A question emerges at the board meeting: “We need to meet NIS2 24/7 monitoring requirements. Do we build our own SOC or buy a service?” The IT department presents the cost estimate for an internal security center. The CFO looks at the numbers and turns pale. Nearly EUR 850,000 in the first year. Do we really need to spend that much to sleep peacefully?
This is a discussion happening in hundreds of companies across Europe right now. NIS2 and DORA regulations require continuous cybersecurity monitoring. For the financial sector, the incident reporting window is just 4 hours - no one will detect an attack in the required time if monitoring only operates during office hours. The question isn’t “whether to monitor” but “how to monitor” - and that’s where the economic calculation begins.
How much does a 24/7 in-house SOC really cost?
Let’s start with the most significant cost: people. A SOC operating 24/7/365 requires minimum three shifts daily, seven days a week. Accounting for vacations, illnesses, turnover, and necessary shift overlap, you need minimum 10-12 security analysts.
At current European market rates, the cost of a SOC team is approximately EUR 500,000-600,000 annually. An L1 SOC analyst earns EUR 35,000-50,000 gross annually. An L2 specialist is EUR 50,000-70,000. A senior L3 is above EUR 70,000. Add employer costs, benefits, training, and certifications.
But people are just the beginning. You need technology: SIEM for collecting and correlating logs, EDR on all endpoints, SOAR for automation, threat intelligence tools, ticketing, and reporting. Licenses and maintenance are another EUR 150,000-200,000 annually.
Then add infrastructure costs (premises, equipment, connectivity), team training and certifications, and recruitment and retention costs. Total: approximately EUR 850,000 in the first year, with a significant portion being recurring annual costs.
📚 Read the complete guide: SOC: Security Operations Center - czym jest, jak działa, jak wybrać
What are the hidden costs of an in-house SOC?
The official budget is just the tip of the iceberg. An in-house SOC generates numerous hidden costs rarely included in initial calculations.
The first is employee turnover. SOC analysts are one of the most sought-after specializations in the market. Burnout is common - monotonous shift work, constant alert-related stress, often feeling underappreciated by the organization. Average turnover in SOC teams is 25-30% annually. Each departure means recruitment costs (headhunters take 2-3 months’ salary), new employee onboarding period (3-6 months of reduced productivity), and monitoring gap risk.
The second hidden cost is maintaining competencies. Cyber threats evolve constantly. Analysts must regularly train - new attack techniques, new tools, new regulations. Certifications (GCIA, GCIH, OSCP) cost thousands of euros per person and require regular renewal.
The third cost is opportunity cost. The best security specialists could work on transformational projects - implementing new safeguards, Zero Trust architecture, automation. Instead, they sit on night shifts handling alerts. This is a waste of talent.
What is the Managed SOC model and how does it work?
Managed SOC (SOC-as-a-Service) is a model where an external provider assumes responsibility for continuous security monitoring of the organization. Instead of building your own team and infrastructure, you rent a ready, operational service.
In practice, it works like this: the provider deploys monitoring agents in the customer’s infrastructure (or integrates with existing tools). Logs and security events are sent to the provider’s central SOC, where an analyst team monitors them 24/7. When an incident is detected, the SOC team analyzes the event, classifies its criticality, and takes agreed-upon actions - from customer notification to active response.
The Managed SOC model doesn’t mean giving up all control. The customer defines policies, priorities, and escalation procedures. They decide which incidents require immediate response and which can wait until morning. The provider operates according to these rules but brings their own expertise, threat intelligence, and experience from serving many customers.
How much does Managed SOC cost compared to in-house SOC?
Managed SOC cost depends on many factors: organization size, number of monitored devices, service scope, and required SLA. However, for a typical mid-sized company in Europe, you can assume Managed SOC costs 30-50% of the cost of an in-house SOC.
Assuming an in-house SOC costs EUR 850,000 annually, Managed SOC is approximately EUR 250,000-425,000 annually. Savings of EUR 425,000-600,000 is a serious argument in budget discussions.
Moreover, Managed SOC cost is predictable. It’s a fixed monthly fee that’s easy to plan in the budget. An in-house SOC generates surprises: sudden departure of a key employee, urgent tool upgrades, overtime costs during serious incidents.
What are the advantages of Managed SOC beyond savings?
Financial savings aren’t the only advantage of Managed SOC. Operational and strategic benefits are equally important.
The first advantage is access to experts. Managed SOC providers employ specialists that a single company couldn’t attract. Malware reverse engineering experts, threat intelligence analysts, specialists in specific technologies - these competencies are available as part of the service but unattainable for most internal teams.
The second advantage is threat intelligence from multiple sources. A Managed SOC provider serves many customers. They see attacks across their entire customer base. If a new type of ransomware hits one customer, the others are immediately protected - IOCs (Indicators of Compromise) are distributed across the entire network. A single company sees only its own incidents.
The third advantage is scalability. An in-house SOC is difficult to scale - hiring and onboarding new analysts takes months. Managed SOC scales flexibly - during periods of increased risk (e.g., merger, large transaction), monitoring level can be quickly increased.
What are the risks associated with Managed SOC?
Every model has its risks. An honest analysis requires accounting for them.
