Prices, cost drivers and 2026 rules
MDR and SOC-as-a-service pricing: per endpoint, per user and per GB of logs
How managed detection and response and SOC-as-a-service are priced in Australia, what log-volume tiers mean, and an illustrative costing for a 60-endpoint business.
MDR (managed detection and response) is usually priced per endpoint or per user each month and covers round-the-clock monitoring of your endpoint security alerts with the provider taking action to contain threats. SOC-as-a-service or managed SIEM is usually priced by the volume of log data you send (per GB ingested, or a tier based on GB per day or events per second) plus a platform or analyst fee. MDR answers "is a device or account being attacked right now?"; a SOC with a SIEM answers the wider question across firewalls, servers, cloud and applications. For many small businesses, MDR is the first step and log-based SOC monitoring comes later or for specific systems.
This guide sits under the pricing overview. For managed endpoint without 24/7 monitoring, see endpoint, email and firewall pricing. All figures are illustrative, ex GST.
What MDR usually includes, and what it may not
| Component | Usually included | Often extra or limited |
|---|---|---|
| Endpoint detection and response agent | Yes, or managed on your existing licence | Licence cost if you do not already own it |
| 24/7 alert triage by analysts | Yes, that is the point of MDR | Some "MDR" is automated overnight with humans in business hours |
| Containment (isolate device, kill process) | Usually, within agreed rules | May need your approval first, which adds delay |
| Identity alerts (Microsoft 365 / Entra ID sign-ins) | Increasingly bundled | Often an add-on per user |
| Threat hunting | Sometimes, as periodic hunts | Ad hoc hunts billed hourly |
| Full incident response and forensics | Rarely | Billed hourly or through a retainer |
| Monthly reporting | Yes | Board-ready reports or compliance mapping may be extra |
Read the definition of "response". Some contracts promise a response within 30 minutes but define response as acknowledging the alert, not containing the threat. See SLA and contract questions.
How SOC-as-a-service and managed SIEM are priced
A SIEM (security information and event management platform) collects logs from many systems. A SOC (security operations centre) is the team that watches it. Pricing models include:
- Per GB ingested. You pay for each gigabyte of log data the platform receives. Simple, but costs move with every new log source.
- Tiers by GB per day. A fixed monthly price up to a daily average, then a step to the next tier. Predictable until you cross a boundary.
- Per log source or per device. A price per firewall, server or application connected. Easy to budget; check whether "chatty" sources cost more.
- Events per second (EPS). Common in older SIEM pricing; harder for buyers to estimate.
- Platform plus analyst fee. You license the SIEM yourself (for example in your cloud subscription) and the provider charges for the people.
Retention also matters. Keeping searchable logs for 12 months instead of 90 days increases storage, and some customers, insurers or regulators expect longer retention.
Illustrative costing: 60 endpoints, 6 servers, Microsoft 365, two firewalls
| Line | Calculation | Monthly | Annual |
|---|---|---|---|
| MDR on workstations | 60 × $22 | $1,320 | $15,840 |
| MDR on servers | 6 × $55 | $330 | $3,960 |
| Identity monitoring | 55 users × $5 | $275 | $3,300 |
| Managed SIEM log ingest | 15 GB a day × 30 days × $10 per GB | $4,500 | $54,000 |
| Total | $6,425 | $77,100 |
The log line is the largest. If the business adds detailed firewall and application logs and the average rises to 28 GB a day, the ingest line becomes 28 × 30 × $10 = $8,400 a month, and the annual total rises from $77,100 to $123,900, a 60.7% increase, with no change to the endpoint count.
That is why log pricing needs a plan:
- Decide what to send. Not every log is security-relevant. Ask the provider which sources give the most detection value per GB.
- Filter at source where the platform allows it, and ask whether filtered data is billed.
- Ask about tiers and overage. What happens if one month spikes, for example during an incident? Is overage billed at the same rate or a penalty rate?
- Check retention costs separately from ingest.
MDR only, SOC only, or both?
| Situation | Common fit | Why |
|---|---|---|
| Up to about 50 staff, mostly cloud (Microsoft 365, SaaS), few servers | MDR with identity monitoring | Covers the most common attack paths (phishing, account takeover, ransomware on endpoints) at a per-user price |
| Several servers, on-premises applications, firewalls at multiple sites | MDR plus selected log sources | Adds visibility over network and server activity |
| Customer, insurer or contract requires central logging and retention | Managed SIEM / SOC | Logging and retention requirements drive the choice |
| Internal IT team that can respond during business hours | Co-managed SOC | Provider watches 24/7 and escalates; your team does the fixing |
This is a starting point, not a rule. The selection method shows how to weigh it for your business.
Questions that expose the real price
- Is the endpoint security licence included, or do I need to buy it?
- What exactly happens between midnight and 6 am: who is on shift, and in which country?
- Can you contain a threat without phoning me first? Under what rules?
- What is included in "response", and what is billed hourly?
- What is the per-GB or per-tier price, and what are the overage rules?
- How long are logs kept, and what does longer retention cost?
- Where are logs stored and processed? This matters for the Privacy Act if they contain personal information.
Frequently asked questions
Is MDR the same as antivirus?
No. Antivirus or endpoint protection blocks known threats on the device. MDR adds people who watch the alerts around the clock and act on suspicious behaviour that software alone may not stop.
Why is SIEM so expensive compared with MDR?
Because it handles far more data from many sources and needs more analyst time to tune and investigate. The cost is driven by log volume, so controlling what you send is the main lever.
Should I sign a multi-year MDR contract?
Only if the renewal price rules, scope changes and exit terms are clear. A lower monthly rate can be outweighed by being locked in to a service that does not fit after your business changes. Model it with the uplift calculator.
Do providers price per user or per endpoint?
Both are common. Per user is simpler when each person has two or three devices; per endpoint is fairer when many people share devices. Convert both to an annual figure for your own counts before comparing.
Sources
- ASD's Australian Cyber Security Centre — guidance on event logging, detection and the Essential Eight
- Office of the Australian Information Commissioner — obligations when logs contain personal information
- business.gov.au — cyber security support for small businesses
