The Economics of In-House vs Managed SOC

Every CISO eventually stands in front of the board and answers a version of the same question: why does security operations cost what it costs, and would it cost less — or work better — somewhere else? The honest answer is rarely a single number. It is an operating model decision disguised as a procurement decision, and getting it wrong is expensive in both directions: over-provisioned in-house teams that burn budget on toil, or outsourced arrangements that quietly erode detection quality until an incident makes the gap visible.

The board question behind the SOC decision

When a board asks "in-house or managed," it is almost never asking about the SOC in isolation. It is asking about risk transfer, capital allocation, and accountability. Those three variables behave differently, and conflating them is where most sourcing decisions go wrong. Risk transfer asks who absorbs the consequence of a missed detection or a slow response. Capital allocation asks whether security operations spend should look like a fixed cost center (headcount, tooling licenses, floor space) or a variable cost that scales with business risk exposure. Accountability asks who is on the hook when the auditor, the regulator, or the customer asks what happened.

A managed security service provider (MSSP) or managed detection and response (MDR) vendor can absorb operational load and some financial risk through contractual SLAs, but it cannot absorb reputational or regulatory risk — that stays with the enterprise regardless of who is watching the alerts. This is the single most under-appreciated fact in SOC economics: the CISO's name is on the breach notification letter whether the SOC is internal, external, or hybrid. That reality should shape the financial model from the first slide, not the last.

The economics conversation therefore has to start with a scoping question the finance team rarely asks unprompted: what decisions must stay inside the enterprise no matter what? Typically that includes detection logic tuning for business-critical systems, final triage decisions on anything touching regulated data, containment authority on production infrastructure, and the relationship with regulators and law enforcement. Everything else — log ingestion, correlation, tier-1 alert grooming, threat intelligence enrichment, after-hours coverage — is a genuine make-or-buy decision with real cost trade-offs on both sides.

Anatomy of the cost stack: in-house, MSSP, MDR, and hybrid

To compare models honestly, break the SOC cost stack into five layers rather than one blended number: telemetry and data platform, detection engineering, tooling and licensing, people (by tier), and governance/oversight. Vendors and internal teams both incur cost in every layer — the question is who bears it and at what markup.

Telemetry and data platform

Log and telemetry volume is the single biggest hidden cost driver in SOC economics, and it is the layer most sourcing evaluations underestimate. A mid-size enterprise (5,000–10,000 employees) commonly generates 500GB–2TB of security-relevant log volume per day once endpoint, network, identity, cloud, and SaaS telemetry are combined. At typical SIEM ingestion pricing of $2–$4 per GB per day amortized annually, that is $350,000–$2.9 million a year in data platform cost alone — before a single analyst is paid. This cost exists identically whether the SOC is internal or managed; MSSPs simply fold it into a per-endpoint or per-GB fee, often with less transparency about the underlying unit economics.

Detection engineering

Detection engineering is the layer that determines whether the SOC actually catches anything, and it is the layer most commonly under-resourced in both in-house and managed models. A mature program needs dedicated detection engineers — not analysts moonlighting between tickets — writing, testing, and tuning detections against a living threat model, mapped explicitly to MITRE ATT&CK coverage. In-house teams often skip this because headcount gets consumed by alert triage; MSSPs often skip it because detection content is shared across hundreds of clients and can't be tuned to any single environment's baseline without eroding the vendor's margin.

Tooling and licensing

SIEM, SOAR, EDR/XDR, threat intelligence platforms, case management, and identity telemetry each carry separate license costs, integration effort, and maintenance burden. In-house teams pay list price (with enterprise discounts); MSSPs often bundle tooling into the service fee using their own negotiated volume pricing, which can be a genuine 15–30% saving, or can be a mechanism for locking the client into vendor-proprietary tooling that has no portability if the contract ends.

People, by tier

This is where the AI-era operating model changes the math most dramatically, and it is covered in depth in the roles section below. The short version: the traditional tier-1/tier-2/tier-3 pyramid, built for a world without automation, is the single most expensive assumption baked into most SOC cost models, whether in-house or outsourced.

