What should your SOC provider do?
Select to filter
24/7 MDR over Alert Logic's own platform, with exposure management, log collection, SOC triage and optional Managed WAF coverage
You still own Remediation and incident-response work unless an automated response workflow or partner service is explicitly configured
Threat hunting, alert enrichment, detection-policy tuning and operational reviews around Armis Centrix
You still own Approve and execute containment through your connected security controls
Analysts investigate related logs before raising validated incidents.
You still own Containment and recovery
Read-only alert investigation with documented evidence and analyst handoff
You still own Authorize source access and maintain available evidence.
24/7 monitoring, incident investigation, threat hunting and guided mitigation
You still own Arrange certified integration and maintain system access
Automatic investigation of eligible Cloud SIEM alerts, evidence queries, recommended verdicts and suggested next steps for your team
You still own Operating Cloud SIEM, connecting sources and maintaining required credentials
24/7 monitoring, analyst triage, incident investigation, threat hunting and response guidance for eyeAlert detections.
You still own Maintain the required eyeAlert entitlement, sensors and connected data sources
24/7 validated investigations and situation reports, with optional active response
You still own Maintain tools, credentials and network mirror configuration
Around-the-clock threat hunting, investigated notifications, recommendations and reports for your existing SOC.
You still own Operating the incident queue and responding to notifications
Ongoing analyst monitoring from National Telecom Thailand.
You still own Containment and remediation
NSE partner service for SEBI-regulated entities.
You still own Remediation execution
Investigate Microsoft security alerts, Deliver actionable incident tickets, Provide case and service-status visibility
You still own Execute containment unless separately assigned
Automated investigations with remediation left to analysts
You still own Maintain alerting and the tools queried for evidence.
24/7 alert investigation, threat hunting, customer-specific escalation and remediation guidance
You still own Maintain collectors, connectivity and sufficient-quality data
24/7 network investigation, threat hunting, custom escalations and log analysis
You still own Provide network visibility and maintain source logging
Tier 1 Foundational SOC in the current quote tool.
You still own Deeper investigation
AI investigation with controlled response across connected security tools
You still own Connect the sources and grant only the required permissions.
24/7 investigation and authorized Advanced response on Acronis-protected workloads
You still own Deploy agents and configure protection plans
24/7 MDR through Arctic Wolf's Aurora platform, Concierge Security Team guidance and supported Active Response containment workflows
You still own Maintaining licenses and configuration for connected security tools
24/7 Managed XDR across selected Barracuda and third-party security controls, with SOC triage and scope-dependent automated response
You still own Confirming which XDR modules are included and which assets, users or devices are covered
24/7 SOC investigation, threat hunting, reporting and pre-approved containment through Bitdefender GravityZone
You still own Choosing the MDR or MDR PLUS scope and enabling the required GravityZone coverage
24/7 investigation and containment for purchased endpoint and identity services, with additional CompassOne modules determined by the package.
You still own Deploying and maintaining agents, cloud connectors and supported integrations
24/7 analyst triage, investigation and approved containment for high and critical cases on the Automate platform
You still own Maintaining log connections, Blumira Agent coverage and emergency contacts
24/7 investigation and configured containment on agreed security sources
You still own Provide access to contracted security tools
24/7 XDR monitoring, investigation, approved containment and scoped Talos services
You still own Maintain component licenses, configuration and API access
24/7 endpoint monitoring, investigation, containment and incident findings
You still own Keep agents, connectivity and vendor support current
24x7 MDR monitoring, investigation, false-positive reduction, alert resolution workflow, scoped response actions, coverage-gap visibility and SOC collaboration through CORR and MOBILESOC.
You still own Licensing, deploying and maintaining the EDR, SIEM, identity, cloud and other tools in scope
Customer-hosted investigation with configured SOAR response
You still own Operate the deployment and chosen model service.
24/7 triage, managed threat hunting and remote containment by CrowdStrike on the Falcon platform
You still own Deploying and maintaining required Falcon modules
Continuous endpoint monitoring, analyst investigation, proactive hunting and specified remediation
You still own Maintain endpoint deployment, required access and reachable incident contacts
24/7 investigation and containment, with coverage selected by tier
You still own Maintain connected tools, access and supported assets
AI investigation with response governed by action risk and approval
You still own Configure tool grants, data access and response authority.
24/7 Enhanced Monitoring investigation, eligible containment actions, monthly reports and scheduled analyst advice.
You still own Maintaining sensor coverage, response configuration and call-home connectivity
24/7 Dell SOC monitoring, investigation, pre-approved platform response and quarterly reporting for the contracted endpoint or XDR service
You still own Pre-approving which threat response actions Dell may take in the platform
24/7 detection and response for selected endpoint, cloud, identity, network or OT modules.
