Author
Luis Miguel Otero Aponte
Pentester · Ciberseguridad720
A managed SOC (Security Operations Center) is an external team that watches your company’s security alerts and responds when something happens. Its price is not a fixed figure: it depends on how many devices and users it protects, which sources it monitors, the coverage hours and how far the response goes.
Number of devices, servers, users and sites.
Sources monitored: EDR only, or also email, identity, cloud and network.
Hours: business hours, extended or 24/7.
Response times agreed in writing.
What the response includes: only alerting, or also containing and remediating.
Whether log retention, reports and follow-up meetings are included.
| In-house SOC | Managed SOC | MDR | |
|---|---|---|---|
| Who runs it | Your team | A provider | A provider, focused on EDR |
| What it watches | Whatever you decide | Several sources (SIEM) | Mainly devices and identity |
| Response | Yours | As per contract | Included: isolate, contain, remediate |
| Best fit | Large organisations | Companies with several sources to monitor | Most SMEs and mid-sized companies |
Building your own 24/7 SOC is expensive by plain arithmetic: a year has 8,760 hours and one person works about 1,700, so covering a single seat all year takes at least five people, before holidays, sick leave or training. That is why most companies buy it as a service.
EDR produces the device telemetry; the SOC watches it and responds. Buying a SOC without a well-deployed EDR is paying to watch an empty room, and having EDR with nobody reviewing the alerts is having a console nobody opens.
Which sources are included and which are not.
Coverage hours and who gets alerted at night.
Response times by severity, in writing.
Which actions they take without asking (for example, isolating a device).
How they handle false positives and which reports you receive.
At Ciberseguridad720 the 24/7 SOC/MDR is built into Securiza720, together with EDR, backups and response. We start with a free diagnostic and give you a tailored proposal.
Does an SME need a SOC? It needs someone watching the alerts outside office hours. For most, managed EDR with a 24/7 MDR covers that need without building an in-house SOC.
Does a SOC help with NIS2? It helps meet incident handling and the notification deadlines (24 h, 72 h and one month), because it detects and documents what happens.
Keep exploring the same topic with more practical reads already available in the blog.
Published Aug 21, 2026 · 7 min read
Do not choose by vendor logo. Choose by operations: who triages, what is out of scope, how you are billed, and what happens at 3 a.m. on Saturday.
Luis Miguel Otero Aponte
Pentester · Ciberseguridad720
Published Aug 18, 2026 · 8 min read
Antivirus blocks what it already knows. EDR watches behaviour, isolates the device and keeps the trail of the attack. We explain the difference with a table and when to make the jump.
Luis Miguel Otero Aponte
Pentester · Ciberseguridad720
Published Feb 16, 2026 · 5 min read
How attackers hijack Meta Business accounts through phishing and session cookie theft, drain ad budgets and scam customers, and how SMEs can stop them.
Luis Miguel Otero Aponte
Pentester · Ciberseguridad720