What a managed SOC costs for an SME

“24/7 SOC” is sold as a command center. For an SME the useful cost is different: someone looking at EDR and identity alerts when your team is off, with an escalation channel. If the quote lists neither sources nor a triage SLA, it is not comparable. What moves the price Number of devices and sites. Sources: EDR only, or email and identity too. Hours: office, extended, or 24/7. Triage time and human escalation. SOC and EDR are not the same EDR produces telemetry. The SOC operates it. Buying a SOC without an operated endpoint is paying for an empty room. For many SMEs the managed layer (Securiza720 + EDR) covers 80% of the value before an expensive SIEM. How to request a quote without getting lost Ask in writing: included sources, exclusions, hours, who is woken, and what happens on a false positive. Then decide whether you need a bounded managed SOC or operated EDR is enough. A short diagnostic avoids signing operations theatre.