SOC-as-a-Service Pricing: What Drives the Cost (and How to Scope It)
There is no universal price for SOC-as-a-Service. Cost is determined by the size and complexity of your environment, the compliance frameworks you operate under, the level of incident response you need, and the log volume the SOC must process. This page explains how those variables interact — and why a scoped assessment produces a more accurate number than any published price list.
Why SOC-as-a-Service Pricing Varies — and Why Published Price Lists Are Misleading
SOC-as-a-Service is not a software subscription. It is an operational program that scales with the complexity of your environment and the depth of coverage you require. A healthcare organization with 300 endpoints, a single Epic EHR environment, and HIPAA audit log requirements is a very different engagement from a defense contractor with 1,200 endpoints across three facilities, OT network segments, and CMMC 2.0 Level 2 obligations.
Providers that publish flat per-endpoint or per-user pricing are typically making significant assumptions about what is and is not included. The practical effect is that the published number grows substantially once your actual environment, log volume, and compliance requirements are applied. Scoped pricing — built around a documented understanding of your specific environment — is almost always more accurate, and usually more competitive, than a price list applied generically.
Armorstack SENTRY scopes every engagement individually. This page explains the variables that drive SOC-as-a-Service cost so that you can approach that conversation informed, evaluate competing proposals on equivalent terms, and build the business case for the right level of program for your organization. For a full explanation of what the program delivers at each layer, see SOC-as-a-Service: What the Program Delivers.
The Five Variables That Drive SOC-as-a-Service Cost
1. Environment Size and Log Volume
The most direct cost driver in any SOC-as-a-Service engagement is the volume of data the SIEM must ingest and the analyst team must monitor. Environment size is typically measured in endpoints (servers, workstations, mobile devices under management), log sources (network devices, cloud services, identity systems, applications), and daily log volume (gigabytes per day ingested into the SIEM).
Log volume is not the same as endpoint count. An organization with 200 endpoints and a complex Microsoft 365 environment, multiple cloud workloads, and an Active Directory of moderate size can generate significantly more log data than an organization with 400 endpoints operating a simpler network architecture. SIEM platforms are typically licensed or priced on log ingestion volume, and that licensing cost flows through to the SOC engagement. Understanding your current log volume — even approximately — is useful before entering a pricing conversation.
In the broader market, SOC-as-a-Service pricing is often anchored per endpoint, per user, or per gigabyte of log data ingested per day. Industry surveys and analyst coverage generally place mid-market SOC-as-a-Service programs in a range from a few dollars per endpoint per month for basic monitoring-and-alert tiers up to significantly higher per-endpoint figures for full MDR with active response, threat hunting, and compliance documentation included. The range is wide precisely because the included scope varies widely. Always confirm what is included before comparing per-endpoint numbers across providers.
2. Compliance Framework Scope
Compliance obligations add cost to a SOC-as-a-Service program in two ways: they expand the log sources that must be monitored, and they require additional documentation work to produce audit-ready evidence.
HIPAA, for example, requires monitoring of all systems that access, store, or transmit electronic protected health information (ePHI). For a healthcare organization, this means the SIEM scope typically includes EHR access logs, clinical workstations, medical device network segments, and any cloud application that touches patient data. That is a broader log source footprint than an equivalent-size non-healthcare organization. CMMC 2.0 adds similar scope requirements around Controlled Unclassified Information (CUI) access monitoring. PCI-DSS Requirement 10 specifies log retention periods and review cadences that must be documented and demonstrated.
The compliance documentation layer — generating the evidence packages that satisfy audit, examination, and assessment requirements — is real operational work. Organizations operating under multiple frameworks simultaneously (a defense contractor that is also processing credit cards, for example) should expect that compliance scope to be reflected in the program cost. The value of that documentation work is that it eliminates the manual evidence-gathering effort your team would otherwise perform before every audit.
3. Detection and Response Tier
Not every SOC-as-a-Service program includes the same level of response capability. Programs vary significantly along this axis, and the difference has material implications for your organization’s risk posture and your team’s operational burden.
At the monitoring end of the spectrum, a provider delivers alerts to your team and your team investigates and responds. This is closer to a traditional managed security services model and typically carries lower program cost. At the full MDR end, the provider investigates confirmed threats and executes active response — host isolation, credential invalidation, blocking rule deployment — without requiring your team to act first. The time between detection and containment is a primary determinant of breach impact, and that gap is much smaller under an active response model. The additional cost of the active response tier is routinely justified by the reduction in breach cost potential it represents.
SENTRY operates at the active response end of this spectrum. Armorstack is a Managed Intelligence Provider, not a monitoring-and-alert service. The response capability is not an optional add-on; it is the program model. For organizations evaluating providers at different points on this spectrum, see MDR vs. MSSP: What the Difference Means for Your Risk Posture.
