MDR or an Internal SOC: How to Frame the Break-Even Question
Break-even between managed detection and an in-house SOC is about coverage hours, staffing, escalation and SLA scope, not licence price. A framing.
Most MDR-versus-SOC comparisons start with a spreadsheet: provider fee on one side, salaries and tooling on the other. The spreadsheet is fine. The trouble is the first column of it, because the two options do not deliver the same thing, and a cost comparison between unlike things produces a confident wrong answer.
So settle what you are buying before you price it. Four questions do most of the work.
1. What hours must be covered, and by whom?
Attackers do not keep office hours, but your budget does. Define the coverage you need in hours per week, then ask what the realistic form of that coverage is.
Round-the-clock monitoring with human analysts is a rota problem before it is a technology problem. A single shift needs more than one person once you account for holidays, sickness, training, turnover and the simple fact that nobody can work every night. Ask whoever builds your internal case to show the rota, name by name, for a normal month and for a month with two absences. If the plan needs people you do not have and cannot hire in your location, it is not a plan.
If your risk justifies only business-hours analysis, an internal team may make sense, but be explicit about what happens at 22:00 on a Saturday. "Alerts queue until Monday" is a legitimate decision when taken knowingly. It is a disaster when discovered.
2. Who does what when something is real?
Detection is half the job. The other half is response, and this is where MDR contracts differ most.
Some services detect and notify you. Some recommend actions. Some take containment actions on your behalf within limits you pre-approve. These are different products with different prices, and the cheaper ones leave the work of acting at 3 a.m. with your own staff.
Write the escalation path as a sequence for a concrete event, for instance a compromised account with signs of lateral movement:
- Who sees the first alert, and how quickly after it fires?
- Who decides it is an incident?
- Who has the authority to isolate a machine or disable an account, and have you given that authority in advance in writing?
- Who calls whom, with what contact details, when the first person does not answer?
Run the sequence on paper with the provider, or with your internal team, and watch where the answers get vague. Authority is the usual gap. An analyst who can see an attack but may not touch anything is an expensive spectator.
3. What does the SLA actually cover?
Read the service level agreement as a lawyer reads it, not as a salesperson summarises it. Common traps, all of them framed as questions:
- What is measured? Time to acknowledge an alert, time to investigate, time to contain, or time to notify you? These differ enormously.
- From when? From the event, from detection, from the alert being created, or from the ticket being opened?
- What counts as in scope? Which log sources, which endpoints, which cloud accounts and identity systems are actually monitored? A contract that covers endpoints says nothing about your email platform or your identity provider.
- What happens on a miss? Service credits are not incident response. Ask what remedy exists when a breach occurs because an alert was missed, and what liability is capped at.
- Who owns the detection content? If you leave, do you keep the rules, the playbooks and the history of investigations? Or do you restart from zero?
The last one is the exit-cost question, and the one this publication always asks. A service you cannot leave without losing your own security history is a dependency.
4. What does an internal SOC need beyond people?
The internal option is more than analysts. Count the whole chain: the data pipeline that collects and stores logs, the detection engineering that keeps rules tuned to your environment, threat intelligence, case management, a way to test that detections still work, and the management layer that handles hiring, training and reviews. Each of those is a recurring cost and a skill that must be retained.
Count also what you lose when one person leaves. A team of a few people has no redundancy for knowledge. Document, cross-train, and price the turnover.
Framing the break-even
Replace "which is cheaper?" with a table that has the same rows for both options.
| Row | MDR | Internal SOC |
|---|---|---|
| Hours covered | per contract | per rota |
| Actions allowed without you | per contract | per your own policy |
| Log sources monitored | per scope document | per your pipeline |
| Detection content you keep on exit | ask | all |
| Cost of a missed alert | liability cap | your own loss |
| Cost to scale if you double in size | per contract | hiring |
Then price both against the same coverage target. Where the internal option reaches equivalent coverage only by cutting hours, say so in the table. Where the MDR option reaches the price only by excluding sources you care about, say that too.
Break-even is not a headcount. It is the point where your volume of telemetry, your required hours and your tolerance for dependency make one of the two options cheaper for the same outcome. The number belongs to your environment, and nobody outside it can hand it to you.
A hybrid is allowed
Nothing says the choice is binary. A small internal team can own context, decisions and response authority while a provider covers night hours and bulk triage. The condition is a clear contract about the handover: who owns an alert at which hour, and in which tool the case lives. Without that, a hybrid collects the costs of both and the accountability of neither.
Ask for the break-even table in writing before a vendor meeting. It will change the meeting.