per endpoint; see MDR |
| Triage and investigation | Level 1 and Level 2, around the clock | Level 3 threat hunting above a monthly allowance |
| Response authority | Notification, plus containment actions you pre-approve | Hands-on remediation, rebuilding systems, forensics |
| Incident response retainer | Rarely included | Retainer hours for a major incident, with a guaranteed start time; recovery itself sits with DRaaS and backup as a service |
| Compliance reporting | Standard monthly reports | Reports mapped to a framework for auditors, such as HIPAA or CMMC; see compliance colocation |
| Onboarding | Standard sources, in a set onboarding period | Custom integration work and rule tuning after that period |
Metro Colo Advisory market read: relative positions, not quotes. Scopes vary by provider and by contract.
Managed SIEM Pricing: How SOC as a Service Is Priced
Five counting models cover almost every quote. None is cheaper in general; each is cheaper for a particular shape of environment, which is why the same company can get quotes that look far apart and buy nearly the same thing.
| Pricing model | What is counted | Fits when | Watch for |
|---|---|---|---|
| Per endpoint | Servers, laptops and desktops running an agent | The endpoint count is stable and endpoints are the main risk | Cloud, network and SaaS logs priced separately |
| Per user | Employees or identities | Each user has several devices, or the company runs mostly on SaaS | Service accounts, contractors, and whether servers are included |
| Per device or asset | Every monitored device, including firewalls, switches and servers | Mixed environments with many network devices | How a device is defined, and cloud workloads that scale up and down |
| Per GB a day of log ingestion | Average daily log volume sent to the SIEM | Log-heavy environments; the usual basis for managed SIEM pricing | Volume spikes, overage rates, and noisy sources nobody needs |
| Tiered bundle | A package by company size or source count | Smaller companies with standard sources | What sits outside the tier, and the price of the next tier up |
Send us the inventory before you request pricing. We put the same scope in front of the providers that fit and show you annual totals side by side, with the retention and response terms written in. The provider you choose pays us, so it costs you nothing.
In-House vs Outsourced SOC vs Co-Managed
There are four ways to cover security operations, and most companies end up in the middle two. If an in-house SOC is the right answer for you, we will say so, and the arithmetic above is where that conversation starts.
| Model | What it means | Best for | Trade-off |
|---|---|---|---|
| In-house SOC | Your own analysts, platform and processes, 24/7 | Large enterprises with steady alert volume, data that cannot leave their control, and budget for a dozen or more security staff | A floor of about $1.86 million a year in people for two per shift (MCA calculation above), plus tools, in a field the BLS projects to grow 21 percent from 2025 to 2035 |
| Outsourced SOCSOC as a service | A provider runs detection, investigation and first response around the clock | Mid-market companies with no one watching at night | Less context about your business; response limited to what you authorize |
| Co-managed SOC | Your team and a provider split the work, often by hours or by tier | Companies with a small security team that cannot cover 168 hours a week | Needs clear handoffs, shared runbooks and one platform both sides can use |
| Managed SIEM only | The provider runs the platform; your team investigates and responds | Teams strong in investigation that do not want to run the SIEM | No 24/7 coverage unless your own team provides it |
For companies that already have a few security staff, co-managed is often the answer: the internal team keeps the business context and the daytime work, and the provider covers the 128 hours a week the team cannot. Companies whose infrastructure is also changing, through a move to hybrid cloud, a cloud repatriation or a managed private cloud, should scope the SOC for where the logs will come from after the move, not before it.
Who Needs a Managed Security Operations Center
CMMC Level 2 rests on the 110 security requirements of NIST SP 800-171 Revision 2, which include audit logging and incident response. Phase 2, which would have required third-party Level 2 certification from November 10, 2026, was suspended on July 13, 2026; Phase 1 self-assessments remain in place (DoD CIO). See the GCC High and CMMC enclave guide.
The HIPAA Security Rule requires audit controls that record and examine activity in systems holding electronic protected health information (45 CFR 164.312(b)). See HIPAA compliant hosting.
A material cybersecurity incident must generally be disclosed on Form 8-K within four business days of determining it is material (SEC). The clock depends on finding the incident first. See financial services colocation.
