Compare two MSSP quotes, an in-house SOC, and a hybrid model across a shared monitoring scope, minimum staffing, usage overage, and normalized three- or five-year total cost.
Apply the same log, asset, ticket, and coverage boundary to all four alternatives.
Defaults are fictional interface examples reviewed on August 18, 2026. They are not market prices, recommended staffing, or detection-performance claims.
Lowest three-year present value
MSSP quote A
$260,685
Lowest five-year present value
MSSP quote A
$430,739
Minimum round-the-clock staff
5 FTE
5 / 2 FTE
Annual analyst workload
1,960 h
1,800 + 160 h
Normalized TCO fills any staffing shortfall at the entered FTE rate. An MSSP option with fewer service hours than required remains visible but is excluded from the ranking.
| Option | Coverage | Entered / minimum FTE | Entered 3-year TCO | Normalized 3-year PV | Normalized 5-year PV | Five-year average month |
|---|---|---|---|---|---|---|
| MSSP quote A | 168 h/w | 1 / 0 | $1,037,724 | $941,969 | $1,523,345 | $29,385 |
| MSSP quote B | 168 h/w | 1 / 0 | $1,325,596 | $1,202,654 | $1,954,084 | $37,710 |
| In-house SOC | 168 h/w | 5 / 5 | $3,024,440 | $2,758,612 | $4,414,444 | $84,828 |
| Hybrid | 168 h/w | 3 / 1 | $1,723,668 | $1,563,856 | $2,539,709 | $49,010 |
1037724.3
1325596.1600000001
3024440
1723667.74
With every other input fixed, this is the first daily log volume where normalized present values are equal. No crossover means the entered rate structure does not reverse within the supported search range.
This is a cost-comparison tool. It does not determine or guarantee detection rate, response quality, regulatory compliance, or vendor eligibility.
A managed security quote can look simple when it is reduced to a monthly fee, yet the invoice may also depend on log ingestion, monitored assets, investigation tickets, incident-response hours, onboarding, and contract exit work. An internal SOC budget has the opposite problem: salary is visible, while shift premiums, training, vacancies, SIEM and SOAR licensing, threat intelligence, implementation, and retransition are easy to omit. This calculator puts MSSP quote A, MSSP quote B, an in-house SOC, and a hybrid model on one workload boundary and compares both nominal and present-value TCO over three and five years.
The output is a decision aid, not an automated sourcing recommendation. Its most useful result is often a scope discrepancy: a short service window, an overage band that starts earlier than expected, or an internal staffing plan that cannot cover the entered schedule. Use those discrepancies to produce a sharper RFP and an auditable operating plan.
One provider may include continuous monitoring and first-level triage, while another provides business-hours analysis with an incident-response allowance. Those prices are not comparable until the same log sources, retention boundary, asset definition, ticket classification, notification window, and escalation responsibility are applied. The in-house option must use that same boundary. Customer duties such as approval, cloud changes, privacy decisions, business coordination, and on-site evidence collection also remain costs even when most monitoring is outsourced.
Annual coverage demand equals hours per day multiplied by days per week, 52 weeks, and concurrent analysts per shift. The calculator divides that demand by productive coverage hours per FTE and rounds up. Productive hours should exclude leave, training, meetings, and expected vacancy time. For example, one continuously occupied seat with 1,840 productive hours per FTE produces an arithmetic minimum of five FTE.
Annual ticket effort equals monthly tickets multiplied by twelve and analyst minutes per ticket. Critical-incident effort is added separately. The total is divided by productive analysis hours per FTE and rounded up. The internal SOC minimum is the larger of the coverage and workload floors. An MSSP or hybrid option applies the workload test only to the share retained by the customer.
