Managed SOC Pricing 2026: Cost per Endpoint, Tier, Coverage

What managed SOCs actually charge, how tier-based pricing works, what is included at each tier, and what to expect for a 500-endpoint vs 5,000-endpoint contract. Vendor-neutral, no email required.

Quick Answer

Most organisations pay $5 - $50 per endpoint per month for managed SOC services, depending on tier. A 500-endpoint mid-market organisation typically lands at $30K - $300K/year.

$5 - $15

Monitoring tier

$15 - $50

Detection and response

$40 - $120

Premium with threat hunt

Three managed SOC tier patterns

Tier 1: Monitoring

$5 - $15 per endpoint per month

24/7 log monitoring, alert triage to Tier 1 standard, escalation to customer named contact. Customer owns the incident response work. Monthly operational reporting.

Best fit: SMB and lower-mid-market wanting cost-effective coverage; teams with internal incident response capability who just need detection.

Tier 2: Detection and Response

$15 - $50 per endpoint per month

Everything in Tier 1 plus active containment (isolate host, block IP, disable account on customer pre-authorisation), Tier 2 triage, named MTTC SLA, false-positive tuning included, quarterly strategic review.

Best fit: Mid-market wanting active response without standing up an in-house IR team. The typical default contract tier.

Tier 3: Premium

$40 - $120 per endpoint per month

Everything in Tier 2 plus proactive threat hunting (typically 4-40 hours / month), incident response retainer (40-80 hours / year included), digital forensics capability, compliance reporting, executive board-ready quarterly reports.

Best fit: Regulated industry, mid-market-to-enterprise, organizations under compliance audit pressure or with named board-level cyber accountability.

Coverage-hours impact on pricing

Coverage hours is the second-largest pricing lever after tier and endpoint count. Three common coverage models:

8x5 (business hours, single time zone): Cheapest tier, typically 40-50 percent discount versus 24/7. Suits low-risk profiles where after-hours incidents can wait for morning triage.
16x5 (extended hours, single time zone): Middle tier, typically 20-30 percent discount versus 24/7. Covers the typical attack peak (5pm-2am local) without paying for overnight idle.
24x7 (around-the-clock): Standard for any organization that has a meaningful breach risk profile. Required for PCI DSS, HIPAA, and most cyber insurance policies.
24x7 with named-shift continuity: Premium for the same shift handling a customer across shifts, typically 15-25 percent above standard 24x7. Reduces handover loss but rarely worth the premium except for highly-regulated estates.

Worked example: 500-endpoint mid-market organisation

A 500-endpoint mid-market organisation with 24x7 coverage and detection-and-response tier:

500 endpoints x $25/endpoint/month = $12,500/month
Annual managed SOC fee: $150,000
Plus SIEM (if co-managed): $30K-$80K annually for 50 GB/day on Sentinel or Elastic
Total year-1 cost: $180K-$230K
Versus in-house SOC for the same coverage: $600K-$1.5M (per /in-house)
Savings vs in-house: 65-85 percent at this org size

The savings ratio collapses as the organisation grows. By 5,000 endpoints, managed SOC at $25/endpoint runs $1.5M annually, which is roughly the same as a lean in-house SOC. This is the cost crossover point that drives the in-house-vs-MSSP decision discussed on /in-house-vs-mssp.

Related cost references

MSSP Pricing

Per-device, per-user, flat-rate

SOC-as-a-Service

SMB-to-enterprise tiers

MSSP RFP Template

47 questions + scoring

Contract Checklist

25 clauses to review

Frequently Asked Questions

How much does a managed SOC cost per endpoint?

Managed SOC pricing is typically $5-$25 per endpoint per month for monitoring-only tiers, $15-$50 per endpoint per month for full detection and response tiers, and $40-$120 per endpoint per month for premium tiers including proactive threat hunting and incident response retainer. A 500-endpoint mid-market organization typically pays $30K-$120K/year for basic managed SOC, $90K-$300K/year for full detection and response.

What is the difference between managed SOC and MSSP?

Managed SOC and MSSP overlap in practice but the typical mental frame differs. MSSP (Managed Security Service Provider) historically referred to broader managed-security functions including firewall management, VPN operations, and patch management. Managed SOC typically focuses specifically on the SOC function: log monitoring, threat detection, alert triage, and incident response. The pricing models also differ: MSSP often prices per-device (any monitored device), while managed SOC more commonly prices per-endpoint (every endpoint covered by EDR / endpoint telemetry). In 2026 the line is blurry; ask vendors to clarify their scope.

What is typically included in a managed SOC contract?

Standard managed SOC inclusions are: 24/7 alert monitoring on customer-provided SIEM (or vendor-provided SIEM), Tier 1 alert triage with named MTTD SLA, escalation to customer's named incident response contact, monthly operational reporting, quarterly strategic review, log retention (typically 12 months hot, 7 years cold for regulated industries), and false-positive tuning included in base. Premium-tier inclusions add: proactive threat hunting (typically 4-40 hours/month depending on tier), incident response retainer (typically 40-80 hours/year included), digital forensics capability, compliance reporting templates, and executive board-ready reporting.

Does managed SOC include the SIEM platform or do I buy that separately?

Three common models. (1) Co-managed SIEM: customer owns the SIEM license (Splunk, Sentinel, QRadar, Elastic); the managed SOC provides operations on top. Customer pays SIEM separately. (2) Vendor-provided SIEM: the managed SOC includes a SIEM in the monthly fee, typically the vendor's own platform or a reseller arrangement with a major SIEM vendor. SIEM cost is bundled. (3) Hybrid: vendor provides a primary SIEM but customer can opt to bring their own. Co-managed SIEM is the typical enterprise pattern (gives the customer data control); vendor-provided SIEM is the typical mid-market and SMB pattern (lower operational burden).

How long does it take to onboard a managed SOC?

Most managed SOC providers can be operational in 30-90 days. Phase 1 (weeks 1-2): contracting, runbook agreement, log source enumeration. Phase 2 (weeks 3-6): log source onboarding (the time-dominant step; bringing 50-200 log sources online typically takes 4-8 weeks), SIEM tuning, and rule pack deployment. Phase 3 (weeks 7-12): tier-1 triage stabilisation, false-positive tuning to under 20 percent rate, and customer escalation path testing. Plan for 90 days to full operational steady state even if the vendor claims faster.

Managed SOC tier-band pricing reflects practitioner write-ups and public quote-page disclosures from named providers including eSentire, Arctic Wolf, Huntress, UnderDefense, Critical Start, Lumifi, and Expel. No per-provider price points cited. SecurityOperationsCost.com has no commercial relationship with any managed SOC provider.