Most buyers asking this question have already been quoted a number they cannot explain to their board. The quote arrives as a single annual figure with no breakdown, and there is no obvious way to tell whether it is fair or what it leaves out.
A 24/7 SOC cost in the UK is normally quoted as an annual subscription, priced against the users, endpoints or data sources you need monitored and the depth of response you want when something is found. Providers price the same service four different ways, so two quotes that look far apart often cover very different scopes.
This guide sets out the four pricing models, the five factors that move the number, what sits outside the headline fee, and a worked example with real figures. If you want an indicative number first, our managed SOC cost calculator takes a couple of minutes.
A 24/7 SOC cost is not a single number. It is a scope decision with a price attached. Once you know which pricing model you are being quoted under, comparing providers becomes arithmetic rather than instinct.
The Four Managed SOC Pricing Models
Providers rarely tell you which model they are using. Knowing it is the difference between comparing quotes properly and guessing.
| Model | How it is charged | Suits | Watch for |
|---|---|---|---|
| Subscription | Fixed monthly or annual fee for a defined scope | Most organisations; easiest to budget | What counts as in scope when the estate changes |
| Per endpoint or per user | Scales with assets monitored | Smaller estates with a countable device list | Gets expensive quickly as device counts climb |
| Tiered | Bands, from monitoring up to full response | Buyers who want to start small | Where response sits. It is often absent from the lowest tier |
| Usage-based | Tracks data ingested or incidents handled | Variable or seasonal workloads | A noisy month produces a bill nobody budgeted for |
Transputec works mainly on subscription and tiered models, because finance teams need a number they can commit to for the year rather than one that moves with log volume.
What Drives a 24/7 SOC Cost Up or Down
Five factors do most of the work on a 24/7 SOC cost. Everything else is detail.
- Size and complexity of the estate. A 40-person business with one Microsoft 365 tenant is a genuinely different job from a 900-person business with three sites and a manufacturing network.
- Depth of response. Alerting is cheap. Someone contactable at three in the morning who is contractually able to isolate a compromised host is not. The gap between telling you and acting is the single biggest line item in most quotes.
- Technology stack. The SIEM or detection platform underneath carries its own licence cost, usually passed through. A Microsoft estate on Sentinel prices differently from a platform service with licensing built in.
- Customisation and tuning. Connecting legacy systems and tuning detections to your environment takes engineering time. This is money well spent, because an untuned SOC generates noise your team learns to ignore.
- Compliance requirements. Regulated sectors need evidence, retention and reporting that unregulated ones do not. If you are working to ISO 27001 or PCI DSS, the audit trail is part of the service and part of the price.
Want a figure before you talk to anyone?
Our managed SOC cost calculator gives an indicative annual estimate in a couple of minutes, based on your estate size and the depth of response you need.
Get an indicative quoteWhat a 24/7 SOC Costs: Indicative UK Figures
Public pricing is rare in this market, so a worked example is more useful than a range pulled from the air.
ThreatSpike, which Transputec delivers as a managed service, is a useful one because the inclusions are unusually explicit. A fixed-cost arrangement covers continuous 24/7/365 monitoring, unlimited incident response and forensics, unlimited support and training, unlimited use of platform features, unlimited event storage including third-party feeds, and 12-month retention with one month held online.
Indicative cost for a small business: £20,000 to £50,000 a year, depending on monitoring scope. That is close to the only public reference point in the UK managed SOC market, and it is worth using as a sanity check against any quote in front of you.
Three things make a fixed-cost model easier to defend internally. The number does not move with log volume, so the figure you take to your board is the figure you pay. Installation, response, training and support sit inside the fee rather than arriving as separate invoices after a bad month. And it scales by size rather than activity, which removes any incentive to under-report incidents.
Educational discounts are available, and a trial of roughly a month with full functionality is typically offered. The ThreatSpike cost calculator produces an indicative figure for your own organisation.
24/7 SOC Cost Compared With Building Your Own
Outsourcing is almost always cheaper below roughly 1,000 staff, and the constraint is the rota rather than the salary.
Genuine round-the-clock cover is 8,760 hours a year. One analyst delivers roughly 1,700 productive hours once leave, training and sickness are taken out, which puts a single-seat rota at five people before anyone has bought a licence. A tiered operation with first, second and third line analysts across three shifts is a different proposition again: our managed SOC service page puts a full internal build at 12 to 18 people and £1.2m to £2.4m a year for a mid-market estate.
Managed monitoring converts that into an operating cost with defined coverage. You get a team, a platform and a body of threat intelligence without the capital outlay or the hiring problem, typically at a total cost of ownership 30 to 60 per cent lower over three years.
The trade-off is control. An in-house team knows your business. A good provider closes that gap through onboarding and tuning, which is why the customisation line in a quote is worth paying rather than negotiating away. Our guide to choosing a managed SOC provider covers the full comparison.
