MDR vs MSSP vs SOC as a Service: How to Buy 24/7 Monitoring
MDR, MSSP or SOC as a service? Match 24/7 monitoring to your headcount, check provider minimums, and switch at renewal without a coverage gap.
Buy MDR if nobody on your staff can contain an attack at 3 a.m. Buy an MSSP if you have responders and need devices managed and alerts triaged. Buy co-managed SOC as a service if you run a SIEM with two or more security staff, and build in-house only above about eight.
Your trigger sets the deadline. A contract renewal, a provider that keeps missing, a past ransomware event or no overnight coverage at all each start the same countdown. It runs backward from the day your current coverage ends, and it needs about 180 days.
The counts are keyword-based, so read them as a ranking. Buyers ask for someone to watch and respond far more often than for another console. They describe contracts priced past budget, providers that keep missing, and nobody watching at night.
Find your model with the 24/7 monitoring fit checker
The fit checker returns one of four models (MDR, MSSP, co-managed SOC or in-house SOC) from your headcount, endpoints, security staff and compliance duties. It adds the checks that matter at your size and a dated switch plan counted back from your contract end date. It names no vendor and fills in no price.
Enter your employees, endpoints, security staff and contract end date, and the fit checker returns your starting model, size-specific checks and a dated 180-day switch plan.
Worked example. A company with 420 employees, 480 endpoints, one security FTE, no SIEM, a ransomware event last year and a contract ending June 30, 2027 gets MDR. Its switch plan starts January 1, 2027, the parallel run begins May 31, and cutover is June 30. A $60,000 annual quote works out to $10.42 per endpoint per month, or 9.3% of one in-house 24/7 seat in median wages.
What is the difference between MDR, MSSP and SOC as a service?
The difference is who acts when an alert is real. An MSSP monitors and manages security devices, then escalates to you, while MDR investigates and contains threats itself on endpoint, identity and cloud telemetry. SOC as a service runs detection across your logs, often on a SIEM you own, with whatever response authority you negotiate.
Each label covers a wide range of contracts. Two MDR providers can differ more from each other than one MDR provider differs from a strong MSSP. So turn every label into one question: which actions can the provider take without calling you first, and how fast?
Four actions matter at night: isolate a host, disable an account, revoke sessions and block an indicator. A provider that can do all four sells response. A provider that can do none sells a pager.
An MSP sits outside this choice. It runs patching, the help desk and remote management, and it rarely owns security response. The split between those roles is covered in how MSPs, MSSPs and co-managed IT split the work.
MDR vs MSSP
MDR suits lean teams because it carries the response itself. MSSPs grew out of firewall and intrusion detection management, and many still price per device and stop at escalation. If your firewall estate is large and your endpoint team is strong, an MSSP can still be the cheaper and cleaner answer.
Choose MDR if nobody on staff can isolate a host overnight. Choose an MSSP if you have responders and need devices run.
MDR vs SOC as a service
SOC as a service, also sold as managed SOC or SOCaaS, starts from logs. It suits companies whose audit burden lives in log review and retention, such as PCI DSS merchants. MDR starts from endpoint telemetry and adds identity and cloud, and many buyers above 1,000 employees end up with both.
Choose SOC as a service if your logs, more than your endpoints, carry the audit burden.
Which 24/7 monitoring model fits your company size?
Size sets your options through provider minimums. Under 100 employees, expect endpoint-led MDR and check every floor; from 100 to 1,000, MDR fits, or co-managed SOC if you already run a SIEM. From 1,000 to 5,000, co-managed SOC plus MDR is common, and above 5,000 a hybrid or in-house SOC becomes realistic.
- Under 100 employees: MDR bundled with an endpoint agent. Provider floors decide your shortlist.
- 100 to 1,000: MDR, or co-managed SOC if you tune a SIEM today. Confirm that response covers identity and cloud as well as laptops.
- 1,000 to 5,000: Co-managed SOC plus MDR on endpoints. Log volume pricing starts to drive the bill.
