How Much Does Managed SOC Cost in India, and What Factors Affect Pricing?
Two quotes reach the CISO's desk in the same week. One offers 24/7 security monitoring for a 500 person company at about ₹1.5 lakh a month. The other asks for several times that, for what its brochure also calls 24/7 security monitoring. Neither vendor is lying. They are pricing different things under one label, and the label is the real problem.
That is why managed SOC cost in India is so hard to pin down. The service can mean a team that forwards alerts by email, or a team that investigates, isolates a compromised laptop at 3 a.m. and hands you a report ready for CERT-In. Both get sold as a managed SOC. The price gap between them is the whole story.
What Factors Affect Managed SOC Pricing in India?
Provider published guides in 2026 put managed SOC pricing in India at roughly ₹25,000 a month for a small business and above ₹20 lakh a month for a large enterprise. For a 500 plus user organisation, full 24/7 coverage is typically quoted between ₹1.5 lakh and ₹5 lakh a month. Per user rates run from ₹200 for basic alert triage to ₹2,000 for managed detection and response with incident response. The same providers estimate an equivalent internal 24/7 SOC at ₹1.5 crore to more than ₹2 crore a year.
Two cautions come with those figures. They are provider claims, not audited averages; we did not find a public India price benchmark from the major analyst firms, so read them as market signals. And the rupee amount matters less than three things it does not show: who is allowed to contain an attack, where your logs sit, and what gets billed on top of the base fee. The rest of this article deals with those three.
Why the budget question is urgent in 2026
IBM's 2026 Cost of a Data Breach Report, released for India on 3 August, puts the average breach at ₹25.5 crore, up 15.9% from ₹22 crore a year earlier. The average incident exposed 39,500 records. Financial services carried the heaviest bill at ₹40.9 crore, followed by technology at ₹35.7 crore and communications at ₹34.5 crore. Phishing remained the most common way in at 19%, ahead of drive by compromise at 16% and supply chain compromise at 15%.
The detection angle is what matters for a SOC buyer. Press coverage of the same report says Indian organisations without AI and automation in security operations averaged ₹31.6 crore per breach, about ₹6 crore above the national average. Globally, IBM found the average cost reached USD 4.99 million, that roughly one in four malicious breaches was AI enabled, and that extensive use of AI and automation saved about USD 1.93 million per breach. Time matters in the data as well: breaches that lasted more than 200 days averaged USD 5.65 million, against USD 4.32 million for those contained sooner.
Volume is the other pressure. CERT-In handled over 29.44 lakh incidents in 2025, according to a January 2026 government review. A parliamentary reply reported by Outlook Money counted 6,04,588 incidents in banking and healthcare during 2025 and another 3,67,462 between January and June 2026. Much of that is scanning and probing, which is noise on any individual network. But noise is exactly what a SOC exists to sort, and sorting it at scale is why headcount, or automation, drives price.
Then there is the market. Markets and Markets forecasts global managed detection and response revenue growing from USD 6.28 billion in 2026 to USD 19.01 billion by 2031, a compound annual rate of 24.8%. Fortune Business Insights puts the 2026 figure at USD 2.81 billion. The gap is too wide to be a rounding difference. The two firms are most likely counting different things, for example a definition that bundles MDR platforms with services against a narrower services view, though neither summary we reviewed spells out the reconciliation. Both agree on the direction: demand is growing fast.
What does a managed SOC cost in India?
How the market prices it
Providers quote in five main shapes. These are indicative figures published by Indian and India serving vendors, and each guide uses its own assumptions.
Per user per month: ₹200 to ₹800 for basic monitoring and alert triage, and ₹800 to ₹2,000 for comprehensive MDR with incident response (Ogma). A second guide gives ₹300 to ₹1,500 per user (NetNXT).
Per device per month: ₹800 to ₹2,500 for network devices such as firewalls and switches, ₹300 to ₹800 per endpoint with EDR, ₹1,500 to ₹4,000 per server and ₹2,000 to ₹5,000 per cloud workload (Ogma). AB7 Solutions quotes USD 4 to USD 12 per endpoint for managed EDR triage.
Per asset per month: ₹800 to ₹1,700, which NetNXT notes is in line with the global benchmark of USD 10 to USD 20. A published list from PJ Networks shows MDR vendors at USD 10 to USD 30 per asset.
Dedicated capacity: AB7 prices one dedicated analyst from USD 1,500 a month and a team with L1 and L2 analysts, a threat hunter and a SOC lead from USD 4,500 a month.
