What is the biggest cost in running a SOC?

People, in almost every case. Round-the-clock cover needs several people for each seat that must always be filled, because each person works only a fraction of the hours in a year. Tools come second, and hidden costs such as hiring, turnover and time spent on false positives add more than most budgets show.

How many analysts does a SOC need for round-the-clock cover?

Work it out from seats. A year has 8,760 hours. If an analyst gives around 1,720 productive hours a year, keeping one seat filled at all times takes just over five people, and two seats take just over ten. Use your own figure for productive hours, which depends on leave, holidays and training. Then check the workload: if alert volume needs more seats at busy times, add them.

Is an outsourced SOC cheaper than an in-house one?

Often it is at small scale, because a provider shares the cost of night shifts across many customers. As you grow, compare carefully: outsourced services are often priced per machine or user, so the bill rises with the business. Include the time your own team still spends on escalations and decisions.

How do I estimate the cost of false positives?

Multiply the number of harmless alerts a year by the average minutes it takes to close one, convert to hours, and multiply by the full cost of an analyst hour. Measure the minutes from a sample of real alerts rather than guessing; the result is usually larger than expected.

Does an AI analyst mean we can run a SOC with no people?

No. An AI analyst can take the first look and give a verdict with evidence, but people still need to review verdicts, decide what to do about real attacks, take any actions and keep detection healthy. What changes is where their time goes.

How much does a SOC cost? A way to work it out

How much does a SOC cost?

A SOC costs whatever your staffing, tools and hidden costs add up to, and the largest part is almost always people. Published figures vary so widely, and are measured in such different ways, that they rarely help with your own budget. A better approach is to work it out from a few numbers you already know or can estimate: how many alerts you get, how long each takes, what an analyst hour costs, and how many hours of cover you need.

This guide gives a method in four parts: staffing for round-the-clock cover, tools, hidden costs, and a worked example that shows the arithmetic. The example uses illustrative numbers, stated as assumptions, so you can swap in your own. It is not a quote for any product, and it is not armor360’s price.

How to work out staffing for round-the-clock cover

Start with seats, not people. A seat is one position that must be filled at a given time, such as one analyst watching the queue overnight. A year has 365 days of 24 hours, which is 8,760 hours for each seat that must always be filled.

Now divide by what one person really works. After annual leave, public holidays, sickness, training and meetings, a full-time analyst might give around 1,720 productive hours a year; use your own figure if you have one. At that rate, keeping one seat filled at all times takes 8,760 ÷ 1,720, or just over five people. Two seats at all times takes just over ten. That is why round-the-clock cover is expensive even for a quiet SOC: the cost is set by the clock, not by the workload.

Then add the roles around the seats: someone to lead the shifts, someone senior for escalations, someone to look after detection rules and tools. In small teams one person may do several of these, but the work still needs doing.

Count the seats you need at each time of day and week
Multiply by the hours each seat must be filled in a year
Divide by the productive hours of one analyst, after leave, holidays and training
Add leads, escalation and engineering roles
Multiply by the full cost of each role, not salary alone

What tools a SOC needs to budget for

Tools are the second large line. Most SOCs need a SIEM to collect and search logs, endpoint detection and response (EDR) on laptops and servers, and threat intelligence to check addresses, domains and files. Many add a ticketing system, a case management tool, SOAR for repeatable actions, and storage for logs kept for investigations and audits.

Check how each tool is priced, because the pricing shape matters as much as the price. SIEMs are often priced by the amount of data taken in or stored, so cost grows with log volume. EDR is usually priced per machine. Threat intelligence may be priced per lookup or by subscription. A cost that looks small today can grow fast if it is tied to something that is growing.

Include the people time to run the tools. A SIEM that nobody tunes produces noise, and noise turns into analyst hours.

SIEM: priced by data taken in or stored
EDR: priced per machine protected
Threat intelligence: subscriptions or per-lookup charges
Ticketing, case management and SOAR
Log storage for investigation and audit periods
Engineering time to run, tune and upgrade each tool

What hidden costs a SOC budget misses

The costs most often left out are the ones that do not appear on an invoice. Hiring takes recruiter fees, interview time and months before a new analyst is fully useful. Turnover repeats that cost each time someone leaves, and night shifts and repetitive alert work tend to make people leave sooner.

False positives are the largest hidden cost in many SOCs. Each harmless alert still takes an analyst’s time to read, check and close. When most of the queue is harmless, most of the staffing budget is spent proving that nothing happened. That time also has an opportunity cost: hours spent closing noise are hours not spent on real investigations, threat hunting or improving detection rules.

