Every SOC provider prices differently, which makes comparing them unusually hard. One quotes per endpoint. Another quotes per gigabyte of log data. A third quotes a flat monthly retainer and will not explain how it was calculated.
Underneath, they are all pricing the same two things: how much data they have to watch, and how many trained humans have to watch it. This guide explains the pricing models used in India in 2026, what the numbers typically look like, and which questions expose the difference between a real security operations centre and a dashboard with an alert feed.
What you are actually buying
A security operations centre is not software. The SIEM platform is the smallest part of the cost. What you are paying for is analyst coverage across three shifts, the tuning work that stops your team drowning in false positives, and a defined response when something real happens at two in the morning.
That distinction matters because the cheapest quotes are almost always selling tooling with an alert email attached. If nobody is contractually obliged to investigate an alert within a stated time, you have bought monitoring, not operations. Our explainer on what SOC support actually involves covers the difference in detail.
The four pricing models
Per endpoint or per device
The most common model in India, and the easiest to compare. Indicative monthly ranges:
- Workstations and endpoints: ₹300 – ₹800 per endpoint
- Servers: ₹1,500 – ₹4,000 per server
- Network devices: ₹800 – ₹2,500 per device
- Cloud workloads: ₹2,000 – ₹5,000 per workload
Straightforward to budget, but it can penalise you for having a large, low-risk estate of laptops while under-pricing the handful of servers that actually matter.
Per user
Roughly ₹200 – ₹800 per user per month for basic monitoring, and ₹800 – ₹2,000 per user per month where full managed detection and response with incident handling is included. This model suits organisations where headcount is a reasonable proxy for risk, and it scales predictably as you hire.
Per gigabyte of log data
Typically ₹150 – ₹500 per GB per day, covering ingestion, monitoring and first-line response. A mid-market business commonly generates five to fifty GB a day.
This model is honest about the real cost driver, but it creates a perverse incentive: you end up reluctant to send valuable log sources because each one raises the bill. If you go this route, agree in advance which sources are in scope and cap the overage rate.
Flat monthly tier
A bundled retainer against a stated estate size. Indicative Indian ranges in 2026:
| Estate size | Typical monthly retainer |
|---|---|
| Up to 100 endpoints | ₹1.0 – ₹2.0 lakh |
| 100 – 500 endpoints | ₹2.0 – ₹5.0 lakh |
| 500 – 2,000 endpoints | ₹5.0 – ₹12.0 lakh |
| 2,000+ endpoints | ₹12.0 lakh and above |
Easiest to budget and easiest to hide margin inside. Ask what happens when you exceed the tier.
In-house SOC versus managed SOC
Round-the-clock coverage needs a minimum of eight to ten analysts once you account for three shifts, leave and attrition. Add SIEM licensing, threat intelligence feeds, an EDR platform and the infrastructure underneath, and a genuine in-house SOC in India lands in the region of ₹2 crore a year before you have handled a single incident.
A managed SOC for a comparable mid-market estate typically runs ₹30 – ₹60 lakh a year. The gap is not because managed providers are more efficient at analysis; it is because they spread the same analyst bench across many clients.
The case for in-house is real in two situations: when regulation requires data and monitoring to stay inside your own boundary, and when your environment is unusual enough that generic detection rules will never fit. For most businesses under a few thousand endpoints, the maths favours managed.
The costs that do not appear in the quote
- Onboarding and integration. Connecting log sources, deploying agents and tuning out the first wave of false positives usually takes four to eight weeks. Ask whether it is included.
- Custom detection rules. Frequently billed separately, in the range of ₹10,000 – ₹50,000 per rule.
- Escalation to senior analysts. Some contracts bill L2 and L3 involvement hourly, around ₹3,000 – ₹8,000 per hour. That is exactly when you need them most.
- Alert volume overage. A noisy month can trigger surcharges under volume-based contracts.
- Incident response retainers. Detection and full forensic response are usually separate line items. Confirm which you are buying.
- Log retention. Compliance may require twelve months; the quote may assume three.
What separates a real SOC from a dashboard
- A written SLA for time-to-acknowledge and time-to-investigate, by severity — not just uptime
- Named escalation paths and a tested out-of-hours contact process
- Analysts who investigate and close alerts, rather than forwarding them to you
- Containment authority agreed in advance: can they isolate a host at 3am, or must they wait for you?
