Transparent pricing
What 24/7 SOC and MDR cover costs
Three tiers, priced per endpoint per month: £6 for monitored-and-escalated, £15 for monitored-and-responded, £24 for the full resilience service. Almost no UK provider publishes MDR pricing; we think you should be able to budget before you ever speak to us.
SOC Monitor
£6 /endpoint/month
£1,500 monthly minimum
24/7 monitoring and Level 1 alert triage across agreed EDR, Microsoft 365 and Entra telemetry, with validated alerts escalated to your team.
- 24/7 monitoring by UK analysts
- Level 1 triage of every alert
- EDR, Microsoft 365 and Entra ID telemetry
- Validated alerts escalated to your team for investigation and response
- Monthly service reporting
MDR Respond
£15 /endpoint/month
£2,500 monthly minimum
Everything in SOC Monitor, plus Level 2 investigation and response actions taken on your behalf.
- Everything in SOC Monitor
- Selected Level 2 investigation and response actions
- Endpoint and identity containment
- EDR policy management
- Email and cloud monitoring
- Monthly threat hunting
- Quarterly service reviews
MDR Resilience
£24 /endpoint/month
£5,000 monthly minimum
Enhanced MDR coverage across endpoint, identity, cloud, network and SaaS telemetry, with the proactive depth larger or regulated estates need.
- Everything in MDR Respond
- Coverage across endpoint, identity, cloud, network and SaaS telemetry
- Custom detection engineering
- Weekly threat hunting
- Named service management
- Board and compliance reporting
- Annual incident response tabletop exercise
Key assumptions
- Prices are per endpoint per month and exclude VAT
- EDR, XDR and SIEM licences are owned by you, so your tooling and data stay yours
- Onboarding, migrations and bespoke integrations are usually included in the price, not charged as a separate project
- Flexible 1 to 3 year contracts with a straightforward exit clause, because a service should be kept on results, not lock-in
The maths, in the open
How the per-endpoint pricing works
Count the endpoints the SOC will watch: laptops, desktops, servers and virtual machines. Multiply by the tier rate, and that is your monthly figure, subject to the tier's minimum. No bands to fall off the edge of, and growth is priced before you hire the people who cause it.
What should make you suspicious elsewhere: quote-only pricing, per-incident response fees, and onboarding charges that only appear after the demo. Onboarding here is part of the service, not a project sold on top.
Worked example
A 150-person business
- Around 170 endpoints across laptops and servers
- Microsoft 365 identities and email as core data sources
- Existing Defender licensing reused as the sensor layer
Typical fit: MDR Respond at 170 endpoints × £15 = £2,550 per month, full 24/7 detection and response included. The equivalent in-house rota does not exist at this size.
Choosing a tier
What separates the tiers
Endpoints
The per-endpoint rate does the scaling: count your laptops, servers and virtual machines and the monthly figure follows, subject to the tier minimum.
Telemetry breadth
SOC Monitor watches EDR, Microsoft 365 and Entra. The higher tiers add email, cloud platforms, and at Resilience level network and SaaS telemetry.
Response authority
SOC Monitor escalates validated alerts to your team; MDR tiers contain threats on your behalf. Escalation-only costs less, but it also does less at 3am.
Proactive depth
Threat hunting monthly or weekly, custom detection engineering, tabletop exercises and board reporting arrive as you move up the tiers.
Client results
What our clients say
"The University was able to secure a multi-million pound cyber security investment as a result of the cyber roadmap work we did."
Danielle Cairns Cyber Risk & Assurance Manager, University of Glasgow "Within 7 months Pactio achieved both ISO and SOC2 compliance, as well as reduced overall cyber risk."
Sophie Fallen Operations Lead, Pactio "Their new ISO 27001 and Cyber Essentials Plus certifications won them more public sector work."
Tom Bennett CTO, FreshWave "A reduced attack surface through consolidation of IT and compliance with GDPR and Cyber Essentials."
Chris Bayley CTO, Audley Travel "PureMalt were able to weigh up different strategic options and make an appropriate investment in cyber security."
Ross Turner Managing Director, PureMalt "Ozone utilised their new capabilities to market to larger clients, whilst expanding into new markets."
Scott Switzer CTO, The Ozone Project The alternative
Compare it with building a SOC
| Cost | In-house 24/7 SOC | 24/7 SOC |
|---|---|---|
| People | A rota of trained analysts to cover every night, weekend and holiday, plus management | Included in the monthly fee |
| Tooling | SIEM licensing, ingestion costs, detection content and the engineering to keep it tuned | Included, built on sensors and licences you already own |
| Time to coverage | A build measured in months before anyone is genuinely watching | Watching within weeks of onboarding |
| Monthly cost | Salaries and licensing regardless of what happens | £6 to £24 per endpoint, minimums from £1,500, published in full |
The NCSC's guidance on building a SOC sets out what the in-house route really involves. The fuller comparison, including when building genuinely is the right call, is on our MDR vs SOC page.
Get your number
Get an exact price for your estate
A 45 minute discovery call is enough for us to count your endpoints and sources and give you a firm monthly price.