SOC: what it actually is, who really needs it, and why it costs so much

When someone says "we have a SOC" or "we need a SOC", they often mean very different things. To one person it's a Grafana dashboard, to another a Slack channel, to a third a glass-walled room with three shifts of analysts and a giant screen. In reality a SOC is a specific operational function with its own economics and its own conditions of applicability. Let's walk through it as engineers — without the marketing.

What a SOC actually is

SOC stands for Security Operations Center. Its job is narrow and clear: spot a security incident as early as possible and help stop it before it becomes a crisis.

Antivirus, firewall, MFA, backups — these are prevention. A SOC kicks in where prevention has been breached: an attacker is already inside, the phishing already worked, the account is already compromised, anomalous activity is already happening. The SOC's task is to see that within minutes, understand what is going on, and shorten the time between compromise and containment.

Technically a SOC consists of four layers:

1. Telemetry sources — where events come from: endpoints, servers, network gear, domain controllers, mail gateways, cloud services, DLP, proxies, DNS, IDS.
2. Platforms — SIEM (event collection and correlation), EDR/XDR (endpoint telemetry and response), SOAR (response automation), Threat Intelligence (subscriptions to live threat indicators).
3. Processes — response playbooks ("what to do when X fires"), escalation rules, metrics, postmortems.
4. People — analysts at L1 (intake and triage), L2 (investigation), L3 (complex cases and threat hunting), plus a platform engineer and a lead.

Strip out any one of these layers and you no longer have a SOC. Tools without people are "expensive logs". People without process are "a hot chat that runs for two weeks".

Who actually needs a SOC

This is the key question, and the honest answer is usually inconvenient for vendors selling "SOC for everyone". A business should think about a SOC when several factors line up:

• A meaningful volume of sensitive data. Customer personal data, medical, financial, legal, intellectual property. The more of "what someone would want to steal" lives in your systems, the higher the value of early detection.
• Regulation that directly or indirectly requires monitoring. GDPR, Moldova Law 195/2024, HIPAA, PCI DSS, ISO 27001, SOC 2 — most of these in some form require "a mechanism for detecting and responding to incidents".
• Size and distribution of infrastructure. When you have dozens of servers and hundreds of endpoints across multiple sites, manual log review stops scaling. One administrator physically cannot spot an anomaly in a stream of millions of events per day.
• High cost of business interruption. For a company where an hour of downtime costs tens of thousands of euros, the ROI of early detection becomes obvious.
• A clear threat profile. Targeted attacks, phishing, supply chain, insiders. If you genuinely have someone with reason to attack you in particular — not just the random wave — detection should be on a conveyor.

If three or four of these factors line up, the SOC conversation is reasonable. If none of them do, the money is better spent on basic measures with higher ROI: backups, MFA, patching, training, proper network segmentation.

Why a SOC costs what it costs

1. People — the most expensive part

To cover round-the-clock monitoring, you need at least 4–5 people on a single L1 position alone (accounting for vacations, sick leave and weekends). Add L2 analysts, at least one L3 / threat hunter, a platform engineer and a team lead — and you have at least 8–10 people on a starter functional SOC. Security analysts are scarce on the market, their salaries trend upward, and retaining them takes constant investment in training and interesting work.

2. Platforms — subscriptions and infrastructure

SIEM is usually priced by log volume per day (events per second or gigabytes). EDR/XDR — by endpoint count. SOAR — by automation count or seats. Threat Intel — separate subscriptions to commercial feeds. Add historical log retention (90 days to a year or more is required by many regulators), compute for correlations, and redundancy. Licensing alone for a mid-sized fleet easily reaches six figures in euros per year.

3. Processes — invisible but mandatory

A SOC doesn't work "out of the box". You need playbooks for specific scenarios (account compromise, anomalous file access, suspicious outbound traffic), constant rule tuning to fight false positives, tabletop exercises with the business, and threat hunting — looking for threats the alerts don't catch. All of that is ongoing work by qualified people, running in parallel with "the duty rotation".

Add the three lines together and it's clear why a fully internal SOC typically starts at around half a million euros per year for a mid-sized business and easily climbs into the millions for a large one.

What if a SOC is needed but half a million per year isn't on the table

Good news: "build your own SOC or do nothing" is a false dilemma. There are intermediate models that capture most of the value at noticeably lower cost.

Managed SOC (SOC-as-a-Service)

An outside provider builds and runs a SOC at their facility, plugs in your telemetry sources, and you pay a subscription. Analysts and platforms live on the provider side. Suits companies with no internal security team and no desire to build one. Downsides: you depend on someone else's team, SLA and playbooks, and they take months to learn the context of your business.

Co-managed SOC

The most interesting model for medium and large companies that already have an in-house security function but don't want to staff a 24/7 analyst rotation. The external team handles round-the-clock monitoring and L1/L2 response on standard scenarios; your team owns L3, threat hunting and integration with the business. Platforms can sit on the client side, on the partner side, or on the client and be plugged into the partner.

Managed Detection and Response (MDR)

A lighter version of managed SOC, focused on endpoints and email. Often sold by EDR/XDR vendors as a separate service. Cheaper than a full SOC, but the coverage is also narrower — only what their tooling reaches.

The gradual path

Often the most reasonable approach is not "buy a SOC at once" but to climb a ladder: first sort out the basics (MFA, backups, patching, asset inventory), then deploy EDR on endpoints and SIEM for critical sources, then plug in a co-managed partner for round-the-clock coverage, and only at higher maturity and scale start thinking about an in-house SOC.

What we do

We don't sell "SOC in a box". In real projects we work along two tracks:

• A joint SOC with the client's security team. Co-managed model: we integrate telemetry sources, deploy the SIEM/EDR/XDR/SOAR stack, develop playbooks and run round-the-clock L1/L2 monitoring. The client's internal security function owns L3, threat hunting and response decisions. One such project is already on our books — details are under NDA, but the project itself is acknowledged in our cases section.
• The road to a SOC. If the business isn't yet at the stage where round-the-clock monitoring makes sense, we start with predictable foundational work: centralised log collection, EDR on endpoints, DLP policies, sound backups and an incident response plan. That is exactly what later becomes the foundation of a SOC, and without which a SOC is meaningless.

An honest diagnostic conversation about whether you need a SOC, in what form, and what should be in place before it — usually takes one to two hours. By the end we either propose a transition plan with concrete economics, or we tell you straight that in your situation the money is better spent elsewhere.