If alerts after 6 p.m. go to an inbox, the SOC question is already answered. The remaining question is which model and which provider.
The Contract Terms That Matter in a Managed SOC
Price is negotiated once; these terms decide what happens during an incident and on the day you leave. Get each one in writing before you sign.
| Term | What to get in writing | Why it matters |
|---|---|---|
| Log retention period | Searchable days and archive months, source by source | Investigations look back weeks or months. Federal agencies are held to 12 months of active storage and 18 months of cold storage for most logs under OMB M-21-31, a useful reference point for private companies too. |
| Response time commitments | Time to triage and time to notify, by severity, measured from the alert | "24/7 monitoring" without a time commitment is a description, not a promise. Ask what credit applies when a commitment is missed. |
| Who may isolate a machine | The containment actions the provider may take on its own (isolate a host, disable an account, block an address) and who approves the rest at night | In a ransomware attack, minutes matter, and a provider that must reach you first at 3 a.m. loses them. Equally, list what it must never do without a call, such as taking a production server offline. |
| Incident response retainer | Hours included, guaranteed start time, and who leads a major incident | A SOC finds incidents. A full investigation and recovery is usually separate work, and the time to arrange it is before you need it. |
| Data ownership and exit | You own the logs, the detection rules written for you and the case history; export format and timeline at termination | Without it, changing provider means starting over with no history and no tuned rules. |
| Notification for regulated incidents | How fast you are told of a likely serious incident, and what evidence the provider hands over | Disclosure clocks under SEC, HIPAA and defense contract rules run on your knowledge, which comes from the SOC. |
| Where analysts sit | Analyst locations, subcontractors, background checks and where your log data is stored | Some controlled, health and financial data carries rules on who may see it and from where. |
| Growth and renewal | Price bands as endpoints, users or log volume grow, and the cap on renewal increases | Every counting model grows with the company. The bands are easiest to set before the first signature. |
We negotiate retention, response times, isolation authority and exit terms with each provider before you choose, while they are still competing for the work. The provider you choose pays us, so it costs you nothing.
Questions to Ask SOC as a Service and Managed SIEM Providers
Alongside the contract terms above, we put these questions to each provider we bring you and get the answers in writing with its quote, so you compare coverage as well as price.
Coverage
Which of our log sources do you support today, which need custom work, and what does each cost to add later?
People
Does our account have a named team, and how many analysts at each tier actually work it?
Reporting
How are triage and notification times measured, and what do you report to us each month?
Attestations
Which audits does the SOC itself hold, such as SOC 2 Type II, and will it sign a HIPAA business associate agreement if we need one?
Five Mistakes Buyers Make With SOC as a Service
Buying a SIEM and calling it a SOC
A platform raises alerts; people decide what they mean. Without analysts working the queue at night, a SIEM is an expensive log archive.
Comparing prices across different scopes
Compare annual totals for the same log sources, retention and response authority, never a rate per endpoint or per gigabyte on its own.
Leaving response authority vague
If the contract does not say who may isolate a machine at 3 a.m., the answer during an incident is nobody, until someone answers the phone.
Under-buying retention
Breaches took an average of 247 days to identify and contain in the IBM 2026 report. Searchable logs that end before the intrusion began leave the investigation blind.
Asking providers for pricing before the requirement is written
Once a provider has priced you directly, it usually will not register an advisor on the deal, and you negotiate alone. Write the requirement first, then put it in front of the providers that fit at once.
How We Place SOC as a Service
Endpoints, users, network devices, cloud and SaaS accounts, daily log volume if you know it, the retention you need, the tools you already own, your compliance requirements and what the provider may do on its own.
The same scope goes to the SOC as a service and managed SIEM providers that fit, on the same day, each priced to an annual total with the terms above answered in writing.
Retention, response times, response authority, exit terms and price are settled before you sign. The provider you choose pays us, so it costs you nothing.
If the question is bigger than the SOC, such as where your workloads should run or a security review ahead of a transaction, that is a paid IT infrastructure consulting or data center consulting engagement, and we tell you the fee before it starts.
SOC as a Service: Frequently Asked Questions
What is SOC as a service?
