Every managed SOC provider offers 24/7 monitoring, threat detection and rapid response. Most of them are telling the truth, which is exactly the problem. The brochures read alike and the pricing cannot be compared, so buyers end up choosing on price or on instinct.
What actually separates one provider from another is rarely on the website. Whether you can reach an analyst directly at 11pm. How escalation really works. What happens when a detection turns out to be wrong. What the contract does when you grow. Detection technology across serious providers is close enough to parity that it no longer decides anything.
This guide covers what the service includes, the ten questions worth asking before you sign, what running a SOC in-house genuinely costs, what mid-sized firms and startups each need, and how to judge a provider once they are live.
Transputec has traded for more than 40 years and runs a UK-staffed SOC. We have written this as the questions we would want a buyer to put to us.
Technology across serious providers is at parity. What separates one managed SOC provider from another is what happens at eleven o’clock on a Tuesday night, and whether the analyst who picks up already knows your environment.
What a Managed SOC Provider Actually Delivers
You get a security team, a detection platform and an escalation process on subscription, without hiring any of it. Scope varies more than most buyers expect, so be specific about what is included before you compare quotes.
- Continuous monitoring across endpoints, identity, network, cloud and SaaS
- Incident response and containment, not an alert and a handover
- Behavioural analytics that flag activity outside your normal patterns
- Vulnerability management, so exposure gets closed and not just counted
- Threat intelligence mapped against your own environment and sector
- Compliance reporting and audit evidence
The line to watch is incident response. Some providers alert you and stop there. Transputec’s managed SOC service contains and resolves, which is a different service and a different cost base. If you want the mechanics first, our guide to how a managed SOC works covers what gets monitored and why.
Ten Questions to Ask Before You Sign
In the order they usually matter.
- Expertise. How long has the team existed, and have they worked in your sector?
- Technology stack. What detection platform sits underneath, and who pays for the licences?
- Certifications. ISO 27001 for the provider, plus SOC 2 if they operate in the US, and whatever your own regulator expects.
- Scalability. What happens to the fee if you grow by 30 per cent? Get the mechanism in writing.
- Threat intelligence. Which feeds, and how are they tuned to you?
- Containment. Included or billed separately? Quotes diverge here more than anywhere else.
- Genuine 24/7. Staffed shifts, or business hours with an out-of-hours answerphone?
- Pricing model. Subscription, pay-per-use or tiered. Ask which one you are being quoted under.
- Onboarding. How much tuning happens before go-live, and is it in the fee?
- References. Ask to speak to a client who has been with them more than three years.
That eighth point catches people out. The same service priced three ways looks like three different businesses, so settle the model before you compare two bids. Our breakdown of what a managed SOC costs sets out what tends to sit outside the headline fee.
Not sure which provider questions matter most for your estate?
Our SOC team will walk through your current coverage, where the gaps are, and what 24/7 monitoring and incident response would look like in your environment.
Book a SOC briefingWhat Does Running a SOC In-House Actually Cost?
More than most boards expect, because the constraint is the rota rather than the salary.
Genuine 24/7/365 cover is 8,760 hours a year. One analyst delivers roughly 1,700 productive hours once holiday, training and sickness are taken out. That is five analysts before anyone has properly covered a weekend, and most teams run six so nobody works nights alone.
An illustrative model, using the UK average SOC analyst salary of £43,220 reported by Indeed in August 2026:
| Line | Illustrative annual cost |
|---|---|
| Five analysts, fully loaded at roughly £55,000 each | £275,000 |
| SIEM licensing and supporting tooling | On top |
| Recruitment and replacement | On top |
Fully loaded means salary plus employer National Insurance, pension and training, which usually adds 25 to 30 per cent.
Treat that £275,000 as the floor, not the running cost. It buys one analyst on duty at a time and no tooling. A tiered operation, with first, second and third line analysts across three shifts, is a different proposition. Our own managed SOC service page puts a full internal build at 12 to 18 people and £1.2m to £2.4m a year for a mid-market estate, against a total cost of ownership typically 30 to 60 per cent lower over three years for the outsourced equivalent.
