SOAR Pricing Models: Per-Asset, Per-Action, Per-Playbook, Platform-Tier, Consumption
Why the same SOC gets quotes that differ by 5x across vendors. The meter you accept at signing determines what gets expensive at year two.
The five meters
Per-asset
Meter the count of managed assets (endpoints, identities, cloud workloads). Predictable. Punishes growth.
Per-action
Meter the count of automation actions executed. Punishes incident spikes. Hardest to forecast.
Per-playbook / per-job
Meter the count of end-to-end workflow runs. Bridges per-action and per-asset.
Platform tier + named users
Flat platform fee plus per-user seats. Predictable. Punishes SOC headcount growth.
Consumption / bundled
Rolled into a SIEM or platform deal sized by ingest volume. Discounts are heavy but standalone economics disappear.
How they trade off
Each meter has a temperament. Coloured cells, not plain checkmarks.
| Feature | Per-asset | Per-action | Per-playbook | Platform + seats | Consumption / bundled |
|---|---|---|---|---|---|
| Predictable forecast | ✓ Included | ✗ Missing | ◐ Partial | ✓ Included | ✗ Missing |
| Resists alert spikes | ✓ Included | ✗ Missing | ◐ Partial | ✓ Included | ✗ Missing |
| Punishes growth | ✓ Included | ◐ Partial | ◐ Partial | ✓ Included | ✓ Included |
| Bundle leverage | ✗ Missing | ◐ Partial | ✗ Missing | ✗ Missing | ✓ Included |
| Transparent to buyer | ✓ Included | ◐ Partial | ✓ Included | ✓ Included | ✗ Missing |
Which meter favours the buyer?
“The meter that favours the buyer is the meter that you can predict twelve months out. Whatever the vendor cannot easily forecast becomes the line that grows surprising.”
Per-action and consumption models are vendor-friendly because incident spikes inflate the bill. Per-asset and platform-plus-seats are buyer-friendly because forecasting is straightforward. The rule of thumb: insist on a cap on consumption tiers, or push to a flat-fee structure if the vendor will negotiate.