Building a SOC or Buying One: The Numbers Nobody Puts in the Proposal

Most organisations approach this as a budget comparison and reach the wrong conclusion, because the in-house option is almost always costed as salaries plus a SIEM licence. That is the smallest part of it.

What round-the-clock coverage actually requires

Continuous coverage means a rota. Allowing for leave, sickness, training and attrition, a genuine 24/7 analyst presence needs considerably more people than the arithmetic of hours suggests — commonly in the region of eight or more analysts for a single seat covered at all times, before any senior or engineering capability.

On top of that you need someone who builds and tunes detections rather than only responding to them, someone who runs the platform, and a lead. Analysts who only triage, with no engineering function behind them, end up drowning in alerts nobody has tuned.

Then the tooling: log collection and storage, endpoint detection across the estate, threat intelligence, case management. Log storage in particular scales with your data and surprises people in year two.

And the part rarely budgeted — retention. Entry-level analysts leave quickly, especially from night rotas. Budget for continuous recruitment and training as a permanent line, not a one-off.

Where an in-house team is clearly right

• Regulation or contract requires data and monitoring to remain in-house.
• Your environment is unusual enough that generic detection performs poorly — industrial control systems, bespoke platforms, unusual architectures.
• You are large enough that the fixed cost spreads across enough systems to be sensible.
• Security is a product differentiator you sell on.

Where outsourcing is clearly right

• You need coverage now rather than in a year.
• You cannot realistically recruit and retain security staff in your location or budget.
• Your environment is mainstream, so standard detection works well.
• You need to demonstrate monitoring to clients or auditors quickly.

What a provider does not do

This is where expectations break down after signing.

They do not know your business. A provider can tell you a finance account logged in from an unusual country at 2am. They cannot tell you that this particular person is travelling this week. Context lives with you.

They usually do not remediate. Many contracts cover detection and notification only. Who isolates the machine, who resets the account, and who decides to take a system offline — confirm all three in writing.

They cannot see what you do not send. Coverage is defined by the log sources onboarded. A provider monitoring endpoints but not your cloud identity provider will miss cloud identity attacks, and the contract will not say so.

You still need someone internally. Somebody has to receive escalations, make decisions and hold the provider to account. An outsourced service with no internal owner degrades quietly — alerts get acknowledged and nothing is ever tuned.

The hybrid most organisations arrive at

Provider covers nights, weekends and first-line triage. A small internal team covers business hours, owns detection engineering with the provider, handles incident response decisions, and does the work that requires knowing the organisation.

This keeps the expensive, hard-to-staff part outside and the context-dependent part inside, which matches where each party actually has an advantage.

Questions to ask any provider

• What is the contractual time to notify for a critical alert, and is it measured and reported?
• Which log sources are included, and what does adding one cost?
• Do analysts write custom detections for us, or only run a standard rule set?
• What exactly happens when something is confirmed — notification, or action?
• Can we see our own data and the detection logic, or only your console?
• What happens to our historical data if we leave?

That last one decides whether you are a customer or a hostage.

Frequently asked questions