Governance and oversight

Even a fully outsourced SOC requires internal oversight capacity — someone accountable for vendor performance, SLA enforcement, escalation quality review, and regulatory liaison. Enterprises that outsource the SOC and then eliminate all internal security operations headcount typically discover this gap during their first serious incident, when there is no one internally who understands the environment well enough to direct the vendor's response in real time.

The hidden costs nobody puts in the RFP

Every SOC sourcing decision I've reviewed with finance teams focuses on the visible line items — license fees, headcount, the MSSP quote — and misses at least half the real cost. The hidden costs matter because they are frequently the deciding factor between a model that looks cheaper on paper and one that is actually cheaper in practice.

• Alert fatigue attrition cost. Tier-1 analyst turnover in traditional SOCs commonly runs 20–40% annually, driven directly by repetitive, low-context alert triage. Recruiting and onboarding a replacement analyst costs roughly 6–9 months of fully loaded salary once training, ramp time, and lost productivity are counted. A 12-analyst SOC with 30% turnover is quietly spending $400,000–$700,000 a year just replacing people, a cost that never appears on a SOC budget line but shows up as permanently degraded detection quality.
• Integration and onboarding cost with MSSPs/MDR. Vendors quote a per-endpoint or per-user monthly fee, but the 90–180 day onboarding period — log source integration, use-case tuning, escalation runbook development — is frequently under-scoped and under-staffed on both sides, producing a detection quality gap in the exact window when the enterprise is most exposed (having just transitioned coverage models).
• Context loss at handoff. Every escalation from an outsourced tier-1 to an internal tier-3 analyst or incident commander loses institutional knowledge — the vendor doesn't know that the finance server always spikes CPU at month-end, or that a particular service account is a known false-positive generator. That context has to be rebuilt in every escalation, adding minutes to hours of mean time to respond (MTTR) that never shows up in the vendor's own SLA reporting because the SLA clock often starts at ticket creation, not at true detection.
• Shelfware tooling. Gartner and independent surveys consistently find that enterprises use well under half of purchased SIEM/SOAR/XDR capability. In-house teams buy capability they don't have engineering time to configure; MSSPs sometimes require specific tooling as a condition of the contract, forcing a parallel, redundant purchase.
• Compliance re-work. Auditors increasingly require evidence of detection coverage mapped to specific frameworks (NIST CSF, ISO 27001, DORA, NIS2). Retrofitting that evidence after the fact — because neither the in-house team nor the MSSP tracked it as a first-class artifact — is a recurring, budgeted-nowhere cost during every audit cycle.

Detection engineering as the real differentiator

Strip away the marketing language and the actual product of a SOC — in-house or managed — is detection quality: the rate at which real threats are caught relative to noise, measured against the specific threat model of the specific enterprise. Everything else (dashboards, reporting cadence, ticketing workflow) is operational scaffolding around that core output. Yet detection engineering is consistently the least-funded function in both operating models, because it produces no visible ticket volume and its value is only obvious in hindsight, after a missed detection.

A mature detection engineering function operates as a continuous loop, not a project: threat intelligence and red-team findings feed new hypotheses, engineers write and version-control detection logic (increasingly as detection-as-code in a Git-backed pipeline), each detection is validated against attack simulation before production deployment, and every detection is tied to a specific ATT&CK technique with a documented false-positive rate and owner. Enterprises that treat detection content as something the SIEM vendor or MSSP provides out of the box are, in practice, defending against last year's generic threat landscape rather than their own actual attack surface.

This is also where AI genuinely changes the economics rather than just the marketing copy. Large language models and correlation engines can now do first-pass hypothesis generation — proposing candidate detections based on observed telemetry gaps, auto-drafting detection logic from a described technique, and continuously scoring existing detections against live traffic to flag ones that have gone stale or noisy. This does not replace detection engineers; it changes their unit economics, letting a smaller team of senior engineers cover a larger detection surface because the AI handles the first draft and the ongoing tuning telemetry, while humans retain judgment on what to deploy and what risk it's worth accepting. Platforms built around an AI-native security stack are specifically designed around this division of labor rather than bolting automation onto a legacy rules engine after the fact.