You still own Selecting the modules, sources and operating duties included in the statement of work.
AI alert investigation with permission-based containment
You still own Maintain source tools and alert coverage.
24/7 monitoring, investigation, supported containment, incident handling and account support. Hunting, Atlas SIEM retention, custom orchestration and DFIR vary by package.
You still own Licensing supported EDR and maintaining source integrations and credentials
24/7 investigation and authorized response on ESET-managed endpoints
You still own Deploy compatible ESET applications and connectors
AI triage, investigation and permitted response on a shared data model
You still own Maintain source permissions and required data delivery.
24/7 MDR investigation in Workbench with analyst-directed execution of enabled response actions.
You still own Maintaining connected tools, licenses and integration permissions
24/7 MDR over Field Effect's endpoint, cloud and network telemetry, with AROs and policy-bound active response
You still own Choosing the Active Response policy and excluding critical systems where downtime risk matters
FortiEDR alert investigation, threat hunting and agreed endpoint containment, with buyer-owned recovery
You still own Deploy and maintain endpoint agents and service access
24/7 investigation, hunting and authorized actions through licensed Heimdal modules
You still own Choose module-specific action and notification permissions
Managed endpoint, identity, and SIEM monitoring with human SOC investigation, incident reports, and supported containment actions inside the Huntress platform.
You still own Deploying agents and configuring Microsoft 365, SIEM, PSA, and ticketing integrations
Managed detection and response using AI agents for triage, investigation and configured response.
You still own Approving the systems and actions that agents may change.
Continuous investigation, automated enrichment and executed containment through connected tools, with deeper CSIRT work scoped by contract.
You still own Business context, escalation contacts and incident decisions
24/7 detection, analyst investigation, threat hunting and containment within agreed integrations.
You still own Ownership and commercial decisions for the underlying technology stack.
Forensic alert investigations with configured response workflows
You still own Keep the EDR, SIEM and other evidence sources working.
SOC investigation, escalation and configured endpoint or Microsoft 365 response for licensed and onboarded coverage.
You still own Complete SOC onboarding and license all required endpoints and Microsoft 365 accounts
CrowdStrike-backed MDR with Kroll response operations, incident investigation and scoped remediation.
You still own Maintain deployment access and covered telemetry
Network compromise detection and configured blocking with eligible Autopilot incident handling
You still own Confirming eligibility and activating Autopilot
24/7 alert triage, investigation, human-led hunting, investigation reports and authorized response through supported partners. The technology datasheet marks curated-detection support as Preview and dependent on the Google SecOps license.
You still own License Google SecOps and the required partner products, and connect supported telemetry
24/7 Microsoft-managed triage, investigation, proactive hunting, managed response recommendations and scoped remediation actions for eligible Microsoft Defender XDR incidents.
You still own Licensing and actively deploying the eligible Defender and Entra products that define service coverage
Investigate validated threats and hunt, Contain threats through agreed modules, Maintain Argus detections and case reporting
You still own Deploy agents and connect agreed sources
24/7 analyst coverage, Cortex endpoint protection, supported external telemetry, hunting and managed containment playbooks.
You still own Agreeing response authority and providing business context.
24/7 threat monitoring, analyst investigation, endpoint isolation, incident reports and quarterly threat reviews.
You still own Source connectivity, supported endpoint agents and assigned configuration work.
24/7 analyst investigation and contracted containment across supported security sources
You still own Maintain contracted telemetry sources and required licenses
24/7 Cortex incident investigation, threat hunting and scoped endpoint containment
You still own Maintain platform licenses, agents and access
Alert investigations with scoped machine quarantine
You still own Connect and maintain detection sources.
MDR on Rapid7 SIEM, exposure context, enabled response actions and remote incident response for eligible in-scope incidents.
You still own Deploying and maintaining agents, collectors, sources and response permissions
Managed endpoint detection and response with external attack-surface monitoring.
You still own Defining response authority and escalation contacts
24/7 investigation, hunting, incident documentation and policy-approved containment through Singularity
You still own License and deploy the covered Singularity modules and agents
Alert investigation and response under adjustable operating modes
You still own Choose which alert classes can progress to automatic action.
24/7 endpoint investigation, initial containment, threat hunting and configuration reports
You still own Deploy sensors and maintain policies, exclusions and endpoint inventory
Managed detection and containment with configurable response authority.
You still own Endpoint deployment and integration health
24/7 analyst monitoring, investigations, threat hunting and supported response within the Taegis environment.