The entered-plan TCO preserves the staffing number supplied by the user. The normalized TCO fills a shortfall at the same entered annual cost per FTE. Rankings use normalized present value so an under-staffed plan does not win simply because a required seat was omitted. A provider whose weekly service window is shorter than the required window remains in the table but is excluded from the ranking because a price adjustment cannot invent missing service coverage.
| Category | Include | Preferred evidence |
|---|---|---|
| Labor | Salary, incentives, employer burden, benefits, recruiting, shift premium, and training | HR ledger, roster, vacancy history, and actual contractor backfill invoices |
| SIEM | Base license, ingestion, indexing, retention, parsing, transfer, and overage | Twelve months of invoices, daily ingestion statistics, retention policy, and discount expiry |
| SOAR and other tools | Automation, EDR integration, case management, ticketing, threat intelligence, and support | License agreements, active users, integration backlog, and support statements |
| Transition | Design, implementation, migration, parallel operation, decommissioning, and retransition | Project plan, integrator quote, cloud transfer estimate, and disposal plan |
Use fully loaded annual cost rather than cash salary alone. Keep the vacancy and backfill allowance separate because an unfilled position may create contractor cost, overtime, delayed engineering, or an accepted coverage gap. The calculator treats SIEM overage as a monthly rate per additional daily GB, so reconcile that unit to the actual platform contract before relying on the result.
Nominal TCO adds setup cost at the start, recurring labor, service, tool, usage, and incident-response costs during each year, and exit cost at the end. Each recurring category grows at the option-specific escalation rate. Present-value TCO discounts each year-end recurring amount and the final exit amount using the shared discount rate, while setup remains a time-zero cost. Comparing alternatives over the same period and economic assumptions keeps a three-year contract structure from being mistaken for a five-year economic advantage.
Preserves the staff number and cost plan exactly as entered, making the budget draft traceable.
Adds a staffing shortfall at the entered unit cost and supplies the present value used for ranking.
Shows how much present-value room separates the two lowest comparable options, not a guaranteed saving.
The crossover is the first daily log volume at which one provider option and the in-house SOC have equal normalized five-year present value while every other input remains fixed. It exposes how quickly included bands and overage rates can change long-run cost. A current volume below the crossover does not prove that outsourcing is appropriate, and a volume above it does not prove that internal operation is appropriate. The point is useful for negotiating growth bands, caps, tier resets, and retention architecture.
No crossover means that the two cost curves do not meet in the supported search range under the entered rate structure. It does not mean that quality, risk, scope, or regulatory obligations are equivalent. Re-run the model with a low, expected, and high log forecast, particularly when cloud, EDR, identity, or OT sources will be added during the contract.
Used to frame incident response as part of cybersecurity risk management and continuous improvement. It does not publish MSSP rates or staffing ratios.
Used to support organization-wide log planning questions. Actual ingestion, retention, and processing cost must come from your environment and contracts.
Used for the discipline of comparing alternatives over a common study period and economic assumptions. This adaptation does not establish procurement compliance.
Relevant to certain Korean public-sector outsourcing contexts. The calculator does not determine applicability, legal compliance, or provider eligibility.
Sources were checked on August 18, 2026. Laws, designation requirements, standards, services, and contract terms can change. Recheck the original material on the date an RFP or approval package is issued.
Not automatically. Service ownership, supplier governance, approvals, business communication, data governance, and critical-incident decisions commonly remain with the customer. Map responsibilities first and enter the staff that those duties require.
No. It is an arithmetic floor from the entered hours and productivity. It does not automatically add managers, engineers, hunters, forensic specialists, breaks, or skill redundancy. Validate a real roster and role plan separately.
No. The rank only reconciles minimum hours and staffing gaps. It does not score detection coverage, SLA measurement, data sovereignty, lock-in, regulatory fit, or demonstrated response quality. Use a separate non-price scorecard.
No. They are fictional values used to demonstrate the interface. Actual rates depend on sources, retention, coverage, asset classes, ticket definitions, incident-response scope, geography, currency, and negotiation. Replace every cost with written quotes or ledger evidence.
No. Check applicable law, procurement rules, the relevant designation program, and organization-specific security requirements. This cost model is not an eligibility assessment or legal opinion.
Replace the shared demand assumptions with real ingestion and ticket evidence, copy each provider band and overage rate from the contract response, and build the internal option from attainable staffing and actual tool invoices. Then review the gap between entered and normalized plans. The strongest next step is to copy the RFP checklist from the result and require both suppliers and internal owners to sign off on one responsibility and billing boundary.