Managed Security Costs, Price Drivers and 2026 Rules
MSSP vs MDR vs SOC-as-a-service: what each managed security service includes
Plain-English comparison of MSSP, MDR, SOC-as-a-service, managed EDR and firewall, vCISO and VAPT for Indian MSMEs — what is included, what is not, and how each is priced.
An MSSP (managed security service provider) runs security tools and devices for you; MDR (managed detection and response) watches your endpoints round the clock and acts on threats; a SOC-as-a-service collects logs from many systems into a SIEM and monitors them. In practice, most Indian providers sell some mix of all three, so the label on a proposal tells you little. What matters is the list of assets watched, the hours, and what the provider will do when it finds something. This guide defines each service, shows what is usually included and excluded, and is part of the managed security pricing overview.
The services, side by side
| Service | Core job | Usually included | Often excluded or extra |
|---|---|---|---|
| Managed antivirus / EDR | Protect each device | Agent, policies, alert triage | Night-time response, server coverage, mobile devices |
| Managed firewall / UTM | Protect the network edge | Rules, VPN, updates, basic logs | Hardware refresh, unlimited rule changes, long log retention |
| MDR | Detect and stop attacks on endpoints | 24×7 analysts, investigation, remote isolation | Cloud and SaaS logs, on-site help, forensics |
| SOC-as-a-service | Watch logs across the estate | SIEM, log connectors, correlation, incident tickets | Extra GB per day, longer retention, custom use cases |
| MSSP bundle | One provider for several tools | Combination of the above, reports | Tools you already own, deep remediation |
| Virtual CISO | Part-time security leadership | Policies, risk register, audit prep | Hands-on operations, tool licences |
| VAPT | Find exploitable weaknesses | Scans, manual testing, report, retest | Fixing the findings, repeated retests |
| Incident-response retainer | Help during and after an attack | Hotline, pre-agreed hours, forensics | Travel, data recovery tools, legal advice |
EDR, MDR and XDR: the endpoint family
- EDR (endpoint detection and response) is software. It records what happens on a device and can block or isolate it. Someone still has to read its alerts.
- MDR is EDR plus people: a provider's analysts read the alerts 24×7, investigate and, if the contract allows, isolate the device, kill a process or disable a user.
- XDR (extended detection and response) is a marketing term for EDR that also takes in email, identity, cloud and network signals. Ask which signals are actually connected in your price.
Illustrative example. A laptop starts encrypting files at 1:40 a.m. on a Sunday. With EDR alone, an alert sits in an inbox until Monday. With MDR whose contract allows isolation, an analyst cuts the laptop off the network within minutes and calls your escalation contact. The licence may be similar; the outcome is not.
SIEM and SOC-as-a-service
A SIEM (security information and event management) system collects logs from firewalls, servers, Microsoft 365 or Google Workspace, cloud accounts and applications, and looks for patterns. A SOC (security operations centre) is the team that watches it. SOC-as-a-service providers usually price by:
- log volume (GB per day) or events per second,
- number of log sources or "endpoint equivalents",
- retention period (hot searchable storage costs more than archive).
The CERT-In Directions of April 2022 expect logs of ICT systems to be kept for a rolling 180 days within Indian jurisdiction. A SIEM tier with 30 or 90 days of retention needs an archive arrangement on top. See CERT-In Directions for MSMEs.
MSSP bundles
Many Indian MSSPs, from large telecom and IT service groups to regional specialists, package EDR, firewall management, email security and monitoring as one per-user or per-device price. Bundles are convenient but check three things:
- Overlap with what you already pay for. If your office suite licence already includes endpoint protection or email filtering, you may be paying twice.
- Tool lock-in. If the provider supplies the licences, leaving means replacing every agent.
- Who owns the data. Logs, reports and configurations should be handed over at exit. See SLA and contract questions.
Advisory and testing services
- Virtual CISO: a senior person for a set number of days each month to write policies, run risk reviews, answer customer security questionnaires and report to management. See vCISO costs.
- VAPT: vulnerability assessment (largely automated scanning) plus penetration testing (manual attempts to exploit). Some customers and regulators require testing by a CERT-In empanelled auditor. See VAPT cost and empanelled auditors.
- Incident-response retainer: pre-booked help for the worst day. See incident-response retainers.
Which combination fits which business (illustrative)
| Business profile | A reasonable starting combination |
|---|---|
| 10–25 people, everything in SaaS, no servers | Managed EDR or MDR on laptops, email security, yearly external VAPT |
| 25–100 people, one office, file server | MDR, managed firewall, Microsoft 365 or Google logs into monitoring, VAPT |
| 100–300 endpoints, plant or warehouse | MDR, managed firewalls at each site, SOC-as-a-service with 180-day retention, vCISO a few days a month |
| Customer or regulator asks for a SOC | SOC-as-a-service with documented SLAs and audit evidence, VAPT by an empanelled auditor |
The best-fit selection method turns these into a scored shortlist.
FAQ
Is MDR the same as a SOC?
Not quite. MDR is centred on endpoints and response. A SOC-as-a-service is centred on logs from many sources. Good MDR providers add some log sources; good SOC providers add some response. Compare the scope list.
Do we still need IT staff if we buy MDR?
Yes. Someone must approve changes, fix root causes, patch systems and be reachable at night. MDR replaces the watching, not ownership.
What is "co-managed"?
A model where your IT team and the provider share the tools and duties, for example your team handles office hours and the provider handles nights. It usually costs less than fully managed but needs clear hand-over rules.
Sources
- CERT-In — Directions of 28 April 2022 on logs and incident reporting, advisories and the empanelled auditor list
- MeitY — Information Technology Act and data protection framework
- National Critical Information Infrastructure Protection Centre — guidance for critical information infrastructure sectors
