SOC pricing FAQ for 2026.
Sixteen of the questions buyers ask before signing an MDR contract. Each answer is keyed to the relevant ledger page.
- What is a typical $/endpoint/mo for MDR in 2026?
- Outsourced MDR in 2026 sits in the band of $ 5 to $ 35 per endpoint per month, depending on tier. Tier-1 monitoring-only is $ 3 to $ 8; Tier-1+2 triage is $ 6 to $ 18; Tier-1+2+3 hunt and respond is $ 12 to $ 35.
- Which MDR vendors publish list pricing?
- Of the 14 vendors most commonly shortlisted by mid-market buyers in 2026, none publish a full list price on their own pricing page. Huntress publishes the closest to a list rate via partner channels (around $ 8.99 / endpoint / month direct retail), but the official pricing page is demo-gated.
- Who are the quote-only vendors?
- Quote-only majors in 2026 include Arctic Wolf, CrowdStrike Falcon Complete, eSentire, Expel, Red Canary, ReliaQuest, Rapid7, Sophos, SentinelOne Vigilance, Secureworks Taegis, Field Effect, UnderDefense, and Critical Insight. Inferred bands for each are sourced on the relevant vendor page.
- When does in-house SOC beat outsourced MDR on TCO?
- Below 2,500 endpoints, outsourced almost always wins. Above 10,000 endpoints, co-managed or in-house usually wins. Between the two, the answer depends on the existing tools stack and the regulated framework overlay; the working sheet is /annex/in-house-tco-model.
- What does a 5-FTE in-house SOC cost in 2026?
- Roughly $ 1.06M / yr in fully-loaded staff cost (BLS May 2024 OEWS median wage $ 124,910 plus 40% benefits and overhead, plus a shift-lead premium), and another $ 200,000 to $ 600,000 in tools (SIEM, SOAR, EDR, TIP).
- Is AI-SOC ready to replace Tier-1 analysts?
- Not in 2026. Agentic SOC vendors (Prophet, Dropzone, Radiant, Huntress) deliver autonomous Tier-1 investigation but high-severity alerts still escalate to humans. Realistic cost-per-investigation reduction is 50 to 80 percent of the equivalent analyst-hour, not 95.
- What hidden costs commonly appear post-signature?
- Seven hidden lines surface: ingest overage ($ 0.40 to $ 1.20 / GB), IR retainer overage ($ 350 to $ 600 / hour), non-standard log source setup, dedicated tenancy (+15 to +40 percent), evidence packs per audit, off-boarding fee, and annual price escalation. All seven can be capped in the RFP.
- How long is a typical MDR contract?
- 12-month minimum is common at SMB-priced vendors (Huntress, Field Effect). Mid-market and enterprise vendors (Arctic Wolf, eSentire, Secureworks Taegis) push 36-month terms with annual escalators; 12-month is available on negotiation.
- What is BYO-SIEM and which vendors support it?
- BYO-SIEM means the MDR vendor monitors the customer's existing SIEM (Splunk, Sentinel, Chronicle, Elastic) rather than ingesting into a proprietary data lake. Expel, ReliaQuest GreyMatter, UnderDefense, and Red Canary all support BYO-SIEM as a first-class delivery option.
- What does CrowdStrike Falcon Complete cost per endpoint?
- CrowdStrike does not publish a list price; field-reported bands cluster at $ 15 to $ 45 per endpoint per month all-in. 200-endpoint minimum; Falcon Flex consumption-based licensing is an alternative purchase path.
- How did Sophos's Secureworks acquisition affect Taegis pricing?
- Sophos completed the $859M acquisition in February 2025. Taegis remains a standalone SKU but is now co-sold through the Sophos channel; Sophos Endpoint is auto-included in all Taegis MDR/XDR subscriptions as of the October 2025 portfolio refresh.
- What is the breach warranty worth?
- Sophos and CrowdStrike Falcon Complete both offer up to $1M in breach-protection warranty. The trigger conditions are strict (customer must be fully covered by the vendor's agent, must follow hardening guidance), so the warranty is best read as a credibility signal rather than as an insurance product.
- How does per-asset metering (Rapid7) differ from per-endpoint?
- Per-asset counts endpoints plus servers, cloud workloads, and network devices. At mid-market scale the asset count is often 2 to 3 times the endpoint count, which is why per-asset rates look lower per-unit but often total higher than pure per-endpoint.
- What is a defensible SLA for an MDR contract?
- MTTD under 15 minutes for high-severity alerts, MTTA under 30 minutes, MTTR under 1 hour, tied to service credits (typically 5 to 15 percent of monthly fee per miss, capped at 25 to 50 percent of the monthly fee). See /annex/sla-matrix for vendor-by-vendor commitments.
- Does DORA change the cost of MDR for EU financial entities?
- Yes. DORA has applied since 17 January 2025 and adds ICT-third-party-risk register obligations, subcontracting registry obligations, and exit-and-portability clauses. Field-reported uplift is roughly +14 percent on MDR base.
- What is the offshore-staffed SOC discount, and what is the trade-off?
- Offshore-staffed providers (India, Philippines, LATAM) price at -30 to -50 percent off US list. The trade-offs are time-zone alignment, English-as-a-second-language friction during incident response, escalation latency, and data-export regulatory questions. Most production deployments use offshore for Tier-1 only.