BuyingVerified 19 Jun 2026
Managed SOAR Services 2026: Provider Pricing and What Is Included
Some MSSPs run your SOAR. Some MDRs include SOAR-style response inside the retainer. The economics and the inclusion lines differ materially.
$5K-$50K/mo
Typical managed-SOAR retainer band (mid-market, illustrative)
MSSP
Runs your SOAR on your behalf
MDR
Runs their SOAR, response inside the retainer
0
Public list rates from named managed-SOAR providers
Two different things
A managed-SOAR provider operates your SOAR licence and playbooks on your platform. An MDR runs its own platform and includes SOAR-style response inside the retainer. The first preserves your tool ownership; the second outsources both tool and operation.
What is typically in the retainer
- Platform operations: backups, upgrades, health monitoring.
- Playbook authoring and tuning against your SOC's use cases.
- Integration build-out and recertification.
- Analyst-in-the-loop for high-decision response steps.
- Monthly reporting on MTTR, actions executed, incidents handled.
What is typically not in the retainer
- Your SOAR licence itself (separate procurement).
- Major architecture changes (those become a project).
- Detection content (that's the SIEM / XDR vendor's job).
- Forensics on serious incidents (separate IR retainer territory).
When MDR is the better fit
“Managed SOAR is for organisations that want to own the platform but rent the operators. MDR is for organisations that want to rent both.”
See /soar-vs-mdr for the full build-vs-buy analysis.