Register of Vendor Pricing · Compiled by Digital Signet · Revised 20 June 2026
Annex VI · TCO

In-house SOC cost for 2026.

The fully-loaded annual cost of standing up a 24x7 in-house SOC, anchored to BLS May 2024 OEWS data for SOC code 15-1212 (information security analysts) at $ 124,910 median annual wage.

Direct answer

A 5-FTE 24x7 in-house SOC in 2026 costs roughly $ 875,000 to $ 1,250,000 per year in fully-loaded staff cost, plus $ 200,000 to $ 600,000 in tools (SIEM, SOAR, EDR, TIP). Below 2,500 endpoints, outsourced MDR wins; above 10,000 endpoints, co-managed or in-house usually wins.

Staff cost ledger (BLS May 2024 anchor)

5 FTE analysts (median wage)BLS 15-1212 median $ 124,910 / yr$ 624,550[R]
Benefits and overhead (40% loading)employer FICA, benefits, training, equipment$ 249,820[R]
SOC manager / shift leadBLS 15-1212 90th-percentile $ 188,060$ 188,060[R]
Subtotal staffannual$ 1,062,430[R]

Tools stack ledger

SIEM (mid-market commercial)Splunk / Sentinel / Chronicle$ 80,000 to $ 250,000 / yr[I]
SOAR (Tines / Torq / Splunk SOAR)annual$ 30,000 to $ 90,000 / yr[I]
EDR (per endpoint, 500 endpoints)CrowdStrike Falcon Pro / S1 Singularity Complete$ 30,000 to $ 60,000 / yr[I]
Threat intel platformannual$ 40,000 to $ 120,000 / yr[I]
Subtotal toolsannual midpoint$ 425,000[I]

Worked example: 500-endpoint mid-market vs outsourced MDR

The RFP normaliser shown on the homepage, evaluated for the worked-example inputs:

Endpoints500[V]
Coverage tiertier-1-2-3[V]
Compliance overlayhipaa[V]
Total / year (outsourced MDR)$ 184,580[V]
In-house equivalentstaff + tools subtotal$ 1,487,430[R]

Verdict: at 500 endpoints with a HIPAA overlay, outsourced MDR costs roughly $ 184,580 / yr against $ 1.49M for in-house. Outsourced wins by an order of magnitude. The breakeven moves north as endpoint count rises.

BLS May 2024 OEWS data released April 2025; next refresh expected April 2026. Tool prices verified against vendor pricing pages 19 June 2026.

Annex cross-references

AnnexIn-house vs SOCaaSThe decision-aid version of this TCO model.AnnexCo-managedThe hybrid model that splits the staff cost.AnnexAI-SOCThe 2026 disruption layer to the Tier-1 analyst cost.