Add the cost of what is skipped. When alerts outnumber the hours to read them, some are closed unread or sampled. That does not show in the budget, but it is a risk you are paying for in another way.

Hiring: fees, interview time, months to full productivity
Turnover: repeating the hiring cost, losing knowledge of your environment
False positives: analyst time spent closing harmless alerts
Skipped alerts: risk carried when the queue is larger than the team
Management time: rotas, reviews, audits and reporting

A worked example of SOC alert-handling cost

Here is an illustrative example. The numbers are assumptions chosen to show the method, not figures from any real SOC or any survey. Change each one to match your own environment.

Assume 150 alerts a day, each taking an analyst 20 minutes to look into by hand, at a full cost of $60 an analyst hour, on 360 working days a year, with each analyst giving 1,720 productive hours a year.

On these assumptions, looking at the alerts by hand takes about ten and a half full-time analysts’ worth of work and costs $1,080,000 a year, before tools, leads, round-the-clock seat cover or the hidden costs above. Note that this is first-look time only. Real attacks then need much longer investigations on top.

Alerts a year: 150 × 360 = 54,000
Minutes a day: 150 × 20 = 3,000 minutes, which is 50 hours
Hours a year: 50 × 360 = 18,000 analyst hours
Cost a year: 18,000 × $60 = $1,080,000
Analysts’ worth of work: 18,000 ÷ 1,720 = about 10.5 full-time analysts

What changes if an AI analyst takes the first look

Now keep the same assumptions, but suppose an AI analyst investigates each alert first, at about $0.10 of compute each, and a person spends 3 minutes reviewing its verdict and the evidence behind it instead of 20 minutes working the alert from scratch.

On these illustrative numbers the first-look work drops from 18,000 hours to 2,700 hours a year, and its cost from $1,080,000 to $167,400. The difference, 15,300 hours or $912,600, is time and money that was going on first looks. It is not a promised saving. The example leaves out the price of the AI product itself, any hardware it runs on, and the work of setting it up, and those must be added before comparing.

It also matters what the freed hours are used for. In most teams the useful answer is not to cut the team but to point the same people at work that was being skipped: deeper investigation of real attacks, the low-severity alerts nobody had time for, threat hunting and tuning noisy rules. A review that takes 3 minutes still needs a person who knows what they are reading.

Compute: 150 × $0.10 = $15 a day; $15 × 360 = $5,400 a year
Review time: 150 × 3 = 450 minutes, which is 7.5 hours a day
Review hours a year: 7.5 × 360 = 2,700 analyst hours
Review cost a year: 2,700 × $60 = $162,000
Total first-look cost: $5,400 + $162,000 = $167,400 a year
Review work in analysts: 2,700 ÷ 1,720 = about 1.6 full-time analysts

One night, looked into as it happenedIllustrated example

19:24Harmless

21:06Authorised

23:36Suspicious

02:14Real attack On call told

03:31Harmless

05:02Harmless

06:47Suspicious

08:00: seven investigations finished, one real attack already with the on-call person.

Each alert is investigated when it arrives. The real attack at 02:14 reaches the person on call; the rest wait for the morning with their verdicts written.

How to run the numbers for your own SOC

Measure before you estimate. Count your alerts for a few normal weeks, including a month-end, and time a sample of investigations from opening to verdict. Most teams find the spread is wide: many alerts close in a few minutes and a few take hours. Use the average for the budget, but keep the spread in mind when planning cover.

Use the full cost of an analyst hour, not salary alone. Add employer taxes, benefits, training, equipment and a share of management, then divide by productive hours, not paid hours. Do the same for the alternative you are considering: its price, any hardware, the set-up work and the review time it still needs.

Then test the result. Change each assumption by a reasonable amount and see which ones move the answer most. Usually it is alert volume and minutes per alert, which is a good reason to measure those two carefully. The savings calculator on our pricing page lets you enter your own numbers and see the same arithmetic.

How armor360 approaches it

armor360 is an AI SOC analyst that investigates alerts from the tools you already run and hands a person a verdict with the evidence cited. Our estimate of its running cost is about $0.10 of compute per investigation, which is an estimate of running cost and not a price. People review each verdict and decide what to do; armor360 takes no response actions.

armor360’s price is by quote, sized to what you protect, with no charge per person. The worked example above is illustrative and does not show our price.