During the day, it’s straightforward. Someone is at a screen, an alert comes in, and it’s reviewed and addressed. The real question is what happens at 11:40 PM on a Friday when an account suddenly logs in from an unknown location and starts encrypting files. Who steps in then?
For most SMEs, the answer is no one, unless you have delegated this to your IT provider.
To start with, someone actually has to receive the alert. A SIEM that sounds an alarm at 3:00 AM does nothing if the phone is on silent. You need a system that routes the right alerts to the person on duty and filters out the noise. Otherwise, you’ll be woken up every night for a false positive (an alert, but no actual threat), and after two weeks, no one will pick up anymore.
Then, that person must also be able to intervene. Blocking an account, taking a laptop off the network, stopping an attack while it’s still in progress—this requires security expertise and the right system permissions.
And one person cannot be on call every week. With a rotation of one week on duty and three weeks off, you need at least four people capable of this, plus coverage for holidays and illness. You also want to compensate your staff for being on call, which adds to the cost. Hours actually worked at night are subject to surcharges, and anyone who has handled an incident at 4:00 AM won't exactly be bright-eyed and bushy-tailed at work the next morning.
Do you want someone not just reachable, but actively monitoring outside office hours? Then it gets even more expensive. A year has 8,760 hours, and a full-time analyst is available for about 1,500 hours a year after accounting for vacation, illness, and training. To cover one position 24/7, you already need nearly 6 analysts. That is why an in-house SOC team for an SME in practice consists of 5 to 6 analysts, plus a team lead and a security engineer to maintain the tooling.
Here is a summary of the costs for an in-house SOC:
That is before your team has even found a single threat. You can read more about where these figures come from below.
In every budget, SOC personnel costs are at the top, and for good reason. A SOC analyst in the Netherlands earns an average of about 50,000 euros gross per year (Glassdoor, 2026). Entry-level positions are lower. A senior analyst in the Randstad region easily commands 60,000 euros or more, and for truly experienced specialists, such as forensic analysts or incident responders, you will quickly pay more.
Then there are employer costs: holiday pay, pension, and premiums. Roughly calculate 30 to 40 percent on top of the gross salary. An analyst will cost you about 65,000 to 70,000 euros per year. Six of them, plus a team lead and a security engineer, and you are looking at over 500,000 euros.
And then you still have to find these people. Security specialists are scarce in the job market, and the good ones have their pick of employers. This creates an additional challenge in keeping your own SOC running.
An analyst without tools is blind. At a minimum, you need:
For an SME environment, this quickly adds up to tens of thousands of euros per year. What is often forgotten is that licenses are the cheap part. A SIEM does nothing on its own. Someone has to write the detection rules, filter out the noise, and keep everything updated as your environment changes. That translates back into man-hours you have to pull from your team.
Attackers don't stand still, and neither should your team. Certifications, training, and the occasional conference are part of the job. You can decide for yourself what training budget to give your specialists. But two or more training sessions per year quickly leads to a budget of at least one to two thousand euros.
Time is the hidden cost. An analyst who is in training isn't monitoring your environment. Someone else has to cover that gap, and in a team of six, you feel that immediately.
Perhaps while reading this blog, you're thinking that an in-house SOC seems unattainable for anyone. That is, of course, not true, and our goal here is to provide insight into how much is involved in setting up your own SOC. Companies that have the capacity and budget, and receive cooperation from the organization, can very well set up their own SOC.
Often for SMEs, a managed SOC is a better solution. With a managed SOC, you are buying a service. The team, the tools, and the procedures are already in place. You connect your environment, and from that point on, analysts monitor it during and outside of office hours. Including weekends and holidays.
At Peakproteqt, you pay a fixed amount per month per workstation and server, excluding VAT:
Vulnerability insights, remediation, and dark web monitoring are included.
For example: a company with 50 employees, 50 workstations, and 5 servers pays 786.00 euros for the workstations, 786.00 euros for the employees, and 303.10 euros for the servers, totaling 1,875.10 euros per month. That is approximately 22,500 euros per year to monitor your entire business.
Compare that to the 400,000 to 700,000 euros per year for an in-house SOC. The difference is so significant that the rest of the comparison really only comes down to what you get in return.
And as you grow, our SOC grows with you. Adding ten workstations is just ten times 15.72 euros, with no need for new hires. With the price calculator on the website, you can quickly and easily calculate this for your own company.
The team is already in place. You don't need to post job openings, pay a recruiter, or create night shifts. Whether those analysts keep their certifications up to date and stay informed about new attack techniques is our problem, not yours.
The same applies if someone leaves or falls ill. Continuity is no longer your concern.
You don't need to purchase a SIEM, set up tooling, or build a team. There are no entry fees and no minimum commitments. One-time project costs may apply for connecting your environment, but that is very different from an upfront investment of two to five hundred thousand euros.
We aim to have you operational within 2 to 4 weeks. During those weeks, we inventory your environment, connect your systems (including Microsoft 365 and Azure), and establish what constitutes normal behavior. After that, we filter out the noise, and our analysts step in when there is a real threat.
An in-house SOC costs an SME between 200,000 and 500,000 euros to set up, 400,000 to 700,000 euros annually, and takes 6 to 12 months to build. A managed SOC is operational within 2 to 4 weeks, with no startup costs, for a fixed monthly fee per workstation and server.
The costs are high, but predictable. The risks are not.
Suppose you decide in January to build your own SOC. First, you have to recruit staff. If all goes well, you'll have a few analysts by Q1. Then you need to configure the SIEM, connect systems, write detection rules, and establish procedures. Before you reach a certain level of maturity, you're easily 6 months down the road.
All those months you are paying salaries and licenses while you don't have everything fully under control, and attackers won't wait for your team to be complete. With a managed SOC, you are about 90% faster to go live: after 2 to 4 weeks instead of 6 to 12 months.
SOC work isn't always enjoyable and can sometimes impose a certain level of pressure. Where it often goes wrong in practice is that SOC analysts have to process too many false positives. This can be exhausting and doesn't always yield results. This is also known as alert fatigue and can cause your employees to look for other work.
In an in-house SOC team of six people, you notice every departure immediately. The schedule falls apart, others have to work extra shifts, and knowledge is lost. Then the recruitment process starts all over again, along with the associated costs. It is therefore important that the human side of the SOC is also well safeguarded.
Ransomware is often deployed at night or on weekends. Attackers are well aware of the times when no one is watching. Those specific moments are the hardest to staff: Christmas, summer holidays. That is why a 24/7 SOC is not easy to set up, and many companies opt for on-call services. This way, you can ensure someone is alert outside office hours without burning out your staff.
Build it yourself
Suitable for large organizations (250+ employees) with a dedicated security budget, executive-level support, sufficient capacity to sustain a full team, and requirements that necessitate keeping everything in-house.
Outsourcing your SOC
Suitable for almost every other company. You get continuous monitoring, and external specialists can often intervene faster than internal teams, with no startup costs and no worries about recruitment or turnover. All this for a fixed monthly fee that scales with your organization. A managed SOC is therefore a logical choice for SMEs.
