The first security quote a company receives almost always comes with the same number: the price of the platform. And that number is almost always correct.
The problem is that it answers a question nobody asked.
Because the platform doesn’t monitor. The platform alerts. Someone has to be on the other end when it alerts, and that someone is the cost that never shows up on the first sheet.
Let’s do the math together
A year has 8,760 hours. That is not negotiable.
A full-time person works about 1,800 effective hours a year. Not 2,080. You have to subtract vacations, holidays, training, leave and the absences that always happen.
Divide:
8,760 ÷ 1,800 = 4.9 people
Almost five people. And look closely at what those five people buy: one occupied chair. Nothing more. One position covered permanently, with no backup in case someone resigns, no margin for two people to be on vacation at the same time, and no one more experienced to escalate a difficult case to.
With that settled, the realistic figure is six analysts plus a lead. Seven people so that the chair is always occupied by someone who is awake.
And those seven still don’t detect well
Here is the part that almost never gets budgeted.
Between the day the team is hired and the day the team detects accurately, it takes between 12 and 18 months. Not because the people are bad, but because fine-tuning detection requires knowing the specific network: what is normal here, what behavior is unusual in this company and not in another, which of the hundreds of daily alerts matter.
That year and a half is paid in full. And it protects little.
Add turnover. The security analyst is one of the most sought-after profiles on the market, and when one leaves, they don’t just take their position with them: they take the knowledge of the network that took a year to build. The clock resets to zero for that shift.
And this is not just our impression. The ISC2 annual workforce study has spent years documenting a global cybersecurity talent gap measured in millions of people. When demand outstrips supply like that, retaining a good analyst stops being a human resources matter and becomes an operational risk: the overnight shift is the first to be left uncovered, and it is precisely the one that can least afford to be.
The two models, side by side
| Item | In-house SOC | Managed SOC |
|---|---|---|
| Nature of the expense | Investment plus operating expense | Operating expense only |
| People needed | 7 on payroll | 0 on payroll |
| Time to operate well | 12 to 18 months | Weeks |
| Cost breakdown | 7 salaries, night premiums, licenses, training, space, infrastructure and turnover | A monthly fee, with scope defined by contract |
| If an analyst resigns | A shift is left uncovered | Provider’s problem |
| Control and customization | Total | Defined by contract |
Notice that the cost row doesn’t include a figure. That’s on purpose. A security analyst’s salary is not the same in Monterrey as in Caracas, and you know yours much better than we do. Take those seven positions, multiply by what your company pays, add licenses and training, and you’ll have your number. You’ll trust it more than any number we could give you. The breakdown of items is in the complete guide.
The difference that decides, and it isn’t the amount
There is a distinction that weighs more than any figure, and it is an accounting one.
An in-house SOC is capital investment plus operating expense. The room, the screens, the backup power, the servers and the initial licenses are capital investment. Salaries, subscriptions and storage are operating expense. They follow two different budget tracks.
A managed SOC is operating expense only. A monthly fee, a single line item.
And why does it matter so much? Because they are not approved the same way.
Capital investment almost always requires a committee, an annual budget cycle and a justification that competes with the plant expansion or the fleet renewal. If next year’s cycle has already closed, the project waits twelve months. Not for lack of will: because of the calendar.
Operating expense, on the other hand, is usually approved within an existing budget line and with the signature of the person who heads the area.
That explains something that confuses many people: the 12 to 18 months of the in-house model are not just team training. A good part of that time goes into getting approval, executing the purchase and setting up the space, before the first analyst sits down to look at a screen.
The eight items that make up the in-house cost
When someone says “an in-house SOC costs the salaries,” they are only getting halfway there. The complete list is this, and it’s worth having it in front of you before deciding:
- The seven salaries. Six analysts on shifts plus an experienced lead to escalate serious cases.
- Shift premiums. Night and holiday work carries legally mandated premiums in Mexico and in Venezuela. They are not negotiable, and they make precisely the shifts nobody wants more expensive.
- Licenses. Correlation platform, agents on endpoints, threat intelligence feeds. They are paid by volume or per device, so they grow as the company grows.
- Log storage. Storing events for as long as an audit requires costs money, and that cost rises every month because the logs keep accumulating.
- Ongoing training. It isn’t a course upon joining. Attack techniques change every quarter, and an analyst who isn’t kept up to date detects last year’s threats.
- Space and infrastructure. A room, screens, backup power and more than one internet link. A monitoring center that loses power or connectivity stops monitoring at the worst possible moment.
- Backup coverage. Vacations, sick leave and resignations. Someone has to cover those hours, and that someone also gets paid.
- Turnover. The cost of finding and hiring the replacement, plus the months during which the new person still doesn’t know the network.
Notice that items 2, 4, 6 and 7 almost never appear in a comparison. And they are precisely the ones that can’t be cut, because the first is the law, the second is required by audits, the third is physics and the fourth is life.
Now do it with your own numbers
You don’t need to request a quote to know where you stand. Take a sheet of paper and answer three things:
- How many people on your team can handle a security alert in the middle of the night? Not “receive the email.” Handle it: understand what is happening and decide what to do.
- Multiply by 1,800. That is the total number of hours your team can cover per year.
- Compare with 8,760.
If the first number is 1, your real coverage is 20%. If it is 2, 41%. If it is 3, 61%. Most of the companies in the region that we review are in the first case, and many believe they are in the third.
The difference between what you think you cover and what you actually cover is exactly the gap through which the problem gets in. And since ransomware almost always starts at night or on weekends, that gap is not theoretical.
When does an in-house SOC really make sense?
It does, and saying so matters, because otherwise this article would be a brochure.
The in-house model makes sense when security is part of what the company sells, when it handles information subject to restrictions that prevent delegating it, when it has more than a thousand employees and when it can sustain a specialized team over the long term. In that case, full control is worth what it costs.
Below that threshold the math doesn’t work, and forcing it usually ends in the worst of both worlds: a small, exhausted team covering business hours and presenting a monthly report that no one reads.
The middle ground, which is usually the best decision
There is a third path that almost no one brings up in the first meeting: start with a managed service while the internal team is trained.
You get full coverage from the first month, and if the company later decides to bring it in-house, it does so with proven processes and its people already trained. Instead of learning at the cost of real incidents.
It’s the same logic as moving forward in layers instead of redoing everything at once: it’s decided based on what is already working in operation, not on a presentation.
If you want to know where you stand today before budgeting any of the three paths, that can be measured. It’s the first thing we do in the free assessment, and you get a number, not an opinion.
The 8,760 hours in a year exist even if no one budgets for them. The only decision is who covers them.
