Cybersecurity

How much SOC as a service costs, and what the price includes

SOC as a service buys round the clock monitoring, alert triage, investigation and some level of response, usually with log collection. Published rates run from $5 per user per month (Field Effect's stated low end) to $28 per user per month (eSentire's top tier). Most providers quote, and onboarding, log retention and incident response often sit outside the rate.

By Rajat Kapoor

Updated October 2026

Key takeaways

Of seventeen SOC and MDR providers whose pricing pages we read on 15 October 2026, six publish a figure of any kind.
Published per-user rates run from $5 per user per month (the low end of Field Effect's stated range) to $28 per user per month (eSentire Atlas Elite).
The response line varies more than any other: some services notify you, some contain a threat themselves, and full incident response is often a higher tier or a separate retainer.
Log retention is where tiers differ most quietly, from no retained logs on one entry package to a year or more on the top one.
A fixed onboarding or launch fee matters most on a small estate, because it does not shrink with your seat count.
A SOC watching your systems has nothing to do with a SOC 2 report, which is an audit priced separately.

You have been told your systems need watching around the clock, usually by an insurer, a customer's security questionnaire or an incident that landed at a bad hour, and you do not have the people to staff a security operations centre yourself. So you ask what SOC as a service costs, and the answers come back per endpoint, per user, per log source, per gigabyte, or as a request for a scoping call.

Getting this wrong rarely shows at signature. It shows later, as a log bill nobody quoted, an incident that starts with a fresh statement of work, or a service that turns out to email you rather than act. This page sets out what the rate is supposed to buy, the three ways it is metered, what providers publish on their own sites, and what usually sits outside the number. It does not rank providers.

What the monthly rate is supposed to buy

One naming note first. SOC here means a security operations centre, a team watching your systems. It has nothing to do with a SOC 2 report, which is an audit and is priced in our SOC 2 cost guide.

A SOC service has four parts, and quotes differ mainly in how much of the last two they include.

Monitoring, every hour. People, not just software, looking at what fires at three on a Sunday morning. Check whether 24/7 means analysts on shift or a team you can reach. Blumira is unusually clear about the difference: its security operations team is available 24/7 for security incidents on its Respond and Automate editions, while concierge support otherwise runs 9am to 8pm Eastern. Both are useful, and they are different promises.

Triage and investigation. Discarding the false positives, working out what the real alerts mean, and telling you what happened in plain language.

Response. The line that moves the price most. A provider can notify you, recommend an action, or take one itself: isolate a host, disable an account, kill a process. CyberQuell's published partner rate card splits its tiers on exactly this: Watch covers 24/7 monitoring, triage, escalation, isolation and containment, and Defend adds threat hunting and an incident commander with full forensic incident response. Huntress states on its pricing page that its per-unit price includes 24/7 SOC monitoring and remediation, with no add-on fee to unlock response.

The log layer. Collecting logs into a SIEM, correlating them and keeping them long enough to investigate. eSentire's Atlas packages show how much this varies inside one provider: the entry tier carries no SIEM and no log retention, the middle tier 90 days and the top tier 365.

Three meters, and why quotes refuse to line up

Every provider picks a unit, and each unit makes something different expensive.

Per endpoint, device or asset. Huntress prices managed EDR per endpoint, UnderDefense per device, and Rapid7 prices Managed Threat Complete per asset, defined on its MDR pricing page as hosts running a workstation or server operating system that sent data in the last 30 days. This meter grows with machines, so an estate with many servers or shared devices pays more than its headcount suggests.

Per user or employee. eSentire, Field Effect, BitLyft and Blumira all charge per person. Field Effect says it never charges by device, endpoint or data stream. Blumira counts knowledge workers with a corporate email address and a device, not people who log in to its platform. This meter grows with people, so it suits staff who each run several machines and costs more where mailboxes outnumber devices.

Per log source or per gigabyte. Huntress bills its managed SIEM per data source and advertises no overages. Microsoft prices Sentinel analytics ingestion pay-as-you-go or through commitment tiers reserving 100 GB to 50,000 GB a day. On a volume meter, connecting one more firewall makes you safer and more expensive at the same time.

What providers actually publish

We read the pricing pages of seventeen SOC and MDR providers on 15 October 2026. Six publish a figure.

Huntress lists managed EDR at an MSRP of $8.99 per endpoint per month, or $7.99 at 100 endpoints. Identity monitoring is $4.80 per identity MSRP and managed SIEM $4.00 per source MSRP. The standard term is 12 months, and buying direct or through a reseller carries a 50 seat minimum per product, none through an MSP.
eSentire sells Atlas Professional, Enhanced and Elite at $17, $24 and $28 per user per month up to 100 users, with a 10 user minimum, and $16.15, $22.80 and $26.60 from 101 to 250 users. Above 250, it scopes.
Field Effect says in its pricing FAQ that MDR pricing typically ranges from $5 to $25 per user per month, depending on the package, user volume and deployment, with setup and onboarding included.
Blumira lists $12, $16 and $21 per employee per month for three editions, each with unlimited log ingestion and a year of retention. Its page describes a SIEM platform with an expert team behind it, so confirm what those analysts do on your edition before comparing it.
UnderDefense states on its MDR pricing page that pricing starts at $11 per device per month.
CyberQuell publishes a channel rate card for MSPs reselling under their own brand: Watch from $1,488 a month and Defend from $2,400, with per-endpoint rates from $3.12 and $4.80 at 200 to 599 endpoints down to $1.80 and $2.40 at 800 to 6,000. That is a wholesale price, not one a direct buyer is offered.

