In-House SOC vs SOC-as-a-Service 2026: TCO Breakeven
An in-house 24x7 SOC needs five to seven full-time security analysts (the SANS-recommended 5 FTE for true 24x7 with leave cover plus one shift lead), a SIEM licence, a SOAR licence, an EDR licence, and a threat-intel platform. An outsourced MDR provides all four plus the staffing under one contract.
Below roughly 2,500 endpoints, outsourced MDR almost always pencils out cheaper than building. Above 10,000 endpoints, a co-managed model usually wins. Between the two, the answer is environment-specific and the in-house TCO model in /annex/in-house-tco-model is the working sheet.
Side-by-side ledger
| Axis | Arctic Wolf | Huntress Managed EDR/MDR |
|---|---|---|
| Staff cost (5 analysts, 2026 BLS median $124,910) | $ 624,550 / yr salary | Included in MDR fee |
| SIEM licence (commercial mid-market) | $ 80,000 to $ 250,000 / yr | Included or pass-through |
| EDR licence | $ 5 to $ 8 per endpoint / month | Often bundled |
| Threat intel + SOAR | $ 40,000 to $ 120,000 / yr | Bundled |
| Breakeven endpoint count (mid-market) | Above 2,500 to 10,000 endpoints | Below 2,500 endpoints |
Recommendation by buyer profile
- Under 1,000 endpoints. Outsourced MDR; building does not pencil out.
- 5,000 to 15,000 endpoints, regulated industry. Co-managed; the customer-side L1 keeps institutional context, the vendor takes 24x7.
- Over 25,000 endpoints, in-house security org. Build or hybrid; at scale the per-endpoint fee compounds faster than headcount.
Related compares
AnnexArctic Wolf vs Expel 2026Pick Arctic Wolf if you want a named Concierge Security Team and you are comfortable with a three-ye...AnnexHuntress vs Arctic Wolf 2026Pick Huntress under 250 endpoints. Pick Arctic Wolf above 500 endpoints and when network, identity, ...AnnexRed Canary vs Expel 2026Pick Red Canary if Zscaler is already in the architecture or planned. Pick Expel if EDR-source agnos...AnnexRFP templateNormalise both quotes to the same scoring shape before deciding.