The financial implication for sourcing decisions: when evaluating an MSSP or MDR vendor, ask not "how many detections do you have" but "show me your last quarter's detection engineering backlog, your false-positive reduction rate, and your ATT&CK coverage map for our specific industry." A vendor that can't produce that data in a sales cycle won't produce it during a contract, and the enterprise will be buying triage capacity, not detection capability.

Rebuilding roles for the AI era

The tier-1/tier-2/tier-3 SOC pyramid was designed for a world where humans had to read every alert because nothing else could. That assumption no longer holds, and enterprises that keep the pyramid structure while adding AI tooling on top of it end up paying for both the old headcount model and the new technology, without capturing the savings or the quality improvement either should deliver.

The AI-era operating model restructures around three functions rather than three tiers of the same function:

1. Autonomous triage layer. AI-driven correlation and enrichment handles the volume work that used to consume tier-1 analysts: deduplication, enrichment with threat intelligence and asset context, initial severity scoring, and closure of confirmed false positives with full audit trail. This is not "AI suggests, human clicks approve" for every alert — that preserves the bottleneck. It is autonomous closure of high-confidence benign alerts with sampling-based human quality review, and automatic escalation of genuinely ambiguous or high-severity findings. Solutions purpose-built for this, such as AI-driven XDR alert triage, are explicitly designed to compress what used to be a 20-minute manual triage into a sub-second automated decision for the 70–85% of alerts that are unambiguous.
2. Investigation and response function. Human analysts move from being alert-readers to being investigators and decision-makers, spending their time on the 15–30% of cases that require judgment: correlating across data sources the AI flagged as related but didn't auto-resolve, determining business impact, and making containment calls. This role requires deeper skill than legacy tier-2, and should be compensated and titled accordingly — "security analyst" undersells what the role has become.
3. Detection engineering and threat hunting function. As described above, this is the function that determines whether the SOC is actually good, not just busy. In the AI-era model this team also owns tuning the AI triage layer itself — reviewing its false-negative rate, adjusting confidence thresholds, and treating the automation as a system requiring the same engineering discipline as any other detection content.

This restructuring changes headcount ratios materially. A legacy 24x7 SOC covering a mid-size enterprise commonly needs 12–16 analysts to maintain follow-the-sun tier-1/tier-2 coverage. An AI-augmented operating model covering the same environment can typically run with 5–8 people once autonomous triage absorbs routine volume — not because fewer humans are watching, but because the humans remaining are doing higher-value work and the AI layer never sleeps, never has attrition, and doesn't experience alert fatigue. The remaining budget doesn't have to disappear as pure savings; well-run programs reinvest a portion of it into detection engineering headcount and threat hunting capacity that the legacy model could never afford.

Metrics that matter, and the ones that mislead

SOC metrics have historically rewarded activity over outcome: tickets closed, alerts handled per shift, average handle time. Every one of those metrics can be gamed by lowering detection sensitivity, and every one of them is a poor proxy for whether the enterprise is actually safer. A board-credible metrics framework needs to separate leading indicators of detection quality from lagging indicators of operational performance, and it needs to be identical whether the SOC is internal, outsourced, or hybrid — otherwise vendor comparisons are meaningless.

Detection quality metrics

• MITRE ATT&CK coverage percentage, measured against techniques relevant to the enterprise's actual threat model, not a generic industry template.
• True positive rate on escalated alerts, tracked over time; a declining rate signals detection content drift or over-tuning to reduce volume rather than improve accuracy.
• Mean time to detect (MTTD), measured from first malicious activity (established via purple-team exercises and retrospective log analysis), not from alert generation — the latter flatters any environment with poor initial detection coverage.
• Dwell time on confirmed incidents, the gold-standard lagging indicator; industry benchmarks (Mandiant, IBM Cost of a Data Breach) put average dwell time in the 190–250 day range for organizations without mature detection programs, versus single-digit days for mature AI-augmented programs.