- 5,000 and up: Hybrid or in-house. Platform-native tiers with seat minimums open up.
Few providers publish their floors. Here is what I could verify in November 2026:
- Microsoft's Defender Experts MDR Plan 2 requires at least 1,500 licensed seats and Microsoft Sentinel.
- Arctic Wolf's smallest public package covers up to 100 users.
- Red Canary's marketplace listing states no minimum.
- CrowdStrike and Expel publish no floor.
Our calls show where floors bite. One buyer was dropping its MSSP, and the providers it interviewed could not handle data from about 2,500 employees. Another ran a one-person IT team that checked CrowdStrike by hand every day.
Providers also set revenue floors, so get each minimum in writing before you book a demo.
Choose by floor first. If a provider's minimum sits above your seat count, cut it from the list on day one.
What does 24/7 monitoring cost to buy and to build?
Few providers publish MDR prices. The two public listings I verified put one service at $120 per endpoint on a 12-month contract and another at $44,000 for up to 100 users over 12 months. Staffing one round-the-clock analyst seat in-house takes about five people, roughly $645,900 in median wages before benefits and tools.
Published MDR prices, checked November 2026
Read the units before you compare quotes. One listing prices endpoints, user accounts, cloud resources and networks separately. The other sells a 100-user package, so a 100-endpoint quote and a 100-user quote are different purchases. Some providers also bill each server as a user.
Term length changes the math too. The Red Canary listing offers up to 50% off at 24 months and up to 67% at 36 months. A longer term also carries you through any change of ownership, which matters in this market.
What an in-house 24/7 SOC costs to staff
One seat staffed 24x7x365 covers 8,760 hours a year. At about 1,800 productive hours per analyst after leave and training, that seat needs five people. Information security analysts earned a median $129,180 in May 2025, so five analysts cost $645,900 in median wages alone.
That figure is the floor. It leaves out:
- benefits, shift premiums and overtime
- a SOC lead and detection engineering
- the SIEM, EDR and automation licenses the analysts work in
- turnover, because night shifts burn people out and each replacement needs months to ramp up
Enter your own quote in the fit checker above to see it per endpoint and as a share of one in-house seat.
Choose to buy if your quote for full coverage costs less than one five-person seat. For nearly every company under 5,000 endpoints, it does.
Which US rules expect continuous security monitoring?
No US rule names MDR, but several set log-review, incident-response or disclosure clocks that are hard to meet without someone watching. PCI DSS v4.0.1 requires automated daily log review. Public companies generally have four business days to disclose after a materiality decision, and the FTC wants breach notice within 30 days.
Ask each shortlisted provider to show evidence for your strictest rule in its standard monthly report. A provider that needs a custom engagement to produce it will slow every audit you face.
For the plan itself, NIST SP 800-61 Revision 3, finalized in April 2025, recasts incident response as a CSF 2.0 Community Profile. Use it to map which roles you keep, which you buy and who signs off on containment.
Choose a provider that maps its reports to your strictest rule out of the box.
What must an MDR or MSSP contract say?
The contract must define response authority, measured response times, data ownership and exit. Ask for written definitions of time to acknowledge and time to contain, a list of actions the provider may take without approval, log retention that matches your strictest rule, and a data return format and deadline at termination.
I have watched a renewal roll over for another three years because nobody read the notice clause until day 45. These ten items belong in the order form or the master agreement:
- Measured times. Define when the clock starts (event ingested or alert raised), the severity tiers and the source of each metric. Require monthly reporting.
- Response authority matrix. List the actions the provider may take without approval: isolate host, disable account, revoke sessions, block indicators. Name the critical servers that need a call first.
- Coverage list. Name every telemetry and log source in scope, plus what is out, such as OT networks or specific SaaS apps.
- Data ownership and retention. You own raw logs, detections and case notes. Match retention to your strictest rule or auditor.
- Exit and data return. Set the export format, the deadline, help with agent removal and pricing for a parallel run.
