The True Cost of Setting Up and Operating a 24×7 Security Operations Center (SOC)

Understanding the costs behind setting up and running a Security Operations Center is important to making informed decisions about how much protection you can afford and how you will go about acquiring it. The simple answer to the question “How much does a SOC cost?” is that it depends on many variables. In this article we will break down those variables and provide typical costs that you can use to inform your decision making about how to best protect your organization.

What is a SOC?

A Security Operations Center, or SOC (pronounced “sock”), is a centralized function that incorporates the people, processes, and technology required to monitor an organization’s IT infrastructure, address IT security issues as they occur, and manage and enhance the organization’s security posture.

Through the combination of people, processes, and technology, a modern SOC provides these IT security functions:

• Detection: automated alerting when monitoring discovers an anomaly or indicator of a security event, plus triage to eliminate false positives
• Investigation: if the alert is a true positive, determining answers to the “Five Ws”: who, what, when, where, and what next?
• Remediation: taking specific steps to undo any damage done and learning from experience what to do in the future to detect or prevent a similar incident
• Hunting: not everything is going to be caught by the technology or security tooling, so SOCs today also proactively look for threat indicators hidden in massive volumes of security data.
• Orchestration: the modern SOC depends heavily on automation to streamline workflows and free up analyst time to be used for threat hunting.

What does a SOC cost?

To answer that question, we need to level set with some assumptions. The costs we provide below assume 24×7 operations, which requires at least 12 dedicated employees plus coverage for vacations, sick time and training. The labor cost component is based on U.S. East Coast labor rates, including wages and benefits. And the tooling or technology cost component assumes a network supporting 5,000 people. The estimates include a one-time implementation cost, but do not include overhead costs for a physical location.

Set up of a SOC includes compiling tactical runbooks, which define your team’s response to specific incidents like ransomware attacks or data breaches, and your overarching incident response playbook. It also includes selecting, purchasing and installing security software and the hardware it will run on, plus calibrating this technology for your specific operations.

Setup and operational costs depend on the level of SOC operations you are trying to achieve. Here are cost breakdowns for three levels of SOC operations.

Does the location of a SOC matter?

Typically, the physical location of the SOC does not matter. After all, the network assets protected by the SOC are typically distributed between on-premises, home, public cloud, and Software-as-a-Service (SaaS). Also “distributed” are the hard-to-come-by skilled people who work in IT security and prefer to work from home.

One caveat is that security data from your dispersed assets does need to be centralized somewhere, whether that is in an on-premises data center or in the cloud. Depending on the nature of your business or your organization’s location, you may be affected by data residency requirements that specify where that data is stored. But wherever that data is located, remote access between your SOC technology, your security data, and SOC personnel is reliable, economical and easily done.

The impact of skills scarcity

Why is remote access important? It can help overcome one of the most significant barriers to building and running your own SOC: people. Recent research says that the number of unfilled cybersecurity jobs worldwide grew 350% between 2013 and 2021, from 1M to 2.5M. That translates into high competition for scarce skills, which impacts both staffing and retention. You’ll need to hire analysts, people who can install, configure and manage your security technology stack, and people who can manage SOC operations. Plus, with technology’s rapid evolution and the ever-changing threat landscape, you’ll have to invest in continuous training and technology refresh.

However, there is an alternative to spending $5M a year for an advanced SOC. You can co-source and get the around-the-clock capabilities of an advanced SOC for a fraction of the cost, in a fraction of the time. Netsurion’s Managed Open XDR and SOC-as-a-Service (SOCaaS) offerings provides an integrated approach that relieves the people challenges of an in-house SOC operation and optimizes your cybersecurity investments. Learn more about the advantages of co-managed security from Netsurion.

Cost of Setting Up and Operating a SOC

A.N. Ananth

A.N. Ananth is Chief Strategy Officer at Netsurion, co-creator of Netsurion's Open XDR platform, and has an extensive background in product development and cybersecurity operations.