A compromised Microsoft 365 account, a suspicious server login or an encrypted network share does not ask whether the company has a large security budget. So the question “how much does a SOC cost?” is better approached not as the purchase of another IT tool, but as the cost of continuous threat detection and response support – before an incident stops the business.

For small and mid-sized companies there is no honest answer in the form of a single universal rate. The size of the environment, the expected level of response and the current state of security controls all move the quote significantly. What a well-configured SOC as a Service should deliver above all is predictability: the company knows what scope of protection it is paying for and which activities are actually performed.

Why a SOC does not have one fixed price

A SOC, or Security Operations Center, is a continuous security monitoring function. In practice that means collecting signals from the infrastructure, analysing alerts, judging what they mean and responding to confirmed incidents. It is not merely a software licence, nor a mailbox into which hundreds of automated notifications land.

Two companies of fifty people each can have entirely different needs. An accounting firm may live in email and Microsoft 365, a law practice may hold sensitive client documents, and a manufacturer may run servers, network devices and systems supporting production. Headcount matters, but it does not explain the whole risk picture or the effort required to monitor the environment.

The price should follow the real environment, not an assumption that every organisation needs an identical stack. An over-specified scope raises cost without a proportionate benefit. Too narrow a scope leaves gaps in exactly the areas attackers tend to use first.

The main factors behind a SOC quote

The scope of monitored infrastructure

The starting point for any quote is the number and type of sources that need protection: employee computers, Windows and Linux servers, firewalls, cloud environments, Microsoft 365 or Google Workspace accounts and key business systems.

It is not only a matter of counting devices. A server running a database or the accounting system carries different weight for continuity than a single workstation. Similarly, the email environment brings its own risks – phishing, unauthorised forwarding rules, sign-ins from unusual locations.

The level of monitoring and response

MDR – Managed Detection and Response – covers detecting threats and acting on them. Its value is not in generating alerts, but in specialists interpreting them. An alert may be routine administrator activity, or it may be the start of an intrusion. Telling those apart reduces both the risk of missing an incident and the unnecessary drain on the customer’s own team.

What matters for pricing is whether monitoring runs around the clock, what the escalation rules are, and how far the team can support activity after an incident is confirmed. A company should understand clearly who contacts its team, what information it receives and what happens outside standard working hours.

Data sources and SIEM

In some environments it is enough to focus on endpoints, cloud accounts and network devices. In others, central log collection in a SIEM is also needed. Logs are records of technical events – login attempts, permission changes, firewall activity, actions on a server.

A SIEM helps connect signals from different places. A single failed login may mean nothing, but a series of attempts from an unusual country combined with a change to a mailbox rule calls for analysis. Extending the scope to more log sources can raise the cost, but is often justified by the nature of the data, audit expectations or the complexity of the infrastructure.

The state of the environment before onboarding

The cost of deployment and ongoing service also depends on how well organised the IT estate is. Unpatched systems, no consistent asset inventory, an excess of accounts with administrative rights or unclear ownership all make monitoring and response harder.

This does not mean a company has to reach a perfect security level first. On the contrary – an initial assessment can identify the most important gaps and help set the order of work. It is worth allowing for the fact, though, that rolling out protection in a disorganised environment usually takes more effort than covering infrastructure with a known structure.

In-house SOC versus a subscription service

When comparing costs it is easy to make one particular mistake: setting a monthly service fee against the salary of a single IT hire. An in-house SOC is not one administrator and not a single EDR tool that flags suspicious behaviour on computers.

To genuinely run 24/7 security monitoring in-house, an organisation needs specialists on call, response procedures, tooling for data analysis, ongoing updates to detection rules and time to verify alerts. It also needs cover for absences, a way to develop skills, and the ability to act when an incident lands at night or over a weekend.

For most SMEs, maintaining that function internally is out of proportion to the scale of the business, both organisationally and financially. A subscription model gives access to the work of a SOC team without building a full security department. It does not remove the company’s responsibility for business decisions, patching or access management, but it provides steady support exactly where resources are usually thinnest.

How to judge whether the scope is right

The cheapest proposal does not always answer the real risk, and the largest package is not always the sensible choice. Start with concrete questions: which systems must run without interruption, where the key data sits, how many people work remotely, and whether the company uses cloud services.

Then establish which events should be detected and what happens once they are confirmed. Account takeovers, suspicious sign-ins, attempts to disable security controls, unauthorised permission changes and behaviour typical of ransomware are usually high on the list. A post-incident report is far less useful than a fast, clear message about what happened, what it affects and what should be done next.

Before signing, it is worth pinning down four areas:

which devices, accounts and services will be covered by monitoring;
whether monitoring and alert analysis run 24/7;
how escalation and incident response support actually work;
what onboarding activities, reporting and scope reviews are included.

Settling these makes it possible to compare offers properly, rather than reducing the decision to a single number on an invoice.

Compare the cost of protection with the cost of downtime

A SOC quote should be judged in the context of what an incident would do, not in isolation from the business. Downtime in the accounting system, loss of access to email, blocked order processing or the need to restore data all affect people’s work, customer relationships and the flow of operations. Not every incident leads to serious loss, but late detection usually narrows the room for manoeuvre.

Continuous monitoring does not guarantee that cyberattacks are eliminated. It does increase the chance of noticing irregularities earlier, judging the situation correctly and limiting the scale of the problem. That matters particularly in companies where the IT function is simultaneously responsible for users, servers, applications and day-to-day faults.

A well-chosen SOC as a Service should grow with the business. Start by protecting the most important parts of the environment, then review the scope again after infrastructure changes, headcount growth or new regulatory expectations such as NIS2. That keeps the cost commercially justified and makes cybersecurity a standing part of business continuity rather than a reaction after the fact.

If you would like an indicative scope and price for your environment, talk to our team. It also helps to understand the difference between MDR and SOC as a Service before comparing offers.

Chief Technology Officer (CTO). For security reasons we do not publish authors’ names – articles are signed by role only, without details identifying a specific person.

How much does a SOC cost? What drives the price of the service