Operational performance metrics

• Mean time to respond (MTTR), from confirmed detection to containment action, split by severity tier.
• Escalation accuracy, the percentage of tier-1/AI escalations that tier-2/3 confirms as genuinely requiring human judgment — a low number indicates the triage layer is either too conservative (costing analyst time) or too aggressive (missing real threats by auto-closing).
• Alert-to-analyst ratio and analyst utilization, tracked to catch burnout before it produces attrition.
• Cost per investigated incident, which is the metric that actually maps to the board's financial question and should be reported alongside, not instead of, detection quality metrics.

Analyst experience metrics

This category is new to most SOC scorecards and belongs there because it is a leading indicator of both detection quality and cost. Track voluntary attrition rate, time-to-productivity for new hires, percentage of shift time spent on investigation versus repetitive triage, and a periodic analyst-reported "signal-to-noise" satisfaction score. A SOC where analysts spend 80% of their time on repetitive triage will lose its best people to burnout within 18 months regardless of pay, and the resulting institutional knowledge loss degrades detection quality faster than any tooling gap.

A worked total cost of ownership example

Consider a representative mid-size enterprise: 6,000 employees, hybrid cloud and on-prem infrastructure, moderate regulatory exposure (PCI and a regional data protection regime), and roughly 800GB/day of aggregate security telemetry. The table below models three-year total cost of ownership across four operating models, using conservative industry-typical unit costs (fully loaded analyst cost of $110,000–$160,000 depending on tier and region; SIEM/XDR platform cost of $2.50/GB/day amortized; MSSP/MDR pricing at typical per-endpoint rates for a 6,000-seat environment).

Two things stand out from this modeling exercise, and they hold across most mid-size enterprise environments we've examined. First, the legacy in-house model is almost always the most expensive on a pure dollar basis while frequently delivering the weakest 24x7 coverage, because it pays fully-loaded salaries for a coverage pattern the model isn't structured to deliver efficiently. Second, the AI-augmented hybrid model has a higher year-one cost than pure outsourcing — the platform build and detection engineering investment front-load spend — but crosses over to the lowest steady-state cost by year two, while retaining the accountability, tuning capability, and institutional knowledge that pure outsourcing sacrifices. The crossover point matters for CFO conversations: hybrid AI-augmented models should be pitched on three-year TCO, not year-one price, and any vendor or internal proposal that only shows year-one numbers is hiding the part of the comparison that actually favors it or disfavors it.

The hybrid model: co-managed done right

Most enterprises don't actually face a binary choice, and the most financially and operationally sound programs we see are explicitly hybrid — not as a compromise, but as a deliberate architecture that assigns each function to whoever can execute it best at the lowest total cost of risk. Getting this right requires a clear division of labor rather than vague "co-managed" language in a contract.

A well-structured hybrid model typically keeps the following internal: detection engineering for business-critical and crown-jewel systems, final containment authority on production environments, regulatory and law enforcement liaison, identity and privileged access governance (an area where the blast radius of an error is too large to delegate — see identity and privileged access management as a discipline that increasingly sits at the center of both detection and containment decisions), and the vendor performance management function itself. It typically outsources or automates: after-hours and weekend tier-1 triage, high-volume log correlation and enrichment, commodity threat intelligence feeds, and first-pass investigation on lower-criticality assets.

The mechanism that makes this work is a shared platform rather than a shared ticket queue. When the enterprise owns the SIEM/XDR data platform and grants the managed partner scoped, audited access to operate within it — rather than shipping logs into the vendor's proprietary console — the enterprise retains portability (the vendor can be replaced without a data migration project), retains the institutional detection content built over time, and retains the ability to pull specific functions back in-house incrementally rather than as an all-or-nothing re-insourcing project. This is the architecture pattern behind what we describe as an agentic SOC model: autonomous agents handle defined categories of work under enterprise-owned governance, human specialists handle judgment calls, and the operating boundary between "automated," "outsourced," and "internal" is a configuration decision, not a re-platforming project.

