Tier-1+2+3 SOC Pricing 2026: Hunt and Active Response
Tier-1+2+3 is the full-fat tier: monitor, triage, validate, hunt, and actively respond. The vendor has delegated authority to take action on the customer's environment (isolation, account disablement, malicious-process termination). Named threat hunting teams (eSentire TRU, CrowdStrike OverWatch, Arctic Wolf CST) sit at this tier.
$ 12 to $ 35
What this tier is
Full Tier-1+2 plus proactive threat hunting and vendor-driven active response (isolation, containment, eviction).
What this tier is not
Not unlimited incident response. Most Tier-3 contracts cap IR hours at a retainer level; major incidents convert to a separate IR engagement billed hourly.
Best-fit vendors at this tier
- eSentire. Threat Response Unit (TRU) hunting is the marketed differentiator; hybrid Atlas XDR + service metering.
- CrowdStrike Falcon Complete. OverWatch hunting bundled; $ 1M Breach Warranty trigger conditions are public.