You still own Deploying supported agents and maintaining integration health, credentials and access.
24/7 security monitoring, threat hunting and contracted incident response
You still own Set scope and response permissions
Continuous endpoint investigation, threat hunting, detection tuning and remote containment.
You still own Access, incident contacts and business impact decisions.
24/7 endpoint investigation, threat hunting and authorized containment
You still own Deploy and maintain endpoint agents and permissions
24/7 investigation of subscribed Trend sources and approved containment through connected products
You still own Deploy licensed products and maintain their connections
24/7 monitoring, analyst investigation, threat hunting and response to validated threats across the agreed Core scope.
You still own Providing access, environment context and tested incident contacts.
24/7 Fusion alert investigation, emerging-threat hunting and protocol-authorized endpoint containment
You still own Maintain product licenses, agents, connectivity and authorized contacts
24/7 MDR with AI investigation, human review and permitted containment
You still own Maintain connected tools, licenses and data access
24/7 investigation, authorized containment and endpoint remediation using Vectra and connected tools.
You still own Maintain tool licenses and telemetry access
24/7 investigation, permitted containment, identity monitoring and managed SIEM
You still own Maintain tool access, connectors and reliable telemetry
24/7 investigation with supported endpoint containment and connected-source monitoring
You still own License and maintain connected security products
24/7 Elements endpoint investigation, escalation and authorized containment, with optional identity MDR
You still own Deploy and maintain Elements endpoint sensors
24/7 investigations and configured containment through supported security tools
You still own Approving which response playbooks can run automatically
Shared XDR and SIEM operation with 24/7 MDR investigation and initial containment
You still own Connecting the right data sources and validating what each source is used for
Sentinel operation, 24/7 investigations and agreed threat containment
You still own Participate in incident escalation and investigation
24/7 log and network analysis, detection engineering and incident collaboration through mySOC.
You still own Monitoring priorities, asset context and required action approvals.
Managed Sentinel detection, alert investigation and coordination with the buyer's IT team.
You still own Azure subscriptions, source access and agreed detection priorities.
Maintain Sentinel connectors and health, Investigate alerts and carry out agreed response, Tune the contracted detection service
You still own Control the Microsoft tenant and source access
SIEM and XDR engineering, detection tuning and continuous investigation.
You still own Tool licenses, source-system access and configuration duties.
24/7 Microsoft MDR with alert triage, investigation, detection content, SOC analysts, scoped response and Microsoft security operating support
You still own Owning the Microsoft tenant, licenses and sources used by the service
Shared Sentinel detection operations with buyer-owned incident response.
You still own Select content changes and participate in the agreed review process
24/7 investigation, detection-rule workflow, hunting and shared portal access
You still own Maintain connected tools and access permissions
Managed Sentinel detections, 24/7 investigation and ongoing tuning
You still own Configure source systems and maintain access
Managed USM with analyst investigation.
You still own Containment and recovery
24/7 Microsoft monitoring, threat investigation, hunting and ongoing detection and platform maintenance.
You still own Platform and data control, access permissions and source coverage decisions.
24/7 monitoring, incident investigation, threat hunting and shared response playbooks through CyberProof Defense Center.
You still own Agreeing containment permissions, escalation contacts and business context.
24/7 investigation with Meridian context and predefined response workflows over contracted security tools.
You still own Selecting monitored sources and maintaining tool access and licenses
Monitoring, investigation, threat hunting, detection engineering and opt-in response over supported SIEM and security tools.
You still own Maintain the connected SIEM, tools, telemetry and permissions
Alert investigation, threat hunting, Sentinel operation and recurring detection tuning for the selected sources.
You still own Operating and configuring the source systems connected to Sentinel.
The co-managed option with responsibilities agreed during onboarding.
You still own Selected containment actions
24/7 monitoring with incident analysis, SIEM maintenance and agreed server vulnerability scanning.
You still own The Azure account and agreed access permissions.
24/7 investigation, AI alert handling, shared detection workflows and scoped response automation
You still own Approve detection changes and automation thresholds
Reveelium operation, prioritized investigation and shared incident coordination.
You still own System access, business context and agreed detection priorities.
24/7 monitoring, investigation, hunting and contracted SIEM, EDR and SOAR engineering.
You still own Tenant ownership, licenses and access duties assigned to your team.
24/7 investigation and hunting with shared XDR access and authorized response
You still own Maintain tools, source access and business context
Managed SIEM within a modular SOC-as-a-Service contract.