Analyst experience as a financial variable

Security leaders routinely treat analyst experience as a culture topic rather than a financial one, but the math is direct: attrition cost, ramp time, and error rates from fatigued analysts all show up as either explicit spend or implicit risk. A SOC that cannot retain senior analysts past 18 months will never build the institutional knowledge required for genuinely fast detection or accurate escalation, no matter how much is spent on tooling.

Three structural changes drive measurable retention improvement. First, restructure work allocation so analysts spend the majority of their time on investigation rather than repetitive triage — this is the direct payoff of the AI triage layer described earlier, and it should be explicitly measured and reported as a retention metric, not just an efficiency metric. Second, build career progression paths that don't require leaving security operations to advance — senior investigator, detection engineer, and threat hunter tracks that pay and promote on par with adjacent engineering roles, rather than the traditional model where the only path up is out of the SOC entirely. Third, invest in tooling that gives analysts confidence in the escalations reaching them — nothing burns out a senior analyst faster than an AI triage layer with a high false-negative rate that makes every escalation suspect and every closed alert a source of anxiety.

The financial case for this investment is straightforward once attrition cost is modeled explicitly. Using the earlier example of a 30% attrition rate costing $400,000–$700,000 annually in replacement cost alone, a program that reduces attrition to 12–15% through better work design and career structure recovers roughly half that cost annually — often enough to fund the entire detection engineering headcount increase the program needs anyway. Retention and detection quality are not competing budget lines; in a well-designed program they fund each other.

Governance, compliance, and sovereign environments

Regulatory exposure changes the make-or-buy calculus materially, and it is the variable most often underweighted in pure cost comparisons. Frameworks like DORA, NIS2, and sector-specific regimes increasingly require demonstrable, auditable evidence of continuous monitoring, incident response timelines, and third-party risk oversight — obligations that don't disappear when the SOC is outsourced, they simply add a vendor oversight layer on top of the existing compliance burden. Enterprises in regulated industries frequently find that a fully outsourced SOC actually increases their compliance workload, because they must now audit the vendor's controls in addition to maintaining their own evidence trail.

Air-gapped, sovereign, and classified environments add a further constraint that simply eliminates cloud-delivered MSSP and MDR models as options for at least the highest-sensitivity segment of the environment: no external telemetry egress, no cloud-hosted console, and often no persistent internet connectivity for the monitored systems at all. These environments require a genuinely self-contained operating stack — detection, correlation, and even AI-driven triage running entirely within the sovereign boundary, with no dependency on external threat intelligence feeds or cloud-hosted model inference. This is a segment where the in-house-versus-managed framing breaks down entirely and the real question becomes whether the platform architecture itself can be deployed on-prem or air-gapped without losing the AI-driven triage and detection engineering capability that makes the AI-era operating model economically viable in the first place. Enterprises operating in this segment should treat platform deployability — can this run fully disconnected, with model inference local rather than API-dependent — as a gating requirement before any cost comparison, not an afterthought.

Continuous exposure management compounds this governance question, because detection quality is only half the SOC's value; understanding what the organization's actual attack surface looks like at any given moment — exposed assets, unpatched systems, misconfigured identities — determines what detections even need to exist. Programs that pair SOC operations with a live continuous threat exposure management practice consistently show better detection engineering prioritization, because engineering effort goes toward the attack paths that actually exist in the current environment rather than a generic industry threat model.

A decision framework for the sourcing choice

Rather than a single build-versus-buy verdict, use a structured framework that scores the enterprise against five dimensions and lets the score, not intuition, drive the model selection.