Whole service by company size: from about ₹25,000 a month for a small business to over ₹20 lakh a month for a large enterprise (BM Infotrade), and ₹40,000 to ₹1 lakh a month for a 50 to 100 person company (NetNXT).
Why the published numbers do not agree
Put the figures side by side and they do not reconcile. ₹1.5 lakh to ₹5 lakh for 500 users works out to ₹300 to ₹1,000 per user, which sits in the lower half of the per user guides. Apply the per asset rate of ₹800 to ₹1,700 to an estate of 650 assets and you get ₹5.2 lakh or more. NetNXT itself says the per asset range applies to smaller environments, which is the clue: volume discounts, the provider's own tooling and the depth of response are doing most of the work. A buyer who compares quotes on price alone is comparing unlike things.
Why one company can receive quotes that differ tenfold
Here is the arithmetic for a 500 person company, using the Ogma per user bands. This is our own illustration, not a quote.
At ₹200 per user, the monthly bill is ₹1 lakh. At ₹800 it is ₹4 lakh. At ₹2,000 it is ₹10 lakh. Over a year, that is ₹12 lakh at one end and ₹1.2 crore at the other, for the same headcount.
What separates those figures is not time of day. All three can honestly say 24/7. The low end typically watches alerts and escalates to your team. The high end investigates, contains, hunts for threats and prepares regulatory evidence. A third variable sits underneath: whether the provider brings its own SIEM and EDR licences or runs on tools you already own. Ask which one a quote assumes before comparing anything.
Pricing at the top of the band also deserves a question of its own. At ₹10 lakh a month, a company is spending close to what a modest internal team would cost, and should be sure it is buying capacity it will actually use.
Is it cheaper to build an internal SOC?
For most companies below a couple of thousand employees, no. Providers estimate the internal route at ₹1.5 crore to more than ₹2 crore a year. Our own check against published salary data points the same way, though it covers payroll only.
Start with coverage. A year has 8,760 hours. An analyst realistically delivers around 1,800 to 2,000 productive hours after leave, training and holidays (our assumption). So one seat staffed around the clock needs roughly four and a half to five people. Then add depth. A minimal structure might be five Tier 1 analysts, two Tier 2 analysts and one senior lead or Tier 3 specialist.
Wisemonk's July 2026 bands put Tier 1 base pay at ₹5 lakh to ₹9 lakh and Tier 2 at ₹9 lakh to ₹18 lakh; another salary guide gives Tier 2 at ₹12 lakh to ₹22 lakh and Tier 3 or incident response at ₹20 lakh to ₹40 lakh. The sources differ because they sample different employers and city mixes. Using the widest reasonable ranges, that eight person skeleton costs roughly ₹65 lakh to ₹1.3 crore in base salaries alone. Benefits, shift allowances, a SIEM licence, EDR, threat intelligence feeds, training and recruitment all come on top. One career guide even warns Tier 1 analysts to expect to move on within 18 months, which means turnover is a standing cost, not an occasional one.
The practical middle path is shared responsibility. An industry staffing guide describes a model where a provider covers overnight Tier 1 monitoring while an internal team keeps Tier 2 and Tier 3 investigation. It suits organisations that want control of decisions without paying for night shifts.
What should a 24/7 SOC service actually deliver?
Monitoring is a feature. Response is the service. A credible 24/7 offer in India should include:
Continuous collection and correlation of logs from firewalls, endpoints, identity systems, cloud workloads and key applications
Triage and investigation by named tiers of analysts, with Tier 2 available at night, not just Tier 1
Written authority to contain: isolate a host, disable an account, block an IP, with rules on what needs your approval
Threat hunting and detection tuning, so alert quality improves over the year
Incident support that produces the facts a CERT-In or DPDP notification needs
Monthly reporting on volumes, false positives, response times and open risks
Log retention and exit terms that match your regulatory obligations
The part buyers underestimate is how time is measured. Providers define "response time" differently: acknowledgment of an alert, start of investigation, or completion of containment. N-able's guide to choosing an MDR provider flags this as the clause to settle before signing. One UK public sector service listing shows why. It quotes a detect time of 15 minutes and a respond time of 30 minutes for critical incidents, but defines detection as the interval between the system raising an alert and an analyst triaging it. That is a legitimate service metric. It is not the time between an attacker getting in and someone noticing. Read the definition, not the headline number.
