SOC as a Service and Managed SIEM

What SOC as a service includes

SOC as a service gives you a security operations center without building one: the provider supplies the log platform, the detection rules and the analysts. A security operations center is the team that watches for attacks across all your systems, and a SIEM (security information and event management) is the software that gathers their logs in one searchable place.

A typical contract covers:

• Log collection. Connectors or a small collector appliance that pull logs from your systems into the provider's SIEM.
• Detection content. Rules that spot known attack patterns, tuned to your environment so you are not flooded with false alarms.
• 24/7 triage. Analysts who review alerts, rule out noise and escalate real incidents.
• Response guidance or action. Some SOCs only notify you; others can block accounts or isolate devices through your tools. Get this in writing.
• Retention and reporting. Logs kept for a set period and monthly reports you can show an auditor or insurer.

Managed SIEM and SIEM as a service are close cousins. Managed SIEM usually means the provider runs and tunes the SIEM, sometimes one you license, while your team or MSP handles response. SIEM as a service usually means a hosted SIEM platform you subscribe to. Ask which parts are staffed by the provider and which are left to you.

When a small firm needs a SOC, and when MDR is enough

Most businesses under about 100 employees should buy managed detection and response first, not a full SOC. MDR covers the devices and accounts where most attacks land, it is priced per endpoint, and the provider takes containment action itself.

Sophos found that 79% of ransomware attacks in its 2026 study began with compromised identities, and malicious email and phishing were the top root causes ⁴. A good MDR service that also watches Microsoft 365 or Google sign-ins covers much of that ground. A SOC with a SIEM adds value when your risk sits in places MDR does not see.

Signs you have outgrown MDR alone:

• A rule or contract requires log monitoring or retention. See the compliance section below.
• You run systems with no endpoint agent: firewalls, VPNs, line-of-business servers, cloud infrastructure, door access or plant equipment.
• Exposed edge devices. Verizon's 2026 DBIR found exploited vulnerabilities were the top initial access route, at 31% of breaches ⁵. At-Bay found 80% of ransomware attacks on its insureds came through a remote access tool ⁶. Firewall and VPN logs are where those attacks show first.
• Third parties have access. Third-party involvement reached 48% of breaches in the 2026 DBIR ⁷.
• An auditor or large customer asks for evidence that someone reviews logs.

Our managed security services guide shows how SOC, MDR and the other services fit together.

What SOC as a service costs

SOC as a service for mid-market companies with 100 to 1,000 employees mostly costs $5,000 to $25,000 per month, according to a July 2026 pricing analysis ¹. Smaller firms rarely buy at that level; they buy MDR per endpoint instead.

What moves the price:

• Log volume. Many SIEMs bill by data ingested per day or by number of log sources. Noisy sources such as firewalls and domain controllers drive most of the volume.
• Retention. Keeping a year of searchable logs costs more than keeping 30 days. Match retention to what your rules or insurer require.
• Response authority. A SOC that can take action through your tools costs more than one that sends you an email.
• Platform ownership. Using a SIEM you already license (Microsoft Sentinel, for example) changes the split between license and service fees.
• Onboarding. Expect a setup project to connect sources and tune rules before alerts are useful.

Lighter options exist. Huntress lists Managed SIEM at $4.00 per source per month MSRP, with a 50-seat minimum and 12-month term for direct purchases ², typically sold alongside its MDR rather than as a full SOC. Entry-level alert forwarding runs $3 to $9 per endpoint per month ¹, but forwarding alerts to you is not the same as having analysts investigate them.

Build vs buy. The median information security analyst earned $129,180 in May 2025 ⁸. With benefits at 30% of compensation ⁹, one analyst costs about $184,500 a year including benefits, based on BLS data (our calculation). Covering every hour of the week takes several people plus the SIEM itself, which is why companies under 500 staff almost always buy this as a service.

Which log sources to send first

Start with the logs that show who logged in, what changed at the network edge, and what ran on your machines. Sending everything on day one raises the bill without making you safer.

A practical order for a 100 to 500 person company:

1. Identity. Microsoft Entra ID or Google Workspace sign-ins, MFA events, admin role changes and mailbox forwarding rules.
2. Edge devices. Firewall, VPN and remote access logs. See managed firewall services for how these are run.
3. Endpoints. Alerts and telemetry from your EDR or MDR platform.
4. Servers. Windows security event logs from domain controllers and file servers.
5. Cloud. Microsoft 365 audit logs, AWS or Azure activity logs, and key SaaS apps such as your accounting or practice management system.
6. Backups. Job failures and deletions, because attackers try to destroy backups before encrypting. See backup and disaster recovery.

Ask each provider how they bill each source, how long each is kept, and which of their detection rules use it. A source nobody writes rules for adds cost without adding protection.

Compliance drivers for log monitoring

Several rules that apply to small and midsize companies require you to record system activity and review it, and a SOC with a SIEM is the usual way to prove that you do. The rule sets the requirement; a provider helps you meet it. Confirm your own obligations with counsel or your assessor.

• HIPAA Security Rule. Requires audit controls that "record and examine activity in information systems" and procedures to regularly review records such as audit logs and access reports ¹⁰. See HIPAA compliance services.
• FTC Safeguards Rule. Covered financial firms must either run continuous monitoring or do annual penetration testing and vulnerability assessments at least every six months ¹¹. Continuous monitoring is often the more useful path for firms that are also asked about it by insurers. Firms holding data on fewer than 5,000 consumers are exempt from this provision ¹¹.
• NIST SP 800-171 and CMMC. Defense contractors handling CUI must implement the 110 requirements of NIST SP 800-171 Rev 2, which include creating and retaining audit logs and monitoring systems ¹²¹³. CMMC Phase 2 certification assessments are suspended while DoD reviews the program, but DoD says it will enforce 800-171 Rev 2 compliance during the pause ¹⁴. At CMMC Level 3, the rule requires a security operations center capability that operates 24/7 ¹³. See CMMC and NIST 800-171.
• NYDFS Part 500. New York-regulated financial companies must keep a documented asset inventory and notify DFS within 72 hours of determining a cybersecurity incident occurred ¹⁵, which is hard to do without centralized logs.

Cyber insurers also list logging and monitoring among the controls they look for ¹⁶. Our cyber insurance requirements page covers what applications ask.

How to compare SOC providers

Compare SOC providers on what their analysts will do with an alert, and on the total yearly cost at your log volume. Ask each one:

• Which SIEM do you use, and who owns the data and the license?
• How do you bill: per endpoint, per source, per gigabyte or flat?
• How long are logs kept searchable, and how long in cold storage?
• What can your analysts do without calling us, and who do you call first?
• How many alerts did a client our size see last month, and how many reached the client?
• Is incident response included or billed hourly? Do you work with our insurer's panel firms? See incident response.
• What reports will we get for auditors, insurers and customer questionnaires?

A vCISO can write the requirements, review proposals and hold the provider to its commitments. If you are under 100 staff and a rule does not require central logging, start with MDR and revisit once you grow.