SOC as a Service Pricing: What Affects Cost

What You Will Know After Reading This

• How SOC as a service pricing is built: log ingestion volume (GB/day or EPS) sets the bill, with endpoint count, cloud workloads and SLA tier as multipliers.
• The real in-house vs. outsourced math: a 24/7 internal SOC needs 6–8 analysts and runs past $1M a year; a shared multi-tenant SOC cuts TCO by 50–70%.
• What Tier 1 triage, Tier 2 investigation and Tier 3 threat hunting cost, and which SLA metrics (MTTD, MTTR) to put in the contract.
• How a managed SOC maps to ISO/IEC 27001 Annex A, SOC 2 Type II, HIPAA and DORA evidence requirements.
• Why a security assessment before signing pays for itself by sizing telemetry correctly and stripping ingestion waste out of every quote.

Table of Contents

• The Core Enterprise Reality: Why Building an In-House SOC Bankrupts Mid-Market Security Budgets
• Managed SOC Cost Matrix & SOC as a Service Pricing Scenario Math
• SOC Data Flow & Threat Pipeline
• The Ekfrazo 5-Stage Security Operations Center Service Evaluation & Budget Framework
• Where Cybersecurity Projects Fail: Hidden Ingestion Overages and Alert Fatigue
• SOC Outsourcing Qualification Matrix: When to Outsource vs. When to Build Hybrid
• How Ekfrazo Delivers Resilient, Cost-Effective Cybersecurity
• Frequently Asked Questions

The Core Enterprise Reality: Why Building an In-House SOC Bankrupts Mid-Market Security Budgets

SOC as a service pricing undercuts in-house builds because a 24/7 SOC needs 6–8 analysts, a SIEM billed per GB/day and constant re-hiring, which pushes internal costs past $1M annually.

The headcount problem starts with arithmetic, not salaries. One console seat staffed around the clock needs roughly five people once vacations, training and turnover are counted (KORE1, 2026). Add Tier 2 investigators, a Tier 3 threat hunter and a SOC lead, and the minimum viable team reaches 8–9 people before a single detection rule is written.

The salary bands make that team expensive. US base pay in 2026 runs $58K–$75K for Tier 1, $80K–$110K for Tier 2, $110K–$145K for Tier 3 and $130K–$175K for a SOC manager, with $5K–$8K night differentials on top (KORE1). Load benefits and payroll tax at roughly 30%, and payroll alone crosses $1M.

Three operational failures compound the cost:

• Alert fatigue. A single SIEM with untuned signature rules fires thousands of low-fidelity alerts a day. Tier 1 analysts triage by volume, close alerts unread, and true positives age in the queue.
• Analyst turnover. Night-shift Tier 1 seats churn fastest. Every departure costs a recruiting cycle, 3–6 months of ramp-up and a coverage gap that someone covers with overtime.
• SIEM consumption billing. Microsoft Sentinel’s analytics tier lists at $4.30 per GB pay-as-you-go in East US and $5.59 in West US (Security Boulevard, May 2026). A noisy firewall or a debug-level application log can double the bill in a month.

The cost of getting it wrong is higher still. IBM’s Cost of a Data Breach Report 2026 puts the global average breach at $4.99M, up 12% year on year, and reports $1.93M in savings for organisations that use AI and automation extensively in security. A shared, automated SOC buys that automation at a fraction of the build cost.

Evaluating Managed Security or Comparing Vendor Quotes? Stop guessing figures—Request a security assessment to audit your log telemetry and threat posture with Ekfrazo’s cybersecurity engineers.

Managed SOC Cost Matrix & SOC as a Service Pricing Scenario Math

Managed SOC cost is driven first by log ingestion volume in GB/day, then by endpoint count, cloud workload coverage, analyst tier SLAs and retention, which together set the monthly retainer.