1. Regulatory and sovereignty constraints. Is there a hard requirement for data residency, air-gapped operation, or specific accountability chains that no external vendor can satisfy? If yes, weight heavily toward in-house or sovereign-deployable hybrid.
2. Scale and coverage economics. Is the enterprise large enough to amortize a full internal 24x7 team across enough analysts to avoid single points of failure (generally 4,000+ employees with meaningful infrastructure complexity), or is coverage cheaper bought at scale from a vendor spreading cost across many clients?
3. Detection engineering maturity and appetite. Does the organization have, or is it willing to build, a genuine detection engineering discipline — version-controlled content, ATT&CK mapping, continuous validation? If the honest answer is no, a managed model with a strong detection engineering track record will outperform an in-house team that treats detection content as a one-time SIEM configuration task.
4. Talent market access. Can the enterprise realistically recruit and retain senior detection engineers and investigators in its region and compensation band? If the local talent market is thin, a hybrid model that concentrates scarce internal talent on judgment-heavy work while buying commodity triage capacity externally is usually the financially rational answer.
5. Tolerance for platform ownership. Does the enterprise want to own its data platform and detection content as a long-term asset (supports easier vendor switching, internal AI/ML investment, and M&A integration), or is it comfortable with the portability trade-offs of a fully vendor-native stack in exchange for lower operational burden?

Enterprises scoring high on regulatory constraint and low on talent market access consistently land on the sovereign-capable hybrid model described earlier. Enterprises scoring low on regulatory constraint and low on scale are usually best served by a modern MDR relationship with strong SLA accountability, revisited on a two-year cycle as the business grows. The mistake to avoid is defaulting to whichever model matches the CISO's professional background — a CISO who came up through an internal SOC tends to over-weight in-house control, and a CISO who came up through a vendor tends to over-weight outsourced efficiency. The framework exists specifically to counter that bias.

A practical roadmap for transformation

Enterprises rebuilding their SOC operating model rarely succeed by flipping a switch from legacy tiered staffing to AI-augmented hybrid in one project. The programs that work follow a staged sequence over 12–18 months.

• Phase 1 — baseline and instrument (months 1–3). Establish the true current-state metrics described earlier — actual dwell time via retrospective analysis, actual MTTD/MTTR, actual attrition and cost-per-analyst — before changing anything. Most programs discover their baseline is worse than assumed once measured honestly.
• Phase 2 — consolidate the data platform (months 2–6). Bring telemetry into an enterprise-owned platform if it isn't already, specifically to preserve optionality for whatever sourcing model phase 4 selects. This is the step most frequently skipped, and skipping it is what locks enterprises into whichever vendor they happen to be using at the time.
• Phase 3 — stand up the AI triage layer against a defined alert subset (months 4–9). Start with a bounded, well-understood alert category (e.g., phishing-derived endpoint alerts, or known-benign identity anomalies) and prove autonomous closure accuracy against a human-reviewed sample before expanding scope. This builds internal trust in the automation incrementally rather than asking analysts to trust a black box on day one.
• Phase 4 — re-score the sourcing decision and re-allocate headcount (months 8–12). With real baseline metrics and a proven triage layer, re-run the decision framework above. Reallocate headcount freed from tier-1 volume into detection engineering and investigation roles, with explicit new job descriptions and compensation bands rather than just relabeling existing roles.
• Phase 5 — formalize the hybrid governance model (months 10–18). Lock in which functions are permanently internal, which are vendor-delegated, and which are AI-automated, with a documented review cadence (typically annual) rather than leaving the boundary implicit and subject to drift.

Framing the decision for the board

When this analysis reaches the boardroom, the framing that lands is not "in-house versus managed" but "what is our target dwell time and cost-per-incident, and which operating model gets us there fastest at acceptable risk." Boards respond to that framing because it converts a technical sourcing debate into the same risk-and-return language used for every other capital allocation decision they make. It also creates accountability that survives personnel changes: whoever runs the SOC in three years inherits a specific numeric target, not a vague mandate to "improve security operations."

The financial narrative that resonates most consistently pairs a near-term cost story with a risk-reduction story, because boards discount pure cost-savings pitches from security leaders (correctly, since security spend rarely nets out to pure savings) but respond well to a credible claim that a given investment reduces expected loss from a breach scenario by more than it costs. Modeling this requires pairing the SOC transformation business case with the organization's own breach cost estimates — regulatory fines, customer attrition, incident response and legal cost, business interruption — rather than presenting SOC cost in isolation. A three-year TCO reduction from $3.2M to $1.5M is a good story on its own; paired with a credible claim that mean dwell time drops from 200 days to under 10, it becomes a story the board actually acts on rather than merely approves.

Frequently asked questions