4. Threat Hunting Frequency and Depth
Proactive threat hunting — hypothesis-driven analyst campaigns designed to find adversaries who have not triggered automated detection rules — is among the highest-value and highest-cost components of a mature SOC program. It requires senior analyst time, threat intelligence synthesis, and environment-specific knowledge that takes time to develop.
Programs that include threat hunting on a monthly cadence with documented hypothesis libraries cost more than programs that deliver monitoring only. For regulated industries facing sophisticated threat actors — healthcare systems targeted by ransomware groups, defense contractors targeted by nation-state APT groups — threat hunting is not optional. Reactive detection finds threats that trigger rules. Proactive threat hunting finds the threats that have established persistence and are moving laterally without triggering rules yet. The dwell time reduction from proactive hunting is among the most impactful risk reduction measures available at the program level.
5. OT/IT Convergence and Specialized Environments
Manufacturing, energy, and healthcare organizations frequently operate environments that include operational technology (OT) or industrial control systems (ICS) alongside traditional IT infrastructure. Monitoring these environments requires SIEM integrations, detection logic, and analyst expertise that differ meaningfully from standard IT monitoring. Providers who have built OT/ICS monitoring capability include that work in their program cost; providers who have not may undercount it in the initial proposal and struggle to deliver it operationally.
Similarly, organizations with complex multi-cloud architectures, hybrid identity environments, or non-standard applications may require additional SIEM engineering work during the onboarding phase. That engineering work is typically reflected in the initial program cost rather than billed as professional services after engagement start.
Build-vs-Buy Economics: The Honest Comparison
The instinct to build an in-house SOC is understandable. Internal control, direct oversight, and the perception that owned capability is more reliable than outsourced capability are legitimate considerations. The economics of the decision, however, are often poorly modeled because the full cost of an in-house SOC is spread across multiple budget lines and accumulated over time, while the cost of SOC-as-a-Service appears as a single, visible program expense.
| Cost Element | In-House SOC | SOC-as-a-Service |
|---|---|---|
| Analyst staffing (24/7 coverage) | 6–8 FTE minimum for genuine three-shift coverage; loaded cost including benefits and overhead is substantial; cybersecurity analyst salaries are above national averages and rising | Included in program; no recruiting, no benefits overhead, no attrition risk transferred to your organization |
| SIEM platform | Enterprise SIEM licensing (Splunk, Sentinel, IBM QRadar, and similar platforms) is typically a significant annual expense; implementation and engineering often require professional services or dedicated internal headcount | Fully managed; platform cost absorbed into SENTRY program; no separate licensing contract |
| Threat intelligence | Commercial threat intelligence subscriptions plus ISACs for your vertical; integration into detection rules is ongoing labor | Included; vertical-specific threat intelligence integrated into detection logic |
| Incident response capability | Either requires senior analyst capacity above the monitoring floor, or an incident response retainer with a separate firm — typically billed separately when activated | Included in SENTRY program; no separate retainer required |
| Compliance documentation | Manual effort to transform SIEM data into audit-ready evidence packages; often a significant pre-audit burden on internal team | Compliance evidence generation built into program workflow; delivered on schedule |
| Recruiting and retention | Continuous cost; cybersecurity analyst attrition is high; each departure creates a coverage gap and restarts recruiting cost | Not applicable; staffing managed by Armorstack |
| Time to first detection coverage | 6–18 months from hiring decision to operational maturity, assuming successful recruiting | 90-Day Proof delivers operational program with tuned detection within the first quarter |
The total cost of an in-house SOC is not commonly published as a single number because it does not appear as one. It is distributed across HR budgets (analyst salaries), IT budgets (SIEM and tooling licensing), and finance budgets (professional services and incident response retainers). When those elements are consolidated into a complete build cost and compared against a scoped SOC-as-a-Service program, the economics of the managed model are competitive for most mid-market organizations — often significantly so — and the in-house model does not win on capability for organizations that cannot sustain six-plus security analyst headcount.
How to Get an Accurate Number
The most useful thing you can bring to an initial pricing conversation with any SOC-as-a-Service provider is a documented answer to the following questions. Providers who ask these questions before quoting are providers building accurate proposals. Providers who quote without asking them are building estimates that will change.