Managed SOC Cost Matrix

Cost Driver	Typical Enterprise Range	Pricing Metric	Impact on Monthly Bill
Log ingestion volume	10–500+ GB/day; cloud SIEM analytics tier $2–$5 per GB (Sentinel $4.30 PAYG East US; effective $2.30–$3.00 at 100+ GB/day commitments)	GB/day or EPS	Highest. Every extra 10 GB/day adds about $1,290 a month at Sentinel PAYG list price
Endpoint coverage (EDR/MDR)	$8–$25 per endpoint/month for mainstream MDR; $25–$45 for platform-tied enterprise tiers	Per endpoint per month	High. Scales linearly; falls to $8–$12 at 1,000+ endpoints
Users and identities	$8–$15 per user/month for 200–1,000 users	Per user per month	Medium. Common for Microsoft 365 and identity-centric bundles
Cloud workloads	CloudTrail, VPC flow, Kubernetes audit and SaaS audit logs	Added GB/day or per cloud account	High in cloud-native estates. Flow logs are often the largest single source
Analyst tier and SLA	Tier 1 monitoring only vs. Tier 1–3 with threat hunting; mid-market retainers $5K–$25K/month	Flat retainer by SLA tier	Medium to high. Tier 3 hunting and 15-minute critical response push quotes to the top band
Data retention	90 days interactive by default, up to 2 years; data lake storage $0.026/GB/month for up to 12 years	Per GB per month	Low to medium. Set by compliance, e.g. PCI DSS requires 12 months of audit logs
Onboarding and incident response	Onboarding $5K–$25K one-time; out-of-scope IR $250–$500/hour	One-time and hourly	Spiky. Unscoped IR hours surprise finance teams after the first incident

Sources: BD Emerson, July 2026; Security Boulevard, May 2026. Published rates, not quotes.

Scenario: 500 Endpoints, 50 GB/day, Annual TCO

A 500-endpoint enterprise ingesting 50 GB/day spends about $1.30M a year running its own 24/7 SOC and about $412K on SOC-as-a-Service, a 68% reduction.

Assumptions: US salaries at KORE1 2026 midpoints, a 1.3× load factor for benefits and payroll tax, Sentinel’s 50 GB/day commitment tier in East US, and EDR licences excluded because both models need them.

Line item	In-house 24/7 SOC (USD/yr)	SOC-as-a-Service (USD/yr)
Tier 1 analysts: 5 FTE covering one 24/7 seat at $70K base	455,000	Included
Tier 2 investigators: 2 FTE at $95K base	247,000	Included
Tier 3 threat hunter: 1 FTE at $135K base	175,500	Included
SOC manager: 1 FTE at $150K base	195,000	Not needed
Night-shift differentials: 5 × $6K	30,000	Included
SIEM ingestion: 50 GB/day commitment at $161.25/day	58,856	Included (shared multi-tenant SIEM)
SOAR, threat intel feeds, case management (planning assumption)	80,000	Included
Recruiting and turnover backfill (planning assumption)	35,000	Not needed
Training and certifications: 9 × $3K	27,000	Not needed
Managed SOC retainer: Tier 1–3, 50 GB/day, 500 endpoints at $25K/month	—	300,000
Onboarding (one-time, year 1)	—	15,000
Internal vendor oversight: 0.5 FTE security lead	—	84,500
IR hours beyond retainer: 40 h × $300	—	12,000
Year-1 TCO	1,303,356	411,500
Cost per endpoint per month	217	69

Year-1 savings are $891,856, or 68.4%. Year 2 drops onboarding, so SOCaaS falls to $396,500 and savings reach 69.6%, inside the 50–70% band that shared multi-tenant SIEM infrastructure typically delivers. On Sentinel pay-as-you-go instead of a commitment tier, the in-house SIEM line rises to $78,475.

SOC Data Flow & Threat Pipeline

In a managed SOC, telemetry flows from endpoints, network, identity and cloud sources through edge filtering into the SIEM, then AI triage, tiered analysts and pre-authorised incident response.

