A managed SOC in India costs ₹15 lakh to ₹1.5 crore per year depending on endpoint count, log volume, response authority, and compliance format. An in-house SOC with equivalent 24x7 coverage costs 3-5x more when you account for the people, tooling, facility and attrition you will actually face. This guide breaks down both models so you can budget accurately.
In-house SOC cost breakdown
| Cost Component | Annual Cost (₹) | Notes |
|---|---|---|
| SIEM licence (Splunk / Elastic / Sentinel) | ₹20 L – ₹80 L | Scales with daily ingest volume (GB/day) |
| SOC analysts (6-8 for 24x7 coverage) | ₹48 L – ₹96 L | ₹6-12 LPA per analyst × 8 for shift coverage |
| SOC lead / manager | ₹15 L – ₹25 L | One senior hire to run the operation |
| Threat intel feeds | ₹5 L – ₹15 L | Commercial feeds beyond open-source |
| SOAR / automation tooling | ₹10 L – ₹30 L | Palo Alto XSOAR, Splunk SOAR, or open-source |
| Infrastructure (servers, storage, network) | ₹10 L – ₹20 L | On-prem or cloud compute for SIEM |
| Training and certification | ₹5 L – ₹10 L | Analyst upskilling, annual recertification |
| Facility and physical security | ₹5 L – ₹15 L | Dedicated SOC room if required by regulator |
| Attrition replacement cost | ₹10 L – ₹20 L | 2-3 replacements/year × 3-4 months productivity loss |
| **Total** | **₹1.28 Cr – ₹3.11 Cr** | For a mid-size enterprise (500-2000 endpoints) |
Managed SOC pricing models
Managed SOC vendors in India use three pricing models. Each has trade-offs:
| Model | Typical Range | Pros | Cons |
|---|---|---|---|
| Per-endpoint / per-seat | ₹800 – ₹2,500/endpoint/month | Predictable, scales with headcount | Penalises growth; log-heavy servers cost the same as idle laptops |
| Per-EPS (events per second) | ₹3 – ₹8/EPS/month | Scales with actual telemetry volume | Hard to predict; noisy sources inflate cost unpredictably |
| Flat monthly fee (tiered) | ₹1.25 L – ₹12 L/month | Budget certainty, negotiable scope | May include volume caps that trigger overage charges |
What to negotiate in a managed SOC contract
- **Detection engineering included** — the vendor should write and tune detection rules for your environment, not just deploy out-of-box rules. Ask how many custom rules are included per quarter.
- **Response authority** — define whether the SOC can isolate endpoints, block IPs, or disable accounts without calling you first. Faster response needs pre-authorised playbooks.
- **SLA definitions** — MTTD (mean time to detect), MTTA (mean time to acknowledge), and MTTR (mean time to respond) must be defined precisely. Ask what pauses the clock.
- **Data residency** — for RBI/SEBI-regulated entities, log data may need to stay in India. Confirm the SOC's data centre locations.
- **Exit terms** — define data return, transition support, and minimum notice period. A 12-month lock-in with 6-month notice is predatory.
- **Compliance reporting** — if you need RBI CSF or SEBI CSCRF evidence from the SOC, that reporting format must be in the contract, not a future discussion.
When to build vs buy
Build in-house when: you have 5,000+ endpoints, regulatory requirements demand full data sovereignty, you can recruit and retain a team of 8+ analysts in your city, and your CISO has SOC operations experience. Buy managed SOC when: you have under 5,000 endpoints, analyst attrition is a problem, you need 24x7 coverage faster than a 6-month build-out, or your compliance deadline is closer than your hiring pipeline.
For a deeper evaluation of managed SOC vendors, see our top managed SOC providers in India buyer scorecard. For detection engineering and SOC operations content, browse our managed SOC and detection guides.
Tell us your endpoint count, log sources, compliance requirements, and response expectations. We will give you a fixed monthly quote with no EPS surprises.