- Regular tuning reviews, with false-positive rates reported as a metric
- Threat hunting, not only rule-based alerting
- Monthly reporting a non-technical executive can read
How to compare SOC proposals
- Convert every quote to the same unit — cost per endpoint per month — before comparing.
- Ask for the SLA table, with severity definitions and response times in writing.
- Ask how many analysts are on shift at 3am on a Sunday, and where they sit.
- Ask what the provider is contractually permitted to do without your approval.
- Ask for the log source list they assume, and price the sources they left out.
- Ask for a sample monthly report and a sample incident report.
- Confirm the exit terms and who owns the historical log data if you leave.
Frequently asked questions
Is SOC as a Service the same as MDR?
They overlap heavily and vendors use the terms loosely. In practice, managed detection and response usually implies a stronger commitment to active containment, while SOC as a Service can stop at monitoring and escalation. Read the SLA rather than the label — our guide to managed detection and response unpacks the distinction.
Do we still need a SIEM if we buy a managed SOC?
You need the capability, but usually not your own licence. Most providers include their platform. If they use yours, licensing sits on your side of the budget — see our overview of how SIEM works.
How long does onboarding take?
Four to eight weeks is typical for a mid-sized estate: agent deployment, log source integration, baselining and tuning. Anyone promising meaningful coverage in a week is skipping the tuning, and you will feel it in the alert volume.
What size of business does this make sense for?
Below roughly fifty endpoints, well-configured endpoint protection plus a managed IT provider is often sufficient. Above that, or wherever regulated data is involved, the case for continuous monitoring strengthens quickly.
Can a managed SOC cover cloud as well as on-premise?
Yes, and it should. Cloud workloads are usually priced separately because the log volume and integration effort differ from a physical server.
Working out your own number
Start from your estate: endpoint count, server count, cloud workloads, and the log sources you are required to retain. That list, not a price list, determines what any provider will quote.
To scope 24/7 coverage for your environment, see our SOC support services or get in touch through our contact page.
All figures in this guide are indicative market ranges for India in 2026, compiled for budgeting purposes. They are not a quotation and will vary by provider and scope.
See also: best cyber security companies in Noida (2026).
A Worked Example: 120 Endpoints, Two Sites
Abstract pricing models are hard to argue with a finance team. Here is the same requirement priced three ways, using the bands above.
- Per endpoint. 120 endpoints plus 8 servers at the middle of the per-device band lands in the region of ₹1,10,000–₹1,60,000 per month. Predictable, and it rises only when you add devices.
- Per user. 140 users priced per user lands in a similar range, but it moves differently: a business with many shared or unattended devices pays less, a business with several devices per user pays more.
- Per gigabyte ingested. Two sites with firewalls, domain controllers, endpoint telemetry and cloud audit logs will typically generate 15–35 GB a day. At that volume the monthly figure can vary by a factor of two depending on which sources are forwarded — which is why log source selection is a commercial decision, not just a technical one.
The lesson is not that one model is cheaper. It is that the same environment produces very different invoices depending on the model, so ask each provider to quote your actual device, user and log-volume numbers rather than a headline rate.
The Contract Terms That Decide Real Cost
- Log retention. Thirty days is common in the base price; ninety days to a year is what you need to investigate an incident found late. Retention is often the largest single cost lever.
- Response scope. Notify-only is cheaper than a provider who will isolate a host or disable an account at 3am. Establish which you are buying.
- Onboarding fee. Log source integration, tuning and rule development are frequently billed separately as a one-time cost.
- Included integrations. Some providers cap the number of log sources; additional firewalls, SaaS applications or cloud accounts then attract a charge.
- Escalation path. A named contact and defined SLA per severity, or a shared inbox. This is the difference between a SOC and a dashboard.
- Exit terms. Whether your historical log data is exportable when the contract ends.
When a Managed SOC Is Premature
Monitoring an environment that has not been hardened produces alerts you cannot act on. If MFA is not enforced everywhere, patching is irregular, backups are untested or nobody has an asset inventory, that work comes first — it is cheaper and it removes more risk. A gap assessment or a scoped VAPT is usually the better first purchase, with SOC support layered on once the basics are in place.
The rough threshold at which continuous monitoring starts to earn its cost is somewhere around 75–100 endpoints, or earlier if you hold regulated personal data, run internet-facing applications, or have a contractual obligation to detect and report incidents. The DPDP Act pushes that threshold down for anyone processing personal data at scale.