The ingestion layer is where the bill is set, so filtering there lowers cost before a single analyst touches an alert. Tier 3 findings feed tuned detections back into the SIEM, which cuts Tier 1 noise over time.

+-----------------+ +-----------------+ +-----------------+ +-----------------+
| ENDPOINTS / EDR | | NETWORK         | | IDENTITY & SAAS | | CLOUD WORKLOADS |
| OS + EDR events | | FW, DNS, proxy  | | IdP, MFA, M365  | | CloudTrail, VPC |
+--------+--------+ +--------+--------+ +--------+--------+ +--------+--------+
         |                   |                   |                   |
         +-------------------+---------+---------+-------------------+
                                       |
                                       v
       +---------------------------------------------------------------+
       | INGESTION & EDGE FILTERING  (the cost meter)                  |
       | drop debug logs, dedupe, measure GB/day + EPS per source      |
       +-------------------------------+-------------------------------+
                                       |
                +----------------------+-----------------------+
                |                                              |
                v                                              v
 +-----------------------------+                +-----------------------------+
 | SIEM ANALYTICS TIER         |                | DATA LAKE TIER              |
 | detection-grade, ~$2-5/GB   |                | compliance-only, ~$0.05/GB  |
 +--------------+--------------+                +--------------+--------------+
                |                                              |
                v                                              | historical
 +-----------------------------+                               | search
 | AI TRIAGE & SOAR ENRICHMENT |                               |
 | correlate, enrich, suppress |                               |
 +--------------+--------------+                               |
                |                                              |
                v                                              v
 +-----------------------+   +-----------------------+   +-----------------------+
 | TIER 1: TRIAGE        |-->| TIER 2: INVESTIGATE   |-->| TIER 3: THREAT HUNT   |
 | validate, prioritise  |   | scope, contain        |   | hunts, new detections |
 | metric: MTTA          |   | metric: MTTD          |   | metric: MTTR          |
 +-----------------------+   +-----------+-----------+   +-----------+-----------+
                                         |                           |
                                         +-------------+-------------+
                                                       |
                                                       v
       +---------------------------------------------------------------+
       | INCIDENT RESPONSE                                             |
       | pre-authorised: isolate host, disable account, revoke tokens  |
       | then notify, report, and feed tuned detections back to SIEM   |
       +---------------------------------------------------------------+

The Ekfrazo 5-Stage Security Operations Center Service Evaluation & Budget Framework

The Ekfrazo framework sizes a security operations center service in five stages: telemetry volume, coverage scope, analyst SLAs, compliance evidence and incident response terms, so every quote is compared on identical scope.

Phase 1: Log Ingestion Auditing & Data Volume Sizing (GB/Day)

Measure 30 days of real telemetry before requesting quotes. Vendors price on peak or average GB/day, and a guess skews every proposal.

• Inventory every source: EDR, firewalls, DNS, proxy, identity provider, Microsoft 365 or Google Workspace audit logs, cloud control-plane logs and critical applications.
• Record average and 95th-percentile GB/day per source, plus EPS for on-premises collectors.
• Classify each source as detection-grade (analytics tier) or compliance-only (low-cost data lake tier at about $0.05/GB ingest).
• Filter at the edge: drop debug-level events, duplicate Windows events and verbose flow records that no detection rule reads.

Output: a sized telemetry baseline that typically shrinks billable analytics volume before negotiation starts.

Phase 2: Endpoint vs. Cloud Workload Coverage Mapping

Map what the SOC must see against what it will be paid to watch. Gaps between the two are where attackers dwell.

• Count managed endpoints, servers, containers and cloud accounts separately; vendors price each differently.
• Confirm the EDR in place (Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne) is supported natively, not via a generic syslog parser.
• Include SaaS and identity telemetry. Most current intrusions start with a stolen session token or OAuth grant, not malware on an endpoint.
• Flag OT, legacy and air-gapped segments that need on-premises collectors.

