Managed SOC, in-house SOC, or MDR: an honest comparison

Round-the-clock monitoring is now a practical obligation for a large share of European organisations, partly through NIS2 and DORA and partly because incidents do not respect business hours. The question is not whether to have it. It is which delivery model you can actually sustain.

What 24/7 in-house really costs

Continuous coverage requires enough analysts to staff a rota without burning people out. Accounting for leave, sickness, training and turnover, that means roughly eight to twelve analysts across tiers, plus at least one detection engineer and someone owning the platform. This is the number that surprises people: it is not a team of three with an on-call phone.

Where each model actually fails

In-house

• Attrition. Tier-1 analysis is repetitive work, and the market for experienced analysts is competitive. Losing two people can end continuous coverage overnight.
• Detection decay. Rules are written, environments change, log sources quietly stop, and nobody notices because absence of alerts looks like success.
• Night-shift quality. The 03:00 analyst is usually the least experienced person on the team, facing the alerts most likely to matter.

Managed SOC

• Context gap. The provider does not know that the finance system always runs a bulk export on the last Friday of the month, so it is either escalated every month or tuned out permanently.
• Escalation-only scope. Many contracts stop at notification. If nobody on your side answers at 03:00, the escalation achieved nothing.
• Alert-volume incentives. If the contract measures alerts handled, you will receive alerts. Measure investigations closed and escalations that were correct instead.

MDR

• Coverage limited to the provider's stack. Excellent on endpoint, frequently weaker on identity, SaaS, cloud control planes and bespoke applications — which is where a lot of modern attack activity now lives.
• Opaque detection logic. You often cannot see or influence the rules, which makes it hard to evidence coverage to an auditor.
• Containment authority. Automatic isolation is powerful and occasionally isolates something business-critical. Agree the boundaries in writing before go-live.

The hybrid that most mid-sized organisations end up with

The arrangement that works most often is not on this list as a pure option: an internal security lead who owns detection strategy, business context and response authority, plus an external provider supplying continuous coverage and tier-1 triage.

One internal person makes the external service dramatically more effective, because someone on your side can answer 'is this normal?' in minutes, can approve containment, and can push back when escalation quality drops. Providers deliver noticeably better outcomes to customers who have this role filled, and it is a single salary rather than twelve.

Questions to ask any provider before signing

1. What exactly happens at 03:00 when a genuine critical alert fires? Walk me through the last real one, redacted.
2. Can you contain — isolate a host, disable an account — or only notify? If containment, under what authority and with what limits?
3. Which log sources are in scope, and specifically: is my identity provider included? Are my SaaS audit logs included?
4. How do I see your detection coverage? Can I map it to a framework such as MITRE ATT&CK, and can I request new detections?
5. What is the contractual time to acknowledge and time to escalate, and what happens when you miss it?
6. How do you monitor for a log source going silent? This is the most common invisible failure.
7. Who owns the data if I leave, and in what format do I get it?
8. Will you support an adversary simulation exercise, and will you accept being measured on what you detected?

That last question is the most revealing. A provider willing to be measured by an independent red team is confident in their coverage. A provider who resists it is telling you something important.

Choosing