Managed SOC Services: What the Quote Must Say Before You Compare Price

Q: What should a managed SOC services quote include?

The log sources and hours it covers, what the price is charged on, who owns and tunes the detection rules, what the SOC may do to your systems without calling you, how onboarding works, where your data is kept and who owns it, and what happens when the contract ends. A quote that gives only a monthly price and a response time cannot be compared with another.

Q: Why do managed SOC quotes for the same company differ so much?

Because they cover different amounts. One may monitor a fixed list of endpoints, another a data volume, and a third adds active response and rule tuning. The price follows the scope, so compare the scope first.

Q: Is it better to be priced per endpoint, per data volume or per user?

None is better in general. Each makes a different cost grow when your estate grows or changes: endpoints with device count, data volume with logging verbosity, users with headcount. Ask what happens to the price when you add a system or an attack makes logs spike.

Q: Who should own the detection rules in a managed SOC?

Ask for the answer in writing. Some providers keep rules as proprietary content you lose on exit, others deliver rules in a form you can take with you. Ownership affects both how well detections fit your business and how hard it is to change provider.

Q: Does a managed SOC replace an incident response retainer?

Usually not. Monitoring and triage are one service; investigation, containment at depth and forensics are another. The quote should say where the handoff happens and whether the second part is priced or only referred.

The short answer

A managed SOC quote is comparable only if it states seven things: which log sources, systems and hours are covered, what the price is charged on, who owns and tunes the detection rules, what the SOC may do on your systems without a phone call, how onboarding works before coverage is live, where your data is kept and who owns it, and what happens when you leave. Two providers can quote the same company at very different monthly prices because they monitor different amounts of it. Get those seven in writing before you compare price, and treat a quote that gives only a monthly figure and a response time as incomplete.

Who this is for

This is for the CISO, head of security or procurement owner at a casino, crypto exchange or fintech who holds two or three managed SOC proposals that look alike. It is about reading the quote, not about choosing a vendor or an operating model. For the SOC, MDR or SIEM decision that comes first, see SOC vs MDR vs SIEM for iGaming. For the contract wording behind response times, see where the SLA clock starts.

The seven lines to look for

Quote line	What to ask	Why it changes the price and the outcome
Coverage scope	Which log sources, systems and hours are covered, and which are not?	Monitoring only part of the estate leaves the rest unwatched.
Pricing basis	Is it charged per endpoint, data volume, user or flat, and what triggers an increase?	The basis decides what grows the bill when you grow.
Detection ownership	Who writes, tunes and owns the rules, and can you take them with you?	Rules fitted to your platform are the value; losing them on exit resets it.
Response authority	What can the SOC do without calling you, and what must wait for approval?	Detection without action is an alert service.
Onboarding	How long until coverage is live, and what is monitored in the meantime?	The first weeks are often the least covered.
Data terms	Where are logs stored, for how long, and who owns them?	These decide your audit evidence and your exposure.
Exit	What do you get back if you leave, and in what form?	A contract you cannot leave cleanly is lock-in.

Line 1: what the coverage covers

"24/7 managed SOC" is not a scope. Ask for the list of log sources and systems that feed monitoring, which hours are staffed by people rather than automation, and which parts of your estate are explicitly excluded. For a casino this means the cashier, the identity provider and the back-office tools; for an exchange, the custody and signing path. What the provider does not see, it cannot detect, so the exclusions matter more than the headline. Managed SOC for iGaming covers fixing those sources before onboarding.

Line 2: what the price is charged on

Providers charge on different bases: devices monitored, volume of data ingested, number of users, or a flat fee for a defined scope. Each makes a different thing grow. Endpoint pricing rises when you add machines, ingest pricing rises with logging verbosity and with attack traffic that floods logs, and user pricing rises with headcount. Ask what happens to the bill when you add a system, when an incident generates unusual volume, and whether there is a cap or a notice period before a rate changes.

Line 3: who owns the detection rules

Detections tuned to your platform are most of what you pay for. Ask whether the provider writes rules for your environment or applies generic content, how often they are tuned and on whose initiative, and whether the rules are delivered in a form you can keep. If the answer is proprietary content that stays with the provider, your detection quality leaves when the provider does. Also ask how false-positive noise is handled, since an unreviewed queue of alerts is a cost on your side.

Line 4: what the SOC may do without calling you

Triage and response are different services. Some providers notify and wait, others contain at a defined level, for example isolating an endpoint or disabling an account, under pre-agreed rules. The quote should list which actions are pre-authorized, which need your approval and who on your side can give it at night. The wording of "response" and the clock around it are covered in the SLA clock article; here the point is to see the authority written into the scope.

Line 5: onboarding before coverage is live

A SOC does not start monitoring on the signature date. Log sources have to be connected, baselines learned and rules tuned. Ask for the onboarding steps, who does what, what is monitored during that period and what the provider needs from your team. Then ask whether the full price starts on day one or when coverage is actually live. The answer shows whether the provider treats onboarding as part of the service or as your problem.

Line 6: data location, retention and ownership

Your logs are your audit evidence and may contain personal data. The quote or its annexes should say where logs are stored, for how long, who can access them and who owns them, and whether subprocessors are involved. For regulated firms these answers feed your own compliance file, so do not leave them to a later conversation. Retention that is shorter than your regulator or auditor expects is a gap you only find after an incident.

Line 7: reporting and exit

Ask what you receive on a regular basis, such as summaries, tuning changes and coverage gaps, and what an incident report contains. Then ask the exit question while you still have leverage: what data, rules and documentation do you get back, in what format, and by when. A provider that is vague about leaving is telling you how it expects the relationship to end. A related question, who takes over when an incident needs deeper work, belongs in the incident response retainer quote.

Red flags in a quote

"24/7" with no list of sources, systems or staffed hours.
A price basis that is not stated, or that can change without notice.
Detection content described as proprietary with no delivery of rules on exit.
A list of services with no statement of what the SOC may do on your systems.
Full fees starting before coverage is live, with no onboarding plan.
No statement of where logs are kept, for how long or who owns them.

Limitations

This is a reading guide, not a price list or a recommendation of any provider. It states no market prices, no durations and no AnySec-original figures, and it does not rank vendors. Terms vary by provider, plan and date, so read the current contract and service description for each option. A contract also does not prove detection works; that is shown by exercising it, for example with a penetration test that checks whether the SOC sees what a tester does.

What to do next

Put your proposals side by side against the table above and send the gaps back as questions. If you want help scoping what the SOC must cover and turning the answers into onboarding and escalation, request a fixed quote for Managed SOC and tell us your critical systems, your log sources and who can approve action at night. Our managed SOC services page describes how an engagement runs.

Frequently asked questions

What should a managed SOC services quote include? Coverage scope, pricing basis, detection ownership, response authority, onboarding, data terms and exit.

Why do managed SOC quotes for the same company differ so much? They cover different amounts. Compare the scope before the price.

Is it better to be priced per endpoint, per data volume or per user? None is better in general. Ask what makes the bill grow and what happens during an incident spike.

Who should own the detection rules in a managed SOC? Get the answer in writing, including whether rules can be taken with you on exit.

Does a managed SOC replace an incident response retainer? Usually not. The quote should say where monitoring ends and deeper response begins.

Sources and review

This article describes procurement practice in general terms and cites no statistics, prices or AnySec-original numbers, case results or SLA figures. Provider terms change; check each provider's current documentation. Author: AnySec Engineering. Published 2026-10-14; last reviewed 2026-10-14.