Cost Estimates, Worked Examples and Best-Fit Checklists
In-house SOC vs outsourced MDR or SOC-as-a-service: a cost comparison for Canadian SMEs
In-house 24/7 security monitoring versus outsourced MDR or SOC for Canadian SMEs: cost lines, a payback example and non-cost factors.
For most Canadian small and mid-sized businesses, an outsourced MDR or SOC service costs less than building equivalent 24/7 coverage in-house, because round-the-clock monitoring needs several people to fill every shift, cover holidays and absences, and keep skills current, plus tools and a log platform. In-house can make sense when you already have security staff, need deep knowledge of unusual systems, or have regulatory or client reasons to keep monitoring internal. The fair comparison is like for like: the same coverage hours, data sources, response authority and retention, counted over three to five years, including the one-time cost of switching.
This guide is part of how to choose a managed security provider. All salaries and prices are illustrative assumptions, not survey data.
Why 24/7 needs more than one person
A year has 8,760 hours. One full-time employee works roughly 1,800 to 1,900 productive hours after vacation, statutory holidays, sick days and training. Covering every hour with one analyst on shift therefore takes about 4.6 to 4.9 full-time equivalents, before anyone supervises them or a second analyst is needed for large incidents. Many SMEs instead use business-hours staff plus on-call arrangements, which is cheaper but slower at night and on weekends, and on-call rules depend on provincial employment standards.
Cost lines for an in-house option
| Line | Illustrative assumption (CAD per year) |
|---|---|
| Security analysts, salary and benefits | 5 × $110,000 = $550,000 |
| Team lead (part of role) | 0.5 × $150,000 = $75,000 |
| SIEM and EDR platform licences | $60,000 |
| Log storage and infrastructure | $20,000 |
| Training and certifications | $15,000 |
| Recruitment and turnover cost (averaged) | $25,000 |
| Total | $745,000 |
A business-hours alternative with one analyst plus an outside on-call service might cost an illustrative $110,000 + $60,000 + $20,000 + $5,000 + $30,000 on-call = $225,000, with weaker night coverage.
Cost lines for an outsourced option
| Line | Illustrative assumption (CAD per year) |
|---|---|
| MDR for 150 endpoints | 150 × $25 × 12 = $45,000 |
| SOC monitoring, 15 GB/day | 15 × $220 × 12 = $39,600 |
| IR retainer, 20 hours | 20 × $300 = $6,000 |
| Internal staff time to manage the provider (0.3 FTE IT) | 0.3 × $100,000 = $30,000 |
| Total | $120,600 |
Even the business-hours in-house option ($225,000) costs more than the outsourced 24/7 option ($120,600) under these assumptions, and the gap to full in-house 24/7 coverage is large.
Worked payback example
A 150-person Halifax logistics company already employs one security analyst and is considering moving monitoring to an outsourced provider while keeping the analyst to manage it and work on projects.
- Current annual cost of the in-house monitoring set-up beyond the analyst's salary: platform licences $60,000 + storage $20,000 + on-call service $30,000 = $110,000.
- Outsourced MDR and SOC: $45,000 + $39,600 = $84,600 (IR retainer kept as before).
- Net yearly saving: $110,000 − $84,600 = $25,400, with 24/7 coverage instead of on-call.
- One-time transition: onboarding $10,000, three months of overlap with the old platform $15,000 → $25,000.
In the outsourced SOC payback calculator, enter cost $25,000, saving $25,400, growth 3%, horizon 3 years. Payback ≈ $25,000 ÷ $25,400 ≈ 0.98 years. Three-year saving: $25,400 + $26,162 + $26,946.86 − $25,000 = $53,508.86 (about $53,500).
If the outsourced service had cost more than the current set-up, payback would never be reached; the decision would then rest on the value of 24/7 response and reduced risk, not on savings.
Non-cost factors that should weigh heavily
| Factor | In-house | Outsourced |
|---|---|---|
| Knowledge of your business | Deep | Must be built and documented |
| Night and weekend coverage | Costly to staff | Usually included in MDR or SOC |
| Visibility across many clients' attacks | Limited | Broader threat view |
| Control over data location | Full | Depends on provider; see SOC data residency |
| Key-person risk | High in small teams | Shifts to provider continuity |
| Exit difficulty | Low | Depends on contract; see exit and offboarding |
| Evidence for insurers and clients | You produce it | Provider reports, if contract requires |
A hybrid is common: outsourced 24/7 monitoring and first response, with an internal person or a vCISO owning risk decisions and supplier oversight.
Checklist before deciding
- Define equal scope for both options: hours, sources, response authority, retention.
- Count all in-house costs, including recruitment and turnover.
- Add internal time to manage an outsourced provider.
- Include one-time transition and overlap costs.
- Compare over at least three years with growth and renewal increases; see renewal uplifts.
- Check client and insurer requirements.
- Use the worked cost examples for the outsourced side.
Frequently asked questions
At what size does an in-house SOC make sense?
There is no fixed threshold. It depends on risk, regulation and whether you can recruit and retain staff. Many mid-sized organisations keep a small internal team and outsource 24/7 monitoring.
Can we start outsourced and bring it in later?
Yes, if the contract lets you keep your logs, configurations and detection content. Negotiate this up front.
Are there government grants for this?
Funding programs change often. Check the Government of Canada's business benefits finder and provincial programs, and enter only funding actually approved in the calculator.
Does outsourcing transfer legal responsibility?
No. Your business stays responsible for protecting the personal information it controls and for breach reporting.
Sources
- Canadian Centre for Cyber Security — guidance on security operations and managed services
- Office of the Privacy Commissioner of Canada — accountability when using service providers
- Government of Canada business benefits finder — current funding programs
