A managed SOC gives UK companies 24/7 detection and response without hiring a full internal security team. This guide covers the difference between MDR and SOC-as-a-service, what SLAs actually mean, and what a fair UK price looks like.
MDR vs SOC-as-a-service
MDR (Managed Detection and Response) is opinionated — the provider brings their own EDR/XDR stack, runs it, and responds to alerts on your behalf. SOC-as-a-service typically plugs into your existing tools (Microsoft Defender, Sentinel, CrowdStrike) and adds the human tier. Both work; the right choice depends on how much of your stack you already own.
SLA metrics that actually matter
Time-to-detect (TTD), time-to-triage (TTT) and time-to-contain (TTC). Ask for the last quarter's median and 95th percentile, not averages. Anything above 15 minutes to first analyst eyes on a P1 alert is behind the market in 2026.
Typical UK pricing
£15-£45 per endpoint per month depending on stack complexity and coverage model. Log ingest surcharges from Sentinel, Splunk or Datadog are often the biggest hidden cost — get a monthly cap in writing.
Frequently asked questions
How is a managed SOC different from a SIEM?
A SIEM is the tool that collects and correlates logs. A SOC is the humans who investigate and respond to what the SIEM surfaces. You can have one without the other; combined they form the core of detection and response.
Can a managed SOC actually contain incidents, not just alert?
Yes — with agreed containment authority. Modern MDR includes host isolation, credential revocation, and email quarantine as pre-authorised actions on defined alert types. Without that authority you're paying for expensive notifications.
Get a UK managed SOC quote
Talk to the GoaTech team. We'll map your current position and show what a tailored UK-focused programme looks like.