- Notification duties. Set how fast the provider tells you about its own breach and how it supports your SEC, FTC or HIPAA clocks.
- Incident response scope. State whether a retainer is included, how many hours, and whether on-site work is covered.
- Insurance. Name the provider's cyber and technology errors and omissions limits, and check your carrier's panel rules.
- Liability caps and warranties. Read the carve-outs and any conditions attached to a claim.
- Renewal terms. Set the auto-renew notice window, a cap on price increases and your rights on a change of control.
Several of these are legal terms, so have counsel review them before signature. Then test the service itself with seven drills that expose MDR gaps before you sign.
Choose the provider whose standard paper already covers items 1, 2 and 5. Negotiating them from scratch adds weeks to a tight calendar.
How do you switch MDR providers without a coverage gap?
Start 180 days before the old contract ends and run both providers in parallel for at least 30 days. Most of the risk sits in notice clauses, agent swaps and log history, so sequence those first. Cut over only after the new provider has proven its detections in your environment.
I have seen a cutover fail because the new agent went in before the old one went passive. Two endpoint products competing for the same hooks can leave a host blind or unstable. Read which security controls go dark during a Defender and CrowdStrike migration before you schedule the agent swap.
If the switch also moves your SIEM, plan the overlap period described in what breaks when you replace an on-prem SIEM. Log history is the piece buyers forget until an auditor asks for it.
Few providers publish onboarding durations. Ask for one in the RFP and make it a contract milestone with a service credit attached.
Choose your cutover date only after the parallel run shows the new provider catching what the old one caught.
Does your EDR choice change the MDR decision?
Yes, because your EDR decides which providers can respond on your endpoints. Platform-native MDR runs on the vendor's own agent, while bring-your-own-tool providers work on the EDR you already own. If you hold Microsoft 365 E5, Defender XDR is already licensed, and the open question is who operates it overnight.
EDR moves came up in 84 of our calls. One buyer leaned toward Microsoft Defender but wanted alternatives first. A bank ran Defender while its parent company evaluated CrowdStrike for every subsidiary, which reshaped its MDR shortlist.
Microsoft's own service has eligibility rules. Defender Experts MDR Plan 1, formerly Defender Experts for XDR, needs at least one listed Defender product or Entra ID P2 in active mode, plus Entra ID P1, and a server counts as a user for billing. Weigh that against the E3 plus Defender Suite versus E5 licensing decision.
If the same renewal has you asking whether XDR can stand in for your SIEM, read whether XDR replaces SIEM at renewal before you scope log coverage.
Choose platform-native MDR if you are standardizing on one EDR for years. Choose bring-your-own-tool MDR if an EDR change is likely within the contract term. For vendor detail, see CrowdStrike, SentinelOne and Arctic Wolf compared as MDR services.
When should you stay with your provider or build an in-house SOC?
Stay with your current provider when it meets its measured response times and the failure is scope, which an amendment can fix. Build in-house when you have eight or more security staff, a SIEM you already tune, and regulators or customers who demand direct control. Everyone else should buy.
Run a stay-put test before you rebid. Ask the incumbent for 90 days of time-to-acknowledge and time-to-contain data by severity. If it meets the SLA and the complaint is a missing log source or a report format, I would renegotiate before I rebid.
Buyers on our calls describe the opposite case bluntly. They say they have been heartbroken too many times, they have been priced out of budget, or nobody watches at night. Those are rebid signals.
A hybrid also works. Your team covers business hours, and an MDR provider covers nights and weekends. Insurers read that split closely, so check how insurers read your EDR and MDR coverage before you sign.
Choose in-house if you can staff five analysts per seat and still fund detection engineering. Choose to stay if the metrics hold.
What changed in the MDR market in 2025 and 2026?
Ownership consolidated. Sophos completed its acquisition of Secureworks on February 3, 2025, and Zscaler completed its acquisition of Red Canary on August 1, 2025, running it at first as a separate business unit. Microsoft renamed Defender Experts for XDR to Defender Experts MDR Plan 1, so check change-of-control and product terms at every renewal.
