sourcing.cisomarketplace.com / soc-build-vs-buy
Part of CISO Marketplace
SOC Build vs Buy · Free Calculator

Build a SOC or buy MDR?

Full 24/7 staffing math, SIEM and tooling costs, MDR per-endpoint pricing, and the breakeven point where building beats buying. Most calculators skip the 24/7 FTE coverage math — this one doesn't.

!
The hidden number: staffing one analyst seat 24/7/365 takes about 6 FTEs, not one. Vacation, sick days, holidays, training, and shift handoff overhead cut each FTE's actual coverage to ~1,500 hours/year vs the 8,760 hours in a year. A 5-analyst SOC sounds like a real operation, but it's actually business-hours-only with weekend on-call — not 24/7.

Your Environment

Workstations + servers + cloud workloads that need monitoring.
GB/day of security telemetry. Drives SIEM license costs.
24/7 requires ~6× the FTE count of business hours.
Analyst salary varies 2-3× by region.
Open source has lower license, higher operational cost.
$/endpoint/month. Mid-market range is $5-9.
3-Year Verdict
Calculating...
Build Path
In-house SOC
$0 / 3 years
$0 in year 1 · $0 per endpoint/year
Analyst staffing (loaded)$0
— FTEs total—
SIEM platform (3-yr)$0
SOAR + threat intel + case mgmt$0
Onboarding + facility (Y1)$0
Training + certs + ramp$0
⚠ Coverage gap
—
Buy Path
Managed Detection & Response
$0 / 3 years
$0 in year 1 · $0 per endpoint/year
MDR subscription$0
$0/endpoint/mo × — months—
Onboarding (one-time)$0
Co-managed SIEM share$0
Vendor mgmt overhead (0.5 FTE)$0
IR retainer / threat hunting$0

Breakeven Analysis

3-year total cost across endpoint counts. The crossover point is where Build becomes cheaper than Buy.

Calculating breakeven...

The 24/7 FTE Math

Why one analyst seat costs ~6 people:

Hours in a year
8,760
Hours that need to be covered for 24/7/365.
Productive hrs/FTE/year
~1,500
After PTO (~160h), holidays (~80h), sick (~40h), training (~80h), breaks (~200h).
FTEs per 24/7 seat
5.8
8,760 ÷ 1,500. Round up to 6 to account for shift handoff overlap.
Seats in a real SOC
3+
Tier 1 monitoring, Tier 2 escalation, lead-on-shift. Minimum for legitimate 24/7.
▸ See all assumptions and calculation methodology

All numbers are vendor-neutral midpoints based on published industry data, Mandiant M-Trends, Gartner SOC research, and SANS SOC Survey averages. Adjust against your specific reality before making a procurement decision.

Build path

  • Analyst loading factor: ×1.4 on base salary for benefits, taxes, equipment, training
  • Salary mix: 40% Tier 1, 30% Tier 2, 20% Tier 3, 10% manager
  • 24/7 multiplier: business-hours team × 5.8 for coverage
  • SIEM tiers (annual): open source ~$30K + ops overhead, cloud-native ~$60K base + ingest, premium ~$120K base + ingest
  • Tooling stack: SOAR ~$60K, threat intel ~$40K, case mgmt ~$25K per year
  • Facility / infrastructure: ~$50K Y1, ~$20K Y2+
  • Training & ramp: ~$8K/analyst/year (certs, conferences, lab time)

Buy path

  • MDR pricing: $/endpoint/month × 12 × endpoint count (slider, mid-market range $5-9)
  • Onboarding: $25K + ($3 × endpoints), one-time
  • Co-managed SIEM: if you keep your own SIEM for compliance, ~60% of build-path SIEM cost
  • Vendor management: 0.5 FTE at Tier 2 loaded cost
  • IR retainer / hunting add-on: ~$30K/year

Region salary multipliers (vs US secondary metro baseline)

  • US major metro: 1.35× · US secondary metro: 1.0× · US low-cost: 0.80×
  • Europe: 0.90× · APAC: 0.65× · LATAM: 0.45×

📄 Download the decision memo

PDF includes your full 3-year cost comparison, FTE math, breakeven point, and a board-ready one-page summary you can adapt for your business case.

✓ Sent! PDF downloading now...
Recommended next step

Get matched with SOC-as-a-Service vendors

Our 5-minute sourcing diagnostic matches you with 3 vetted MDR / co-managed SIEM / SOCaaS vendors sized for your endpoint count. No vendor pays for placement.

Open the sourcing diagnostic →