- How many endpoints are in scope? (Servers, workstations, cloud instances, mobile devices under management)
- What is your approximate daily log volume? (Even an order-of-magnitude estimate — tens of GB/day, hundreds of GB/day — is useful)
- What log sources are in scope? (On-premises network infrastructure, Microsoft 365, AWS/Azure, Active Directory, OT/SCADA, point-of-sale, EHR)
- What compliance frameworks govern your organization? (HIPAA, PCI-DSS, CMMC, GLBA, SOC 2, NIST CSF, state-specific regulations)
- What level of incident response do you need? (Alert-and-notify vs. investigate-and-respond vs. full active containment)
- Do you have existing security tooling in place? (Current SIEM, EDR/XDR platform, identity monitoring, existing vendor contracts that need to integrate or be replaced)
- What does your existing security team look like? (Internal analysts who will work alongside the SOC, or no dedicated internal security staff)
Armorstack’s scoped assessment process produces a program proposal built on the answers to these questions — not on a generic endpoint count. The 90-Day Proof is an alternative starting point: deploy the full program, generate real outcomes, and use those outcomes to build the business case for the ongoing engagement. Learn about the 90-Day Proof. For how MDR pricing compares across different provider models, see MDR Pricing: How Managed Detection and Response Is Priced.
Frequently Asked Questions About SOC-as-a-Service Pricing
What is the typical price range for SOC-as-a-Service in the mid-market?
Industry analyst coverage and market surveys place mid-market SOC-as-a-Service programs across a wide range depending on included scope. Basic monitoring-and-alert programs (closer to traditional MSSP models) are priced at the lower end of the market; full MDR programs with active response, threat hunting, compliance documentation, and OT coverage are priced higher. The per-endpoint metric that many providers use as a headline number does not capture the full scope difference between programs — a low per-endpoint number with narrow included scope may cost more in total than a higher per-endpoint number that includes SIEM, threat hunting, and compliance documentation. Armorstack does not publish a standard price list because the right number for your organization depends on the specific variables described above. A scoped assessment produces the accurate figure for your environment. Request a scoped assessment.
Is it cheaper to build an in-house SOC or use SOC-as-a-Service?
For most mid-market organizations — those operating with fewer than several hundred security staff, without a dedicated security analyst bench of six or more, and without the budget to sustain a multi-million-dollar annual security operations program — SOC-as-a-Service is substantially less expensive than a correctly-built in-house SOC when all cost elements are counted. The in-house SOC cost is often underestimated because it is distributed across multiple budget lines (HR, IT, finance) rather than appearing as a single program expense. The 90-Day Proof is designed specifically to let organizations validate the cost-effectiveness of the SENTRY program with concrete outcomes before committing to a long-term engagement. See how the 90-Day Proof works.
What are the main pricing models used by SOC-as-a-Service providers?
The most common pricing anchors in the SOC-as-a-Service market are per-endpoint per-month, per-user per-month, per-gigabyte of log data ingested per day, flat monthly program fee, and hybrid models that combine a base program fee with a variable component tied to log volume or endpoint count. Each model creates different incentive structures. Per-endpoint models can undercount environments with high log-per-endpoint ratios (complex cloud environments, OT/IT converged networks). Per-gigabyte models can create bill shock in environments with log volume spikes. Flat program fee models are often the most predictable for budget planning but require accurate environment scoping at the outset. Armorstack’s scoped engagement model is designed to produce a predictable program cost based on a complete understanding of your environment — not a base rate that grows after contract signature.
Does the 90-Day Proof have a different cost structure than a long-term engagement?
The 90-Day Proof is a structured program engagement, not a discounted trial or a lite version of the SENTRY service. It deploys and operates the full program — managed SIEM, 24/7 monitoring, threat hunting, incident response, and compliance evidence generation — in your environment over 90 days. Pricing is scoped to your environment using the same variables as a long-term engagement. The value of the Proof is that it generates concrete program outcomes — threat hunting results, incident documentation, compliance evidence — before you commit to a multi-year agreement. Organizations that continue past the 90-day period transition to an ongoing engagement priced at the long-term rate. Contact us to scope your 90-Day Proof.
What compliance-related costs does SOC-as-a-Service pricing typically cover?
A mature SOC-as-a-Service program includes compliance documentation work within the program cost: log retention configured to framework-specific requirements, alert review documentation structured for audit evidence, incident reports formatted for regulatory review, and coverage assessments that map the monitoring program to specific control requirements. This work is real operational labor, and it is either included in the program or it falls to your internal team to perform manually before every audit. SENTRY includes compliance evidence generation as a standard program component for HIPAA, PCI-DSS, CMMC, NIST CSF, GLBA, and SOC 2. Complete compliance posture — governance, policy, risk assessment — is addressed through Armorstack VERITY advisory, which is a separate engagement.
Get a SOC-as-a-Service Quote Built for Your Environment
Armorstack SENTRY scopes every engagement to your specific environment, compliance obligations, and response requirements. The result is a program proposal that reflects what you actually need — not a generic per-endpoint number applied to an undifferentiated environment. Start with a scoped assessment or validate the program through the 90-Day Proof before committing.
Waukesha, Wisconsin-based. Serving regulated organizations nationally.
877-890-5508