Compliance-first delivery
A security operations centre (SOC) is the people, process and tooling that watch your environment for threats, investigate alerts and respond to incidents. Whether you build one or buy one as a service, the job is the same: collect the right telemetry, detect what matters, and contain it quickly — at 3am on a Sunday as reliably as at 11am on a Tuesday.
A managed SOC / MDR service gives you a provider's analysts, detection content and on-call rota. An in-house SOC means hiring your own team and running the SIEM, EDR and runbooks yourself. Many organisations end up somewhere in between. Here is how the options compare on the things that actually decide it.
Managed SOC / MDR vs in-house soc
Where each option is strong, where it depends on your situation, and where it is weak.
| What matters | Managed SOC / MDR | In-house SOC |
|---|---|---|
| Time to first coverage | Weeks of onboarding: connect log sources, tune detections, agree runbooks | Months: hire, deploy and tune a SIEM, write playbooks |
| True 24/7 coverage | Shared rota run by the provider | One seat 24/7 needs about five people once shifts, leave and training are counted |
| Hiring & retention risk | Carried by the provider | Yours — experienced analysts are scarce and move often |
| SIEM / EDR tooling | Provider-run, or provider operates your existing tools | Licensed, integrated, tuned and upgraded by you |
| Detection breadth | Content and lessons reused across many environments | Built from your own incidents and research |
| Context on your business | Built through onboarding, asset lists and runbooks | Native — your team knows the systems and people |
| Response authority | Agreed in advance: contain, isolate, escalate | Full — your team can act on anything |
| Cost structure | Subscription, usually scaled by endpoints, users or data volume | Salaries, tooling, training and management overhead |
| Data handling | Logs processed by a third party under contract and DPA | Stays entirely within your control |
What a managed SOC actually includes
Most managed SOC and MDR services combine round-the-clock monitoring, alert triage and investigation, and some level of active response — for example isolating an endpoint or disabling a compromised account. Good providers also run threat hunting, maintain detection rules for new attack techniques, and report on what they saw and what they changed.
What differs between providers is the response authority (do they act, or just email you?), the log sources they cover (endpoints only, or cloud, identity and SaaS as well), and how much of the tooling is theirs versus yours. Always ask for a sample incident report and the escalation matrix before signing.
What it really takes to build in-house
A credible in-house SOC needs more than a SIEM licence. You need analysts across all shifts, a senior lead, detection engineering, documented playbooks, an incident response plan that has been rehearsed, and a way to keep skills current. Covering a single seat around the clock — 8,760 hours a year — takes roughly five full-time people once you allow for shifts, weekends, holidays, sickness and training.
The upside is real: deep knowledge of your systems, full control over priorities and data, and the ability to act instantly. For large or highly regulated organisations, or those with unusual environments, that control can be worth the cost.
The hybrid model
Many mid-size and larger organisations run a hybrid: a small internal security team owns risk, architecture, compliance and business context, while a managed partner provides the overnight and weekend coverage, first-line triage and specialist incident response. The internal team stays focused on improving defences instead of watching dashboards, and the partner escalates with context rather than raw alerts.
Which one fits you?
If most of the points in one column describe you, that's probably your answer.
Choose a managed SOC if…
- You need 24/7 coverage but can't justify five or more dedicated analysts
- Customers, insurers or frameworks such as ISO 27001 or SOC 2 expect monitoring and incident response you can evidence
- You want coverage within weeks, not after a hiring cycle
- Your IT team is already stretched by operations
Build in-house if…
- You have the scale and budget for a fully staffed, multi-shift team
- Regulation or policy requires all monitoring to stay internal
- Your environment is unusual enough that outside analysts would struggle
- You already have strong security leadership to run it
Go hybrid if…
- You have a small security team that can't cover nights and weekends
- You want to keep ownership of risk decisions while outsourcing triage
- You are building in-house capability gradually and need cover meanwhile
Our honest take
For most small and mid-size organisations, a managed SOC delivers genuine 24/7 coverage sooner and with less hiring risk than building in-house. Larger or highly regulated organisations often run a hybrid — an internal team for context and decisions, a managed partner for round-the-clock eyes. We'll tell you honestly which fits.
Discuss your situationQuestions buyers ask
The terms overlap. MDR (managed detection and response) usually emphasises endpoint-centric detection plus active response such as isolating a device. A managed SOC often covers a broader set of log sources — cloud, identity, network and SaaS — through a SIEM. Ask any provider exactly which sources they monitor and what actions they are authorised to take.
A single seat staffed around the clock is 8,760 hours a year. Once shifts, weekends, holidays, sickness and training are counted, that is roughly five full-time analysts per seat, before you add a lead and detection engineering. That arithmetic is the main reason smaller organisations choose a managed or hybrid model.
It will process the security telemetry you send it, such as logs and alerts, under a contract and data processing agreement. You decide which sources are in scope, where data is stored and how long it is retained. Sensitive workloads can be scoped so that only security metadata leaves your environment.
Yes, it can provide evidence for logging, monitoring and incident management controls. It does not make you compliant by itself — you still need risk management, policies and the other controls. We help clients align to these frameworks; certification is always issued by an independent auditor.
Yes. Make sure detection rules, runbooks and incident history are documented and exportable, and that you own your SIEM data. Then a later transition, or a hybrid model, is straightforward.