New owners can move roadmaps, consoles and contract paper within a single term. If your provider changed hands, ask in writing which console, agent and support team you will have in 12 months. For one of these providers in detail, see what Red Canary is and how it works.
AI claims grew with the deals, and most providers now pitch AI triage. Ask for the share of alerts a human analyst reviews and for measured containment times. Judge the provider on those two numbers.
Regulation moved too. The Department of War suspended CMMC Phase 2 on July 13, 2026, and the HIPAA Security Rule overhaul proposed in January 2025 is still not final. Write both into your contract as change triggers, so scope can grow without a rebid.
What should you do next?
Run the fit checker and copy your result. Then mark your contract's notice date and ask three providers for floors, response authority and exit terms in writing before you see a demo. You are buying people and a contract, so a managed service comparison serves you better than a product demo.
- Run the fit checker and save the result to your ticket.
- Pull your contract and mark the notice date.
- Request 90 days of response metrics from your incumbent.
- Shortlist providers whose published floors fit your size, starting with our shortlist of MDR and XDR providers.
If you are rebuilding after an incident, read about responding to extortion when there is nothing left to restore alongside this plan.
When you want quotes you can compare line by line, TechnologyMatch matches you with vetted MDR, MSSP and SOC providers whose minimums fit your size. We brief them on your stack and contract date before the first call.
Compare 24/7 monitoring providers that fit your size
Tell us your headcount, stack and contract end date, and we match you with vetted MDR, MSSP and SOC providers whose minimums fit.
FAQ
Is MDR better than an MSSP?
MDR fits when you need the provider to contain threats itself. An MSSP fits when your own team responds and you need devices managed and alerts triaged. The deciding question is who may isolate a host at 3 a.m. without calling you.
Is SOC as a service the same as managed SOC?
Yes. Both terms describe an outsourced security operations function, usually built on SIEM log sources and sometimes sold as SOCaaS. Response authority varies by contract: some providers contain threats, and others only escalate.
How much does MDR cost per endpoint?
Few providers publish prices. Red Canary lists $120 per endpoint for a 12-month contract on AWS Marketplace, and Arctic Wolf lists $44,000 for up to 100 users over 12 months (checked November 2026). CrowdStrike Falcon Complete, Microsoft Defender Experts MDR, Sophos MDR and Expel are quote-only.
Do I need MDR if I already have EDR?
EDR detects threats and can isolate a device, but someone has to read the alert and decide. If nobody on your staff watches the console at night, MDR supplies that person. Many MDR providers can run on the EDR you already own.
What is a co-managed SOC?
A co-managed SOC splits detection and response between your team and a provider, usually on a SIEM and EDR you own. You keep decision rights, and the provider covers the hours and alert volume you cannot. It fits teams with two or more security staff.
How long does it take to switch MDR providers?
Plan for about 180 days from contract review to cutover, including at least 30 days of parallel running. Few providers publish onboarding durations, so ask for one in writing and make it a contract milestone.
Can a company under 100 employees get 24/7 monitoring?
Yes, but provider minimums decide the options. Some public MDR packages start at 100 users, and other providers publish no minimum at all, so confirm the floor before a demo. Endpoint-led MDR bundled with an agent is the usual fit at this size.
How does the 24/7 monitoring fit checker pick a model?
The fit checker applies four rules in order: in-house or hybrid SOC at 8 or more security staff and 5,000 or more endpoints, then co-managed SOC at 2 or more staff with a SIEM or heavy log duties, then MSSP for alert-only needs with a responder on call, then MDR. It also builds a dated switch plan from your contract end date and never names a vendor.
Does CMMC require an MSSP?
No. CMMC sets security requirements, and you choose how to meet them. If an MSSP delivers security protection assets such as a SIEM, those services fall inside your assessment scope. Phase 2 third-party assessments were suspended on July 13, 2026, while Phase 1 self-assessments remain in force.