Two things that model does not price. Vacancy risk: one resignation on a five-person rota leaves you uncovered while you hire, and these people are hard to replace quickly. And exposure: an in-house team of five sees only your environment, while a provider’s team sees patterns across a client base.
The advantages of an in-house SOC are real. You keep full control of tooling and process, your analysts learn the estate in depth, no telemetry leaves your tenancy, and the institutional knowledge stays with you. For a regulated firm running unusual systems, that depth can be worth the cost.
The disadvantages are mostly structural. The rota is fragile, you compete for analysts against banks and security vendors, you specify and maintain the tooling yourself, and the team only ever sees one environment. None of that appears in a salary budget.
Outsourcing is almost always cheaper below roughly 1,000 staff. Above that the sums get closer and often land on a hybrid, with an internal team in business hours and a provider covering nights and weekends.
What Separates a Good Managed SOC Provider From a Great One
The people, and how reachable they are when something goes wrong.
Detection technology across serious providers is broadly at parity. What differs is what happens at eleven o’clock on a Tuesday night. Transputec clients have direct access to the analysts watching their environment, by phone, Teams or WhatsApp. Not a ticket queue, and not a first-line desk reading from a script.
Three questions get at this quickly:
- Do clients reach the analysts watching their environment, or does everything go through a helpdesk?
- How does escalation work, and who makes the call to contain?
- When did the provider last visit a client in person?
That last one sounds soft. It is not. Our SOC Manager, Toni Nakovski, recently met a client face to face for the first time after eight years of working together. The client is IQPC, and the whole relationship had been built through monthly reviews, Teams calls and incident response over phone and chat. The trust was already there. Meeting in person took it further.
Ask what a monthly review covers, too. Transputec’s reviews go through detections and how they were handled, changes in your environment that moved your risk, intelligence relevant to your sector, and where more protection would be worth the money. A provider who cannot describe their review agenda probably does not hold them.
Why Mid-Sized Businesses Feel This First
The government’s Cyber Security Breaches Survey 2025 found 43 per cent of UK businesses identified a breach or attack in the previous 12 months. Among medium-sized businesses it was 67 per cent. London businesses were more exposed again, at 51 per cent.
Mid-sized firms get hit hardest for three reasons. They hold data, money and customer records worth taking. They are assumed to be defended more lightly than a large enterprise. And they often sit inside a supply chain that leads somewhere bigger, which makes them a route rather than a destination.
Yet many run with the security posture of a much smaller company. One or two IT staff, no dedicated analysts, antivirus doing the heavy lifting and no written incident response plan. The same survey found medium-sized businesses the most likely of any size band to bring in an external cyber or IT provider, at 43 per cent. For most of them a managed SOC provider is the only realistic route to staffed 24/7 cover.
On cost, be careful with the figures that circulate. The survey puts the average cost of the most disruptive breach at £1,600 across all businesses and £3,350 for medium and large ones, including those who reported no cost at all. Excluding the nil responses it is £3,550 and £5,590. Those are the real numbers, and they sit a long way below the million-pound figures often quoted at boards.
What Startups Should Ask For Instead
Early-stage companies have a different problem. There is usually no internal security team at all, the headcount is changing every quarter, and the budget will not stretch to a platform licence plus analysts.
Three things matter more than they do for a larger buyer:
- A pricing model that moves with you. Per endpoint per month scales down as well as up. A fixed annual platform fee does not.
- Coverage of the things that actually get startups. Credential theft, business email compromise and exposed cloud configuration, rather than an enterprise detection catalogue you will never use.
- An exit and a growth clause. You may be a very different size in 18 months. Agree now what happens at both ends.
Investor and customer due diligence is the other driver. Enterprise buyers and insurers increasingly ask for evidence of monitoring and incident response before they sign, and a young company that can show it tends to clear security review faster.
