Managed SOC vs MDR vs In-House SOC: Which Do You Need?

Every company needs someone watching for threats around the clock. The question is who. You can build an in-house SOC, outsource monitoring to a managed SOC, or buy MDR, which adds active response. This guide explains the differences in plain language, what each option costs and covers, and how to choose the right model for your company.

What is a SOC?

A security operations center (SOC) is the team and tooling that monitors your environment for threats, investigates suspicious activity and responds to incidents. It typically runs a SIEM to collect and correlate logs, EDR on endpoints, and playbooks for how to handle each type of alert.

A SOC is different from a NOC. A NOC watches availability and performance: is the server up, is the link saturated, did the backup run. A SOC watches for attackers. Many companies need both, and our guide to outsourced NOC vs in-house NOC covers the other half.

What is a managed SOC?

A managed SOC, sometimes called SOC as a service, is an outsourced team that monitors your logs, endpoints, identities and cloud accounts 24/7. Analysts triage alerts, investigate what looks real and escalate confirmed incidents to you with context.

A managed SOC often covers a broad scope: monitoring, SIEM administration, detection engineering, reporting and compliance support. The provider may run its own SIEM or work in yours.

What is MDR?

MDR stands for managed detection and response. It includes everything a managed SOC does, plus response. When a threat is confirmed, the provider takes agreed actions immediately, such as isolating a laptop, disabling a compromised account or blocking a malicious process. For small teams, that difference matters most at 3 am.

MDR is usually built around an EDR or XDR platform, which gives analysts the ability to act on endpoints directly, not just watch logs.

EDR vs MDR vs XDR: what is the difference?

These acronyms are often mixed up because one is software and the others describe either broader software or a service.

• EDR (endpoint detection and response) is software installed on laptops and servers that detects and blocks malicious behavior.
• XDR (extended detection and response) is a platform that brings together signals from endpoints, identities, email, network and cloud to detect attacks that cross them.
• MDR (managed detection and response) is a service. Human analysts use EDR or XDR tools to watch your environment 24/7 and respond for you.

A tool alone does not stop an attack at night if nobody looks at its alerts. That is the gap MDR fills.

What about an in-house SOC?

An in-house SOC gives you full control and deep knowledge of your environment. It is also the most expensive option. Staffing a 24/7 seat takes at least five to six analysts once shifts, weekends and leave are covered, and the US median wage for an information security analyst is $129,180 a year according to the Bureau of Labor Statistics. Add a SIEM, EDR licenses, threat intelligence, training and a manager to run it all, and the annual cost quickly passes a million dollars.

Retention is the other challenge. Night shifts and alert fatigue drive turnover, and every departure takes knowledge with it.

How much do managed SOC and MDR cost?

MDR is usually priced per endpoint or per user per month. Published pricing varies widely, from under $10 per endpoint at the entry level to more than $50 for services that cover many data sources and include full response. EDR licensing alone typically costs a few dollars to around $25 per endpoint per month, depending on the product tier.

Managed SOC services are more often quoted per engagement, based on the volume of log data, the number of data sources and the level of customization. For most small and mid-sized companies, either option costs a fraction of an in-house team.

What should a managed SOC or MDR service monitor?

• Endpoints and servers through EDR.
• Identity: Microsoft Entra ID, Okta and Google Workspace sign-ins.
• Email and collaboration: Microsoft 365 and Google Workspace.
• Cloud accounts: AWS, Azure and GCP activity logs.
• Network: firewalls, VPNs and DNS.
• Critical applications and SaaS platforms.

The more of these the provider sees, the faster it can spot an attack that moves from a phished mailbox to a laptop to a cloud account.

How to choose the right model

• Choose MDR if you have a small IT team, no security staff and need threats contained even when nobody is awake.
• Choose a managed SOC if you have people who can respond but cannot watch alerts 24/7.
• Choose an in-house SOC if you are a large or highly regulated enterprise with the budget to staff it.
• Choose a hybrid if you have a security lead: keep strategy in house and let a provider cover nights and alert volume.

Questions to ask any provider

• Which data sources do you monitor: endpoints, servers, Microsoft 365, cloud, firewalls?
• What actions will you take without asking us first?
• How fast do you start triage on a critical alert?
• Do you work in our existing SIEM and EDR, or do we have to switch?
• Who owns the detection rules and logs if we leave?
• How do you hunt for threats that did not trigger an alert?
• What reports will we receive, and how often?

Red flags to watch for

• Alerts forwarded to you without investigation or context.
• No clear statement of which response actions are included.
• Vague answers about response times or who is on shift.
• Long contracts with no exit terms or data return clause.

The bottom line

For most small and mid-sized US companies, MDR offers the best balance of coverage and cost, because it turns alerts into action without hiring a team. If you already have security staff who need more hands rather than a service, consider cybersecurity staff augmentation instead. See what our managed SOC and MDR service covers.