SOC as a service is a security operations center run by an outside provider, whose analysts monitor, investigate and respond to security events in your environment around the clock. You keep your systems and data; the provider supplies the people, the processes and usually the platform, for a monthly fee. It is also called managed SOC, outsourced SOC or security operations center as a service.
What is managed SIEM?
Managed SIEM is a SIEM platform run for you by a provider, which connects your log sources, writes and tunes detection rules, keeps logs for an agreed period and forwards alerts. Whether its analysts also investigate and respond depends on the contract. It is also sold as SIEM as a service.
What is the difference between SIEM and SOC?
A SIEM is software that collects logs and raises alerts; a SOC is the team and the process that decide which alerts matter, investigate them and respond. A SIEM without people working its alerts around the clock does not give you 24/7 detection.
SIEM vs XDR: what is the difference?
A SIEM ingests logs from any source you connect and is the usual record for compliance retention. XDR correlates telemetry from its own sensors on endpoints, email, identity and the network in one platform and can act through those sensors. Many SOCs run both.
What is the difference between a managed SOC and MDR?
MDR focuses on detection and response starting from endpoints, often on the provider's own agent. A managed SOC watches a wider set of log sources through a SIEM, including network, cloud and applications. The two overlap heavily, so compare the scope in the contract rather than the label.
How much does SOC as a service cost?
SOC as a service is priced per endpoint, per user, per device or per gigabyte of logs ingested a day, and the scope inside the price varies more than the rate. The useful anchor is the in-house cost: by our calculation from BLS data, one seat staffed 24/7 takes about 4.9 analysts and about $928,000 a year with benefits at the national median pay, before any tools. Quotes for the same scope from the providers that fit are the only reliable price.
How is managed SIEM priced?
Managed SIEM is usually priced on log volume, in gigabytes ingested per day, and sometimes per device or per source. Retention multiplies the cost: at 100 GB a day, a year of logs is 36.5 TB before compression. Compare quotes only at the same daily volume and the same retention.
How many analysts does a 24/7 SOC need?
About 4.9 analysts for each seat kept staffed every hour of the week, by our calculation: 8,736 hours a year to cover, divided by about 1,776 hours one analyst works after vacation, sick days, holidays and training. A SOC that keeps two analysts on every shift needs about 9.8, before a lead or an engineer.
What is a co-managed SOC?
A co-managed SOC splits the work between your team and a provider, typically with your staff covering business hours or the deeper investigation and the provider covering nights, weekends and first-line triage. It fits companies with a small security team that cannot cover 168 hours a week. Clear handoffs and shared runbooks are what make it work.
What should a SOC as a service contract include?
It should include the log sources covered, how long logs stay searchable and archived, triage and notification times by severity, the containment actions the provider may take without calling you, incident response terms, and your ownership of the logs, rules and case history with an export when you leave. Price bands for growth in endpoints, users and log volume belong in it too.
How do I choose a SOC as a service provider?
Choose on scope and terms before price: supported log sources, analysts per shift and their tiers, response times, response authority, retention, exit terms and the provider's own attestations, such as SOC 2 Type II. Put the same written requirement in front of the providers that fit, so the quotes can be compared line by line.
Do you place SOC as a service?
Yes. We place SOC as a service, managed SIEM and related managed security services with the providers that fit your requirement, and negotiate scope, terms and price before you sign. The provider you choose pays us, so it costs you nothing, and you'll hear back within 24 hours.
Price Your SOC Before You Request Quotes
Send what the SOC would watch and the terms you need, using the list above. Rough numbers are fine. You'll hear back within 24 hours from the person who will run your search. If you have already spoken to one provider, tell us which; we can still run the rest of the market. Everything runs by email, so there is no sales call to book.
That is what keeps the providers competing for the work. The provider you choose pays us, so it costs you nothing.
Managed security: managed security services, managed detection and response, managed firewall services, SASE and SD-WAN and the GCC High and CMMC enclave guide.
Compliance: compliance colocation, HIPAA compliant hosting and financial services colocation.
Recovery: DRaaS, backup as a service and disaster recovery colocation.
Infrastructure and strategy: cloud migration services, cloud repatriation, IT infrastructure consulting, data center consulting and the colocation pricing guide.