The first risk is vendor dependency (vendor lock-in). Changing Managed SOC providers is a serious undertaking - it requires migrating integrations, processes, and organizational knowledge. However, this risk isn’t specific to SOC - it applies to any outsourcing of critical functions.
The second risk is less business context knowledge. An external SOC doesn’t know your organization as well as an internal team. They may not know that the CEO logging in at 3 AM is normal (because they’re traveling) rather than an anomaly. Good Managed SOC contracts address this through an onboarding phase and building context.
The third risk is data confidentiality. SOC sees everything - logs, alerts, incidents. For some organizations (e.g., government institutions, companies with sensitive intellectual property), sharing this data with an external entity may be problematic. The contract, provider certifications, and data processing location must be carefully analyzed.
How does Managed SOC meet NIS2 and DORA requirements?
A key question for many organizations: is Managed SOC accepted by regulators as a way to meet requirements?
The answer is: yes, under certain conditions. Both NIS2 and DORA allow outsourcing security functions as long as the organization maintains oversight and responsibility. You cannot “delegate” board responsibility - but you can delegate operational execution.
Key is appropriate contract formulation with the Managed SOC provider. The contract must precisely define: service scope, SLA (including response times compliant with regulatory requirements), incident reporting procedures, audit rights, and procedures for contract termination.
For the financial sector under DORA, the “right to audit” issue is particularly important - the financial institution must be able to audit the provider. Good Managed SOC providers are prepared for this and have certifications (ISO 27001, SOC 2) confirming service quality.
When does an in-house SOC make sense?
Despite Managed SOC’s clear economic advantage, there are situations when an in-house SOC is justified.
The first situation is very large organizations with thousands of employees and complex infrastructure. At appropriate scale, the unit cost of an in-house SOC decreases, and the benefits of context knowledge increase.
The second situation is organizations with extremely sensitive data where sharing logs with an external entity is unacceptable (e.g., intelligence services, military, certain government institutions).
The third situation is organizations for whom cybersecurity is a key business competency - e.g., companies providing security services to others.
For most other organizations - mid-sized companies, public institutions, manufacturing enterprises - Managed SOC is the more rational choice.
Strategic comparison of SOC models
| Aspect | In-house SOC | Managed SOC |
|---|---|---|
| Annual cost (typical mid-sized company) | ~EUR 850,000 | ~EUR 250,000-425,000 |
| Time to launch | 6-12 months | 4-8 weeks |
| Scalability | Difficult, requires recruitment | Flexible |
| Access to experts | Limited by budget | Broad, included in service |
| Threat intelligence | Mainly public sources | Aggregated from many customers |
| Context knowledge | Full | Requires building |
| Control | Full | Through SLA and contract |
| Turnover risk | High (25-30% annually) | Transferred to provider |
| NIS2/DORA compliance | Self-demonstrated | Supported by provider |
Summary
The “build vs buy” decision in the SOC context is one of the most important cybersecurity decisions facing European companies under NIS2 and DORA requirements. Economic analysis clearly indicates that for most organizations, Managed SOC is the more rational choice.
Savings of 50-70% of costs is a strong argument. But intangible benefits are equally important: access to experts, threat intelligence from multiple sources, elimination of turnover risk, speed of launch. In a world where cybersecurity specialist shortage is widespread and threats are growing, building everything yourself is often a luxury most companies cannot afford.
Of course, Managed SOC isn’t a magic answer to all problems. It requires careful provider selection, precise contracting, and active oversight. Responsibility for security remains with the organization - only the execution model changes. But for companies seeking a cost-effective way to meet regulatory requirements and build real cyber resilience, Managed SOC is an option worth serious consideration.
Considering Managed SOC for your organization? nFlo offers InfraGuardian service - comprehensive 24/7 security monitoring based on IBM Security technology. Contact us to discuss your organization’s needs.
The cost that appears in neither budget
Both business cases usually count licences, hardware and salaries, and both usually omit the same item: attrition. A SOC analyst who leaves after a year takes with them the knowledge of which alerts are normal in your environment — knowledge that exists in no runbook and that takes the replacement several months to rebuild. In a five-person rota that is not an edge case; it is the steady state.
That item is precisely what a managed model moves off your books, which is why the comparison usually flips below a certain scale: SOC as a Service.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Security Operations Center (SOC) — Security Operations Center (SOC) is a central location where a team of security…
- SOC as a Service — SOC as a Service (Security Operations Center as a Service), also known as…
- OSINT — OSINT, or Open Source Intelligence, is the process of collecting, analyzing,…
- SOC 2 — SOC 2 (System and Organization Controls 2) is a security audit standard…
- Social Engineering — Social engineering is a set of psychological manipulation techniques used by…
Learn More
Explore related articles in our knowledge base:
- Who Does the National Cybersecurity System Cover? Entities, Operators, Providers and Authorities
- Why Cybersecurity is Crucial for Local Governments - Detailed Analysis
- 12 Tips to Improve Cybersecurity in Your Organization
- A modern approach to monitoring IT environments - a guide
- AI in the law firm: 3 foundations you need to know about before implementation
Explore Our Services
Need cybersecurity support? Check out:
- SOC as a Service - 24/7 security monitoring
- IT Monitoring - 24/7 infrastructure monitoring
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
- NIS2 for local government — implementation
- NIS2 Funding Calculator for Local Government
- EDR vs XDR vs NDR — comparison