Phase 3: Analyst Tier SLA Evaluation (Tier 1 Triage vs. Tier 3 Threat Hunting)

Price the analysts you need, not the tier labels on the brochure. Ask each vendor to commit numbers to the contract:

Tier	Function	SLA metrics to contract
Tier 1	Alert triage, enrichment, false-positive closure	Mean time to acknowledge (MTTA) for critical alerts, e.g. 15 minutes
Tier 2	Investigation, scoping, containment actions	Mean time to detect (MTTD) and time to escalation with a written incident summary
Tier 3	Threat hunting, detection engineering, IR lead	Hunts per month, new detections per quarter, mean time to respond (MTTR)

Insist on named analysts or a dedicated pod for enterprise accounts, and a monthly report of true-positive rate per detection rule.

Phase 4: Compliance Mapping (ISO/IEC 27001, SOC 2 Type II, HIPAA, DORA)

A managed SOC should produce audit evidence as a by-product of operations. Map its deliverables to controls before signing:

Framework	Controls the SOC must evidence	Evidence the vendor should deliver
ISO/IEC 27001:2022	Annex A 5.7 threat intelligence; 5.24–5.28 incident management; 8.15 logging; 8.16 monitoring activities	Monitoring scope, incident records, lessons-learned reports, log integrity proof
SOC 2 Type II	CC7.2 anomaly monitoring; CC7.3 event evaluation; CC7.4 incident response; CC7.5 recovery	Alert-to-ticket trail across the full audit period, IR timelines
HIPAA Security Rule	164.308(a)(1)(ii)(D) activity review; 164.308(a)(6) incident procedures; 164.312(b) audit controls	ePHI system log review records, a signed BAA with the provider
DORA (EU financial entities)	Art. 10 detection; Art. 17 ICT incident management; Art. 19 major incident reporting; Art. 30 contractual terms for ICT providers	Incident classification data fast enough to meet regulatory notification deadlines, audit and exit rights in the contract

Phase 5: Incident Response Playbook Integration and Retainer Structuring

Detection without authorised response leaves the SOC watching an intrusion it cannot stop. Settle response authority and IR economics in the contract.

• Pre-authorise containment actions the provider can run without a call: isolate host, disable account, revoke sessions and OAuth tokens, block IOCs at the firewall.
• Integrate playbooks for ransomware, business email compromise, cloud credential theft and insider data exfiltration with your ITSM and on-call rota.
• Structure the IR retainer as pre-paid hours that convert to proactive work (tabletop exercises, VAPT, detection tuning) if unused, rather than expiring.
• Cap out-of-scope IR rates in writing; published rates run $250–$500 per hour.

Where Cybersecurity Projects Fail: Hidden Ingestion Overages and Alert Fatigue

Managed SOC budgets fail when ingestion spikes from debug logs and new cloud sources trigger overage fees, and when signature-only detections bury analysts in noise that hides real intrusions.

1. Debug-log spikes triple the GB/day bill. A development team switches an application to debug logging during an incident and never switches it back. Ingestion climbs from 50 to 150 GB/day. At $4.30/GB, those extra 100 GB/day add about $12,900 a month, and on a commitment tier the excess bills at the tier rate until someone notices. Fix: per-source volume alerts and a contractual cap or notification threshold on overages.

2. Signature-only detection floods Tier 1. Out-of-the-box rule packs fire on every port scan and failed login. Analysts close thousands of alerts a week by pattern, and a real credential-stuffing run looks like the rest of the noise. Fix: require the vendor to report true-positive rate per rule and retire or tune rules below an agreed threshold every month.

3. Cloud and SaaS telemetry left out of scope. The contract covers endpoints and firewalls, but the identity provider, Microsoft 365 audit log and AWS CloudTrail sit outside the SIEM because adding them raises the quote. Most modern intrusions start in exactly those sources. Fix: price identity and cloud control-plane logs in the base scope, routing low-value flow logs to the data lake tier.

4. Detection with no authority to respond. The SOC spots a ransomware precursor at 02:00 but cannot isolate the host without a customer approval nobody answers. Fix: pre-authorised containment actions and a 24/7 escalation tree written into the SLA.

