CompareVerified 19 Jun 2026
SOAR vs MDR 2026: Build Automation In-House or Buy a Managed Service
The build-vs-buy debate for SOC response. SOAR plus analysts is the build path. MDR is the buy path. The right answer depends on SOC size, sensitivity of data, and whether you can hire.
Build
SOAR licence + integrators + 24x7 analysts
Buy
MDR monthly retainer (see mdrcost.com)
$3-$15/endpoint/mo
Typical published MDR endpoint band
$300K+/yr
Realistic in-house enterprise build envelope
The build-vs-buy frame
Build means owning the platform and the people. Licence cost is the smallest line item. The bulk is integration engineering, playbook development, and 24x7 analyst headcount. Buy means signing an MDR retainer and inheriting the provider's playbooks, platform, and analysts.
“If you cannot reliably hire a third shift, MDR is not a cost-decision, it's a feasibility decision.”
TCO at three SOC sizes (illustrative example, not a real company)
In-house SOAR build (mid-market, 500-staff)
01
SOAR licence (commercial tier)
Quote-only vendor, mid-market band
$90,000
running $90,000
02
Integration engineering
20 integrations at $4,500/yr each
$90,000
running $180,000
03
Playbook development
10 playbooks at ~80 hours each
$40,000
running $220,000
04
Analyst training
6 analysts at $1,800/yr each
$10,800
running $230,800
05
24x7 SOC coverage gap
Net headcount premium vs single shift
$120,000
running $350,800
(Illustrative example, not a real company.) Year-one cost ~$350K before any incidents.
MDR retainer (same SOC)
01
MDR per-endpoint retainer
2,000 endpoints at $5/mo
$120,000
running $120,000
02
Onboarding and tuning
One-time first-year line
$40,000
running $160,000
03
Internal SOC liaison (0.5 FTE)
Someone has to talk to the provider
$80,000
running $240,000
04
Legacy SIEM (kept as system of record)
Even MDR users keep their own SIEM
$60,000
running $300,000
(Illustrative example, not a real company.) Year-one cost ~$300K, no 24x7 hiring pressure.
When in-house SOAR wins
- Large enterprise with sensitive data that cannot leave your tenancy.
- Mature SOC with hiring success and 24x7 coverage already in place.
- Highly custom workflows that no MDR provider runs as standard.
- Regulatory environments where ownership of the response process is mandatory.
When MDR wins
- SMB or mid-market without budget for 24x7 in-house staffing.
- Security-team-of-one organisations.
- Cyber-insurance requirements that explicitly recognise MDR.
- Periods of hiring difficulty where building cannot keep pace with risk.
Across the SOC stack
siemcostcalculator.com
SIEM cost - the upstream feeder SOAR orchestrates
xdrcost.com
XDR cost - detection layer SOAR automates response for
edrcost.com
EDR cost - endpoint detection feeding SOAR playbooks
mdrcost.com
MDR cost - managed alternative to in-house SOAR
securityoperationscost.com
Umbrella SOC TCO hub