You still own Estate changes
Co-managed detection, investigation and response workflows through a 24/7 US SOC
You still own Agreeing source scope, tool ownership and license responsibilities
24/7 investigation, detection engineering, shared SOC workflow and contracted remote response
You still own Maintain telemetry sources, endpoint agents, credentials and licenses
Operates the customer-owned SIEM.
You still own Tenant and source systems
24/7 Microsoft-focused MXDR with ION automation, Sentinel and Defender operations, Cyber Defender investigation, threat hunting, Teams collaboration and Cyber Advisor posture work
You still own Buying and maintaining required Microsoft Sentinel, Log Analytics, Defender and Teams licensing
Changes are made inside the customer's Google SecOps environment.
You still own Source systems and access
24/7 SIEM analysis, threat hunting and recurring SOC engineering
You still own Retain internal incident decisions and operational contacts
24/7 event analysis, hosted SIEM operation, detection tuning and escalation under agreed runbooks.
You still own Data-interface maintenance, required collectors and logging changes.
24/7 SOC monitoring, analyst investigation, hosted or customer-owned SIEM operations, threat hunting, case management, guided remediation and optional Active Defense containment across supported tools.
You still own Choosing and licensing the SIEM, EDR, identity, cloud and ticketing tools in scope
24/7 investigation, containment, threat hunting and Sentinel health and ingestion management.
You still own Microsoft tenant, licensing and agreed source access.
Managed Sentinel detections, investigations and MXDR incident coordination
You still own Maintain source systems and endpoint security tools
Shared investigation and authorized containment workflows, with operating support defined by the purchased integration packages
You still own Maintain licenses, source access and connectivity
24/7 investigation, shared detection improvement and response coordination
You still own Retain an internal security owner and decision contacts
24/7 analysis with detection tuning, joint playbooks and incident guidance.
You still own Asset context, business use cases and the incident management process.
SIEM deployment and operation, 24/7 triage, threat hunting and custom detection content.
You still own Monitoring priorities, asset context and required access.
24/7 alert handling, investigation, detection engineering and operation of the security platforms assigned to Thales.
You still own Shared SOC decisions, source selection and business context.
Shared SIEM investigations, detection tuning, response collaboration and a dedicated account manager for MSP-operated tenants.
You still own Tenant access, policy decisions and agreed response permissions
Shared SIEM detection maintenance and investigation, with buyer-owned containment.
You still own Maintain SIEM hosting, licenses, source devices and log transport
Managed security tooling, 24/7 investigations and incident coordination
You still own Provide access, response permissions and log-source configuration unless separately managed
Hybrid or fully outsourced SOC operation with 24/7 monitoring, alert investigation, threat hunting, threat intelligence, SIEM and SOAR enhancement, incident response leadership and detection improvement across agreed environments.
You still own Select fully outsourced or hybrid responsibilities in the contract
Recurring SOC operations, investigation cases and contracted attack disruption
You still own Maintain tool access, permissions and escalation contacts
Managed Sentinel operations, threat hunting and authorised incident handling
You still own Provide licenses, data budgets and response permissions
24/7 Sentinel monitoring, incident handling, platform operations and reporting
You still own Maintain log sources, access and customer-defined use cases
Outsourced SOC coverage with managed SIEM, MDR, threat hunting, triage and scoped containment across existing tools
You still own Approving response authority, escalation contacts and any actions that touch production systems
Fully Managed SOC rather than the targeted Hybrid Cloud option.
You still own Access and response permissions
24/7 monitoring, investigation, SIEM detection maintenance, agreed containment and incident coordination
You still own Keeping the agreed log sources, cloud accounts, endpoint agents and business context current
Detection-tool operation, rule engineering, investigation and containment
You still own Provide access, business context and response permissions
What it costs
- Small business
- $3k to $10k a month
- Mid-market
- $10k to $40k a month
- Enterprise
- $30k to $100k+ a month
New to this?
What is a SOC provider?
A SOC (Security Operations Center) provider or service monitors your IT environment for cyber threats, investigates alerts, and either notifies you, advises your team, contains threats, shares SOC workflow, or runs most daily SOC work. Common types include alert-monitoring services, managed SIEM, MSSPs, MDR providers and SOC-as-a-Service companies.
How much does outsourcing your SOC cost?
SOC outsourcing typically costs $3,000 to $10,000 per month for small businesses, $10,000 to $40,000 per month for mid-market companies, and $30,000 to $100,000 or more per month for enterprises. Common pricing models include per-user, per-endpoint and flat monthly fees.
What is the difference between MSSP, MDR and SOCaaS?
MSSPs primarily monitor devices and forward alerts. MDR is threat-focused and includes active response actions and threat hunting. SOCaaS provides a full outsourced SOC function. In practice these categories are converging rapidly.