3 Questions CISOs Must Ask Managed SOC Vendors Before Signing

1. How do you bill when our ingestion exceeds the contracted GB/day, and what alert do we get before that happens? Get the overage rate, the measurement window (daily peak or monthly average) and the notification threshold in writing.
2. What were your median MTTA and MTTR for critical incidents last quarter, measured across all customers? A vendor that cannot produce its own metrics cannot be held to yours.
3. Which containment actions can your analysts execute without our approval, and in which of our tools? If the answer is “none”, you are buying alert forwarding, not a SOC.

SOC Outsourcing Qualification Matrix: When to Outsource vs. When to Build Hybrid

Outsource a full SOC when you lack 24/7 staff and need coverage within weeks; build a co-managed hybrid when you own a tuned SIEM, internal detection engineers or strict data-residency rules.

Operational trigger	Outsource full SOCaaS	Build co-managed hybrid SOC
Internal security headcount	Fewer than 3 security FTEs; no night or weekend coverage	3+ analysts in-house covering business hours
Existing SIEM investment	None, or a legacy SIEM due for renewal	Tuned SIEM with multi-year licence and custom detections
Time to 24/7 coverage	Needed in 30–90 days (audit, board mandate, cyber insurance renewal)	6–12 month build is acceptable
Log volume profile	Under ~200 GB/day; benefits most from shared multi-tenant SIEM pricing	Very high GB/day where an enterprise commitment tier is already cheaper
Data residency and sovereignty	Provider can keep logs in your region	Regulation or contract forbids telemetry leaving your tenant
Detection engineering	No in-house rule authors	Internal team writes detections; provider supplies after-hours Tier 1–2
Compliance driver	Need ISO/IEC 27001 or SOC 2 Type II evidence quickly	Mature ISMS; provider evidence slots into existing controls
Budget model	Prefer predictable opex retainer	Willing to carry SIEM capex/licences and partial payroll

A common middle path: the provider runs 24/7 Tier 1–2 monitoring inside your own SIEM tenant, while your team keeps detection engineering and Tier 3 ownership. You keep the data and the institutional knowledge, and stop paying for night shifts.

How Ekfrazo Delivers Resilient, Cost-Effective Cybersecurity

Ekfrazo delivers managed security operations that tie SOC telemetry to customer, employee and operational experience, under ISO/IEC-aligned governance, so detection protects revenue journeys as well as infrastructure.

Ekfrazo’s Cybersecurity and managed security services apply the same CX, EX and OX lens the firm uses across AI and cloud automation programmes:

• CX (customer experience): detections and response playbooks prioritised around customer-facing systems, such as portals, payment flows and APIs, where an outage or breach hits revenue and trust first.
• EX (employee experience): identity-centric monitoring of SSO, email and collaboration suites, with containment actions designed to stop account takeover without locking out the workforce.
• OX (operational experience): cloud control-plane and infrastructure telemetry sized in GB/day, filtered at source and routed between analytics and low-cost retention tiers to keep ingestion spend predictable.

Every engagement starts with the same evidence: a telemetry audit, a coverage map and a posture baseline drawn from the Enterprise VAPT and security posture assessment framework. Governance runs on ISO/IEC 27001-aligned controls, so monitoring scope, incident records and lessons learned double as audit evidence for ISO/IEC 27001, SOC 2 Type II, HIPAA and DORA.

Know Your Real SOC Cost Before You Sign

Ekfrazo’s cybersecurity engineers will measure your actual GB/day, map endpoint and cloud coverage gaps, and benchmark vendor quotes against a like-for-like scope, so you buy the SOC you need and not the overage you didn’t plan for.

Request a security assessment →

Frequently Asked Questions

These answers cover SOC as a service pricing ranges, managed SOC cost drivers, staffing math and SOC outsourcing trade-offs that CISOs raise most often when comparing managed security proposals.