What is not in the quote
Four categories regularly appear after signature.
Data ingestion. Many services price by log volume on top of the base fee. A cloud migration or a new SaaS platform can double ingest without anyone planning for it. IBM India's 2026 data lists cloud migration among the top three factors raising breach cost, so growth in telemetry is likely, not hypothetical.
Onboarding and integration. One time setup fees run from nothing to several thousand dollars in vendor guides, but custom connectors for older or unusual systems can cost far more in effort.
Incident response hours. A base fee may cover triage and containment advice, but deep forensics, malware analysis and on site work are often a separate retainer.
Compliance reporting and exit. N-able notes that many MDR providers place compliance reporting outside the standard scope, and one UK listing offers data extraction at the end of a contract only on a time and materials basis. Ask what leaving costs before you join.
What do CERT-In, DPDP, SEBI and RBI expect from a SOC?
A SOC in India does not operate in a regulatory vacuum, and the rules tighten the specification more than any sales deck.
CERT-In Directions (28 April 2022, in force from 28 June 2022). Covered entities must report specified cyber incidents within six hours of noticing them, keep ICT logs for a rolling 180 days, synchronise clocks with NIC or NPL time sources and name a point of contact. Law firm commentary differs on whether logs may be stored outside India if they can be produced on request. The safer reading, and the one most guides adopt, is to keep them in India.
DPDP Rules 2025 (notified 13 November 2025). Obligations phase in over 18 months, so full application arrives around 13 May 2027, according to one adviser briefing. Rule 7 requires a breach intimation to the Data Protection Board without delay and a detailed report within 72 hours. Counsel commentary notes there is no materiality threshold, so any personal data breach triggers it. The Rules also set a minimum one year retention for logs and related records, and advisers cite penalties of up to ₹200 crore for failures in breach notification.
SEBI CSCRF. The framework issued on 20 August 2024 requires regulated entities to have SOC monitoring, which can come from an own or group SOC, a market SOC or a third party managed SOC. Adviser summaries say compliance became mandatory from 31 August 2025 after two extensions, with the first audit for qualified and midsize entities due by 30 June 2026. Entity category decides the depth, so check your own tier in the circular.
RBI Directions (31 July 2026). RBI issued entity specific Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions on 31 July 2026, with a separate version for NBFCs on its own site. A summary of the commercial bank version describes immediate effect, replacement of the 2016 framework, incident reporting through RBI's DAKSH platform within six hours, and a 24/7 cyber SOC with SIEM and tiered staffing. At least one adviser summary treated NBFCs as unaffected, which conflicts with RBI's own listing, so confirm your category against the RBI text.
What this means in practice (our analysis): your SOC contract has to fit three clocks. Six hours is the outer limit for CERT-In and RBI reporting. Seventy two hours is the DPDP deadline for the detailed report. And log retention runs from 180 days to a year depending on the rule and the data. A counsel's guide even suggests contract wording that obliges the vendor to notify you within two hours of finding a potentially reportable incident, which leaves you time to complete the six hour report. If a provider cannot commit to something like that, you are carrying the regulatory risk yourself.
How to evaluate a provider
Five questions separate serious offers from thin ones.
What is in scope? Ask for the asset and log source count the quote assumes. A price without a scope is a guess.
Who can act? Get the containment authority in writing. If every action needs your approval at night, you are paying for a notification service.
How is time measured? Obtain definitions for detection, acknowledgment, response and containment, plus reporting on actual performance.
Where do logs live, and who owns them? Confirm in country storage, retention periods, and your right to export on exit.
How is automation used? IBM's data suggests automation matters, but ask which steps are automated, who reviews the machine's verdicts, and whether savings reach your invoice.
Then model three years, not one. Include ingest growth, onboarding, incident response hours and an exit. A cheap first year that rises 40% in year two can cost more than a steady mid priced contract.
Finally, test before you trust. Run a tabletop exercise during evaluation: simulate a ransomware alert at 2 a.m. and see who answers, who decides and how quickly you would have a CERT-In ready summary.
What changes over the next two to five years
These are forecasts and our own reading of the evidence, not facts.
DPDP obligations reach full force in 2027, and the minimum log retention and 72 hour reporting duties will push more mid sized firms to buy rather than build. Sector regulators are converging on the same six hour reporting rhythm, so the CERT-In clock stops being a financial services curiosity. Expect buyers to ask harder questions about evidence quality, not just alert counts.