The other eleven quote. Expel lists three packages with their contents and a request pricing button. Rapid7 custom quotes every Managed Threat Complete subscription on an annual contract. BitLyft and Vijilan price per user or per endpoint and release the figure only after a form, and Arctic Wolf carries no pricing page at all.

So the published per-user span for direct buyers runs from $5 per user per month (the low end of Field Effect's stated range) to $28 per user per month (eSentire Atlas Elite). Per-endpoint figures start at $8.99 list (Huntress managed EDR). The scope behind each figure differs, so read these as the edges of what is disclosed, not as a budget.

What sits outside the rate

This is where two quotes with the same headline number come apart.

Onboarding and launch fees. eSentire charges a launch and optimisation fee of $2,500 a year regardless of user count. At its 10 user minimum on the entry tier, the subscription is $2,040 a year, so the fee is larger than the service. Blumira charges a required one-time onboarding fee of $500 on Detect and $250 on Respond, included on Automate. Huntress says it has no separate setup or onboarding fees, and Field Effect includes onboarding in every package.

The licence underneath. Some providers run their own stack inside the rate; others operate yours and leave the licence with you. CyberQuell's card excludes the Microsoft licences clients keep buying directly. Vijilan says its ThreatRespond service runs over the EDR you already own, so that licence stays yours and is not in its number. If the service runs on Sentinel, Microsoft's ingestion bill is a second invoice.

Log volume and retention. Ask what happens when ingestion grows and how long logs stay searchable. eSentire sells extended log storage as an add-on at $1 per user per month. Field Effect keeps 90 days on its lower packages and up to seven years on MDR Complete.

Incident response hours. Containment is often included; a full investigation after a breach often is not. eSentire includes a digital forensics and incident response retainer only in Elite. BitLyft lists an incident response engagement only on its Premium plan, and Field Effect lists its incident response retainer as an upgrade. Ask how many hours are included and what the rate is after them.

Frequently asked questions

How much does SOC as a service cost?

Most providers quote after scoping, so a published price is the exception. Of seventeen SOC and MDR providers whose pricing pages we read in October 2026, six publish a figure. Per-user figures run from $5 per user per month, the low end of Field Effect's stated range, to $28 per user per month for eSentire's top Atlas tier, and per-endpoint figures start at $8.99 list for Huntress managed EDR. The scope behind each differs, so these mark what is disclosed rather than what you will pay. Onboarding fees, log retention and incident response hours frequently sit on top.

What is included in SOC as a service?

Round the clock monitoring by analysts, triage and investigation of alerts, some level of response, usually log collection into a SIEM, and regular reporting. The parts that vary are response, which ranges from notifying you to isolating hosts and disabling accounts itself, how long logs are retained, and whether a full incident response investigation is included or sold as a retainer. Ask for the included list by tier, in writing, before comparing any two prices.

Is the SIEM or log storage included in the price?

Sometimes, and the answer often changes by tier inside one provider. One published package range carries no SIEM and no log retention at its entry level, 90 days in the middle and 365 days at the top. Other providers include unlimited ingestion with a year of retention, or bill per log source. If the service runs on a SIEM you license yourself, such as Microsoft Sentinel, the ingestion bill comes from that vendor rather than the SOC provider.

Is incident response included in a managed SOC contract?

Containment usually is: isolating a machine or disabling an account during an alert. A full incident response engagement after a breach, with forensics and a report for your insurer, often is not. Several providers include it only on their top tier and sell it as a retainer below that. Ask how many incident response hours the contract includes, what the hourly rate is once they run out, and whether a new statement of work is needed to start.

Are there setup or onboarding fees for SOC as a service?

It depends on the provider, and the difference matters most for small estates. One published price list carries a $2,500 annual launch fee regardless of user count, which at a 10 user minimum on the entry tier is more than the year's subscription. Another charges a required one-time onboarding fee of $250 to $500 depending on edition. Others state they charge no setup fee at all. Ask for every fee outside the per-unit rate before comparing quotes.

Is SOC as a service related to SOC 2?

No. SOC as a service is a security operations centre run for you, a team monitoring and responding to threats on your systems. SOC 2 is an attestation report that a licensed CPA firm issues after auditing your controls. The two share three letters and nothing else. A managed SOC can produce evidence that helps a SOC 2 audit, such as logs and incident records, but it cannot give you the report, and the two are bought and priced separately.