Cost Estimates, Best-Fit Selection and Checklists
Managed SOC cost for an Indian manufacturer with 180 endpoints and two plants: a worked estimate
An illustrative managed security budget for an Indian MSME manufacturer — MDR, SOC-as-a-service log volume, firewalls at two plants, OT network separation, VAPT and 3-year contract maths.
An Indian MSME manufacturer with about 180 endpoints, a head office and two plants might budget, as an illustrative figure, around ₹16 to ₹20 lakh a year before GST for a managed security programme that includes 24×7 MDR on computers and servers, a SOC-as-a-service collecting firewall, server and ERP logs with 180-day retention, managed firewalls at three sites, a yearly VAPT, and a separate plan for the shop-floor (OT) network. The biggest variables are log volume, the number of servers and whether plant machines can run security agents at all. This guide builds the estimate step by step and belongs to the best-fit selection method.
The company
- Auto-components maker: head office in Pune, plants in Chakan and Hosur
- 150 desktops and laptops, 12 Windows servers (ERP, file, domain controllers, backup), 18 shop-floor PCs that run machine software
- ERP on an on-premises server; email on a cloud suite
- Customers are large OEMs whose supplier security requirements ask for log monitoring, incident notification and yearly testing
- IT team of three, office hours only
Step 1: sort the assets
| Asset group | Count | Can run an EDR agent? | Treatment |
|---|---|---|---|
| Office laptops and desktops | 150 | Yes | MDR |
| Servers | 12 | Yes | MDR at server rate |
| Shop-floor PCs | 18 | Often not supported by machine vendors | Network separation, monitoring at the firewall, approved-software controls where allowed |
| Firewalls | 3 sites | — | Managed firewall |
| Cloud email and identity | 165 accounts | — | Log monitoring |
Industrial machines and PLCs are a different world: patching and agents may void vendor support. Most MSMEs start by separating the plant network from the office network and monitoring traffic between them.
Step 2: estimate log volume
| Log source | Illustrative GB per day |
|---|---|
| 3 firewalls | 6.0 |
| 12 servers incl. domain controllers | 3.0 |
| ERP application and database audit logs | 1.0 |
| Cloud email and identity | 1.5 |
| Total | 11.5 |
Ask providers to measure during onboarding; estimates before onboarding are often wrong in both directions.
Step 3: line-by-line estimate (illustrative, before GST)
| Line | Basis | Annual cost |
|---|---|---|
| MDR, 150 endpoints | 150 × ₹5,500 | ₹8,25,000 |
| MDR, 12 servers | 12 × ₹16,000 | ₹1,92,000 |
| SOC-as-a-service, 12 GB/day tier, 90 days hot | ₹2,200 per GB/day per month × 12 GB × 12 | ₹3,16,800 |
| Archive to reach 180 days | 12 GB × 90 days = 1,080 GB × ₹10 × 12 | ₹1,29,600 |
| Managed firewalls, 3 sites | 3 × ₹60,000 subscription and management | ₹1,80,000 |
| OT network segmentation review | One-time ₹2,40,000 over 3 years | ₹80,000 |
| VAPT, external and internal | Per year | ₹2,20,000 |
| Onboarding | One-time ₹1,50,000 over 3 years | ₹50,000 |
| Total | ₹19,93,400 |
That is about ₹11,000 per endpoint a year across the 180 endpoints, or ₹1.66 lakh a month. With 18% GST the cash cost is ₹23,52,212 a year, normally recoverable as input tax credit for a registered manufacturer.
To test other per-endpoint bands, enter the 162 endpoints that run agents and the fixed lines (SOC, archive, firewalls, VAPT and the spread one-time costs) in the cost estimator.
Step 4: three-year contract maths
| Year | Recurring (excl. one-time spread) | Uplift | Total |
|---|---|---|---|
| 1 | ₹18,63,400 | — | ₹19,93,400 incl. ₹1,30,000 spread one-time |
| 2 | ₹18,63,400 × 1.07 = ₹19,93,838 | 7% | ₹21,23,838 |
| 3 | ₹19,93,838 × 1.07 = ₹21,33,407 | 7% | ₹22,63,407 |
Three-year total: ₹63,80,645 before GST. If the company negotiates a cap of 5% instead of 7%, years 2 and 3 become ₹19,56,570 + ₹1,30,000 and ₹20,54,399 + ₹1,30,000, total about ₹62,64,369 — a saving of about ₹1.2 lakh over the term. Small percentages on large bills matter; see hidden costs and renewal traps.
Where the estimate can go wrong
- Log volume doubles after onboarding because domain controllers are verbose. Ask for a filtering plan and the price of the next tier.
- Servers counted as multiple endpoints in one quote but not another.
- OT machines left out of every quote because they cannot run agents, so nobody owns their risk.
- Customer requirements change: an OEM may ask for evidence of incident response tests. Budget a tabletop exercise.
- Response at night depends on someone at the plant who can physically unplug a machine. Name that person in the escalation matrix.
Options to reduce cost
- Move from 90 to 30 days of hot storage and keep the rest in archive (the 180 days are still met).
- Use the security features in your existing licences for email and identity.
- Run the internal VAPT every second year, with quarterly scans in between, if your customers accept it.
- Consider an incident-response retainer only if MDR does not include enough forensic hours.
FAQ
Do we need a SOC, or is MDR enough?
With on-premises servers, three firewalls and customer requirements for log monitoring, a SOC with log collection adds visibility MDR alone may not give. A smaller plant-free firm may not need it.
Should the provider monitor the plant network?
Monitoring traffic at the firewall between office and plant is a common start. Deeper OT monitoring is a specialist service with its own sensors and pricing.
Who reports to CERT-In if the plant is hit?
Your business does, within six hours of noticing a reportable incident. The provider should prepare the information. See the CERT-In Directions guide.
Sources
- CERT-In — Directions, advisories for industrial control systems, empanelled auditors
- National Critical Information Infrastructure Protection Centre — guidance on protecting critical systems
- CBIC GST — GST and input tax credit