What Sits Outside the Headline Fee
This is where a 24/7 SOC cost quietly grows, and where buyers get caught. Establish each of these in writing before you compare numbers.
| Item | Often included | Often extra |
|---|---|---|
| SIEM or platform licensing | In platform-based services | Where you bring your own SIEM |
| Onboarding and detection tuning | In fixed-cost models | Quoted as a separate project |
| Incident response hours | In fixed-cost models | Billed per hour during a live event |
| Forensics after an incident | Rarely | Almost always, and it is not cheap |
| Data retention beyond the standard window | Up to a stated period | Per GB beyond it |
| Out-of-hours escalation to a senior responder | In higher tiers | In lower tiers |
The forensics line is the one that surprises people. A provider can contain an incident inside the fee and then quote separately for establishing what was taken, which is the part you need for an ICO notification.
Does a 24/7 SOC Pay for Itself?
For most mid-sized organisations, yes, and the arithmetic is not subtle.
IBM’s Cost of a Data Breach Report 2026 puts the global average breach cost at $4.99 million, up 12 per cent on the previous year, and the mean time to identify and contain a breach at 247 days. That last figure reverses five years of improvement.
Speed is where the saving comes from. The same report found that organisations making extensive use of AI and automation in security resolved breaches 65 days faster and reduced the cost of an average breach by $1.93 million. An attacker with eight months inside your network is a different problem from one detected in an afternoon, and the gap between those two outcomes dwarfs an annual monitoring fee.
Set the cost against your own exposure rather than an industry average. If a week of downtime would cost you more than a year of monitoring, the decision makes itself. The NCSC’s incident management guidance is a reasonable yardstick for what mature response looks like.
What to Check Before You Sign
Ask these of every provider, including us, and compare the answers rather than the headline prices.
- Which pricing model is this, and what happens if we grow 30 per cent? Get the uplift mechanism in writing.
- Is incident response included or billed separately? This is where quotes diverge most.
- What are the response commitments, and what happens when one is missed? A stated target with no consequence is a marketing claim.
- How long is data retained, and how much is searchable online? Retention matters for investigations and for compliance evidence.
- What does onboarding and tuning involve, and is it in the fee? An untuned SOC is an expensive alert generator.
Transputec answers all five in writing before contract. If a provider will not put those answers on paper, that tells you something the price does not.
How to Compare Two Quotes
Once you have two numbers in front of you, normalise them before you judge, because no two providers present a 24/7 SOC cost the same way.
- Convert both to the same basis. Annual, including everything either provider treats as standard. A per-endpoint quote and a fixed-fee quote are not comparable until you do.
- Add the exclusions back in. Use the table above and price the gaps, especially response hours and forensics.
- Compare what happens on a bad day, not a quiet one. Who acts, how fast, and at what extra cost.
- Check the exit. Who owns the detection rules written during the contract, and what history transfers if you leave.
If one quote is dramatically cheaper, the usual explanation is that response is not in it. That is a legitimate way to buy, provided you know you are buying alerting and have decided who acts on it. Our comparison of managed SOC and managed SIEM covers that distinction.
Conclusion
A 24/7 SOC cost is a scope decision with a price attached. Once you know which of the four pricing models you are being quoted under, which of the five drivers apply to your estate, and what sits outside the fee, comparing providers becomes arithmetic.
Use the £20,000 to £50,000 small-business reference point to test whether a quote in front of you is scoped honestly, and price the exclusions before you decide.
Talk to our team about the security work behind Transputec’s managed SOC services, or get an indicative figure from the cost calculator.
Frequently Asked Questions
How much does a 24/7 SOC cost in the UK?
Most providers quote an annual subscription priced against users, endpoints or data volume, plus the depth of response you want. As a public reference point, a fixed-cost arrangement for a small business runs roughly £20,000 to £50,000 a year with response and retention included. Anything dramatically below that usually excludes incident response, so check what you are actually buying.
What is included in a managed SOC subscription?
At minimum, continuous monitoring and alert triage. Better services include investigation, containment, threat hunting and compliance reporting. The line to watch is response: some providers tell you something is wrong and stop there, which is a different service and a different cost base. Ask whether an analyst validates every alert before it reaches your team.
Is a 24/7 SOC cheaper than hiring your own analysts?
Below roughly 1,000 staff, almost always. Round-the-clock cover is 8,760 hours a year and one analyst delivers about 1,700 productive hours, so a single-seat rota needs five people before any tooling. A full tiered build runs 12 to 18 people. Outsourced equivalents typically land 30 to 60 per cent lower on total cost of ownership over three years.
What is not included in the headline price?
Commonly: SIEM licensing where you bring your own platform, onboarding and detection tuning, incident response hours during a live event, forensics afterwards, and retention beyond the standard window. Forensics is the one that catches people out, because a provider may contain an incident inside the fee and quote separately for establishing what was taken, which is what an ICO notification needs.
How do I compare two managed SOC quotes?
Normalise them first. Convert both to an annual figure on the same basis, add back anything either provider treats as extra, then compare what happens on a bad day rather than a quiet one: who acts, how quickly, and at what additional cost. Finally check who owns the detection rules written during the contract and what history transfers if you leave.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