How to Build the Business Case for Your Board
Security spend framed as a cost loses the argument. Framed as risk transfer, it usually wins.
Regulatory timing. UK GDPR requires a reportable personal data breach to reach the regulator within 72 hours of becoming aware of it, as the ICO sets out. Without continuous monitoring, the clock starts late and you are explaining a delay as well as a breach.
Insurance. Insurers now ask for evidence of monitoring, incident response and documented controls before they quote or renew. We covered what they are asking for in our guide to cyber insurance requirements.
Audit effort. A provider generating monthly evidence packs removes weeks of internal work per audit cycle. Transputec’s SOC reporting covers ICO, FCA, ISO 27001, Cyber Essentials Plus and PCI DSS requirements.
Board visibility. Boards now expect security reporting rather than an assurance that IT has it covered. That is a deliverable you should name in the contract.
How to Judge a Managed SOC Provider Once They Are Live
Agree the measures before you sign, because they are hard to introduce afterwards.
| Measure | What to agree up front |
|---|---|
| Time to detect and respond | The committed target by severity, and what happens when it is missed |
| Detection quality | How many detections proved genuine, and how false positives are tuned out |
| Compliance evidence | Produced on a schedule, not assembled when an auditor asks |
| Cost against the alternative | Reviewed annually against the in-house model above |
| Client satisfaction | Measured and published, not asserted |
On that last point, Transputec publishes its customer satisfaction data, including Net Promoter Score. Ask any provider for theirs. One who measures it and publishes the result is making a claim you can hold them to.
For a working example, Worldwide Flight Services described their reasoning when they invested in cyber security monitoring with Transputec.
Conclusion
Choosing a managed SOC provider on brochure features will not get you anywhere, because the features match. Ask instead about the rota behind the 24/7 claim, whether containment is included or billed, who picks up at 3am, and what the fee does when you grow. Then agree how you will measure the service before it starts.
If you are weighing this up, talk to our team about the security work behind Transputec’s managed SOC services, and ask us the ten questions above.
Frequently Asked Questions
What does a managed SOC provider cost in the UK?
Most providers price per endpoint per month, and the figure moves with estate size, how much log data you generate and whether containment is included. The headline fee is rarely the whole cost, so ask what sits outside it: SIEM licensing, onboarding and tuning, and incident response hours during a live event. Our managed SOC cost guide breaks down the pricing models you will be quoted under.
Is a managed SOC the same as managed SIEM or MDR?
No, though the terms get used loosely. A SIEM is the platform that collects and correlates log data. A managed SOC is the people and the process operating that platform, including investigation and response. MDR usually sits between the two, focused on detection and response at the endpoint. The practical question is who investigates an alert and who contains the threat. We compare the two in detail in our guide to the difference between managed SOC and managed SIEM.
We already have a firewall and antivirus. Do we need a SOC as well?
Those are perimeter and endpoint defences. They stop known bad things at the door. A SOC watches what happens inside your environment after those defences have been bypassed, which with modern phishing, credential theft and supply chain attacks happens more often than most teams expect. A good provider integrates with the tooling you already pay for rather than asking you to replace it.
How long does onboarding a managed SOC provider take?
Expect weeks rather than months, and expect the timeline to depend on your estate. Asset discovery and log ingestion come first, then baseline tuning so the service is not drowning you in false positives on day one. Transputec works to live cover inside 21 days, with detection coverage mapped against MITRE ATT&CK from the first week. Ask any provider how much tuning happens before go-live, and whether it is inside the fee.
Can a managed SOC provider help with compliance evidence?
Yes, and it is one of the clearer returns on the spend. Continuous monitoring produces the audit trail that control attestation needs, and it is what makes the UK GDPR 72-hour breach reporting window achievable. Transputec generates monthly reports covering ICO, FCA, ISO 27001, Cyber Essentials Plus and PCI DSS, with evidence packs on demand. Ask to see a sample pack before you sign.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
