Cost Estimates, Best-Fit Selection and Checklists
In-house SOC vs managed SOC in India: build-or-buy cost and payback
What a 24×7 in-house security operations centre really costs an Indian MSME — staff rotation, tools, training, attrition — compared with a managed SOC or MDR, with a payback worked example.
Running your own 24×7 security operations centre means paying for enough analysts to fill every shift, every day of the year, including leave and attrition, plus SIEM and EDR licences, training and management time. For most Indian MSMEs that adds up, as an illustrative figure, to well over ₹50 lakh a year, while a managed SOC or MDR service for the same estate is often a fraction of that. In-house can still make sense for larger firms, regulated entities or businesses with unusual systems, and many settle on a co-managed model in between. This guide shows the arithmetic and how to use the build-versus-buy payback calculator. It belongs to the best-fit selection method.
Why 24×7 needs at least five people
A year has 8,760 hours. One full-time analyst works roughly 8 hours × 5 days × about 46 weeks after leave and holidays: about 1,840 hours. 8,760 ÷ 1,840 ≈ 4.8 people to keep one seat filled around the clock, before training days, sickness and resignations. Most teams plan for five to six analysts for a single 24×7 seat, plus a lead.
In-house cost (illustrative, per year)
| Line | Basis | Annual cost |
|---|---|---|
| Analysts | 5 × ₹9,00,000 total employment cost | ₹45,00,000 |
| SOC lead | 1 × ₹22,00,000 | ₹22,00,000 |
| SIEM licence and storage for 180 days | Platform subscription | ₹8,00,000 |
| EDR licences, 150 endpoints | 150 × ₹1,800 | ₹2,70,000 |
| Training and certifications | 6 × ₹60,000 | ₹3,60,000 |
| Threat intelligence feeds, tools | Subscription | ₹2,00,000 |
| Recruitment to replace attrition | Illustrative 2 hires a year × ₹1,50,000 | ₹3,00,000 |
| Total | ₹86,30,000 |
Salaries in security vary widely by city and experience; these figures only show the shape of the cost.
Managed alternative (illustrative)
For the same 150 endpoints and similar log sources, a managed SOC with MDR might be quoted at, say, ₹22 lakh a year. You still need one internal owner, perhaps an IT manager spending part of their time, valued at ₹6 lakh. Total ≈ ₹28 lakh.
Annual saving = ₹86.3 lakh − ₹28 lakh = ₹58.3 lakh.
Payback of switching (illustrative)
If you already run an in-house team and switch, the one-time cost might be ₹6 lakh (onboarding, agent migration, log connectors, overlap month). With a yearly saving of ₹58.3 lakh, payback is about five weeks. With the calculator defaults (₹4 lakh one-time, ₹9 lakh saving, 8% growth, 3 years), payback is under six months and the three-year net saving about ₹25 lakh.
The option many MSMEs actually compare: office hours only
The real alternative for many small firms is one IT person watching alerts in office hours, with nothing at night. Illustratively, that costs a share of an IT salary (say ₹4 lakh of a ₹12 lakh role) plus ₹2.7 lakh of EDR licences: about ₹6.7 lakh a year. A managed MDR service for 150 endpoints at an illustrative ₹6,000 each costs ₹9 lakh. The extra ₹2.3 lakh a year buys the nights, weekends and holidays, which together are about four-fifths of the hours in a year (roughly 6,900 of 8,760). Whether that is worth it depends on what one night of unchecked ransomware would cost you; for most businesses with on-premises servers, it is more than ₹2.3 lakh.
When in-house can make sense
| Situation | Why |
|---|---|
| Very large or complex estate | Managed pricing per endpoint or GB may exceed the cost of a team |
| Regulator expects a SOC with specific controls | Some regulated entities must meet detailed requirements; check RBI or SEBI rules |
| Highly specialised systems | Plant OT, proprietary platforms, unusual data |
| Data cannot leave your control | Contracts or policy prevent external access to logs |
Co-managed: the middle ground
In a co-managed model your team handles office hours and change work; the provider covers nights, weekends and holidays, or provides the SIEM platform and senior escalation. Costs fall between the two, but only if responsibilities are written down clearly. Typical splits:
- Provider: 24×7 monitoring, triage, containment within agreed limits, threat hunting.
- Your team: patching, user issues, root-cause fixes, business decisions, CERT-In submission.
Hidden costs on both sides
| In-house | Managed |
|---|---|
| Attrition: trained analysts are in demand | Scope gaps: assets not onboarded are not watched |
| Night shifts and burnout | Log overages and tier jumps |
| Tool sprawl and integration time | Renewal uplift and lock-in to provider tools |
| Single points of failure | Response limited to what the contract allows |
See hidden costs and renewal traps.
How to run your own comparison
- Price the in-house option honestly: people for full rotation, tools, training, attrition.
- Get two or three managed quotes for the same scope.
- Add the internal owner's time to the managed option.
- Enter the one-time cost of switching and the yearly saving in the payback calculator.
- Add a value for risk: what one bad night would cost.
FAQ
Can one IT person do security monitoring?
In office hours, partly. One person cannot cover nights, leave and holidays, and is a single point of failure.
Is co-managed cheaper than fully managed?
Often a little, because the provider does less. It needs clear rules, or alerts fall between the two teams.
Should salary growth be in the calculation?
Yes. If in-house salaries rise faster than managed fees, the saving grows; the calculator's growth field handles that.