On price, automation is the pressure point. Providers that supervise AI assisted triage need fewer Tier 1 analysts for the same alert volume, and some vendors argue this will shift staffing toward Tier 2, threat hunters and detection engineers. If that holds, per asset pricing will drift toward outcome based pricing, though we would treat vendor claims on savings with caution until they appear in contracts. Meanwhile attackers are using AI too, with IBM reporting AI enabled breaches up 56% year on year, so the defensive savings are an arms race, not a free lunch.
How NS3TechSolutions Supports Managed SOC Services in India
A SOC is only as good as the telemetry that feeds it. Most disappointing SOC engagements we hear about are not analyst failures; they are scoping failures: firewalls not logging properly, endpoints missing an agent, cloud accounts never connected, clocks out of sync. That sits squarely in the infrastructure and network security layer where NS3TechSolutions works.
NS3 can help organisations in three practical ways: assessing whether the network, endpoint and cloud estate produces the logs a SOC needs, with time sync and retention aligned to CERT-In and DPDP expectations; scoping a managed SOC or NOC and SOC arrangement against your actual assets rather than a generic package; and supporting the infrastructure changes that make onboarding cheaper and faster. For teams weighing the shared model, NS3's managed services and security capabilities can sit alongside an internal Tier 2 function. The goal is a service whose price you can explain to your CFO line by line.
Practical checklist
Save this for your next RFP or renewal review.
List the assets, users, servers, cloud workloads and network devices to be covered, with counts
Decide whether the service is monitoring only, MDR, or a shared model with an internal Tier 2
Get quotes on the same scope, with the same tooling assumptions
Obtain written definitions for detection, response and containment times
Confirm containment authority and the approval rules for night time actions
Ask for in country log storage and retention of at least 180 days, and one year where DPDP logs apply
Add a clause for vendor notification inside a window that supports the six hour CERT-In and RBI clocks
Check ingest pricing, overage rates and what happens when log volume doubles
List onboarding, integration, incident response and compliance reporting charges separately
Ask for audit reports under 12 months old and customer references who had a real incident
Agree exit terms: data export format, timeline and cost
Run a tabletop test before signing, and repeat it every year
FAQ
Q. How much does a managed SOC cost per month in India for a 500 employee company?
A. Provider published guides suggest ₹1.5 lakh to ₹5 lakh a month for 24/7 coverage, while per user pricing implies roughly ₹1 lakh for basic triage and up to ₹10 lakh for full MDR with incident response. The gap reflects scope, not time of day.
Q. Is a managed SOC cheaper than an internal SOC in India?
A. Usually yes below a couple of thousand employees. Providers put an internal 24/7 SOC at ₹1.5 crore to over ₹2 crore a year, and payroll alone for a minimal eight person team can approach ₹65 lakh to ₹1.3 crore before tools and turnover.
Q. What is the difference between a managed SOC and MDR?
A. Providers use the terms loosely. In general, a managed SOC emphasises monitoring and triage across your logs, while MDR adds threat hunting, endpoint response and guided or active remediation. Check the contract for who investigates, who contains and what is reported.
Q. Does a managed SOC help with CERT-In six hour reporting?
A. It can, if the contract requires fast escalation and evidence in a usable format. The six hour clock starts when you notice or are told of the incident, so a provider alert that arrives late consumes your window.
Q. Can a SEBI regulated entity outsource its SOC?
A. CSCRF allows SOC monitoring through an own or group SOC, a market SOC or a third party managed SOC. The depth required depends on your entity category, and audits must still be carried out by a CERT-In empanelled auditor.
Q. Which pricing model is best?
A. Per user pricing is easy to budget but rises with hiring. Per asset or per endpoint pricing tracks the estate but can punish growth. Tiered or flat fees give predictability if the scope is clear. Pick the one that matches how your environment actually changes.
Q. What should a managed SOC SLA include?
A. Defined times for acknowledgment, investigation start and containment; stated authority to act; log retention and location; reporting cadence; escalation paths; and exit and data return terms.
The question to ask first
Before anyone negotiates the rupee figure, ask what happens at 3:10 a.m. when a finance user's laptop starts encrypting files. Who sees it, who decides, who acts, and when will you hold the facts you need to file a report? The provider that answers in specifics, with names, times and written authority, has priced a service. The one that answers with a dashboard has priced a feed. In 2026, with breach costs at ₹25.5 crore on average and three regulatory clocks running at once, that difference is worth far more than the gap between any two quotes.