Should you build or buy Managed Detection & Response (MDR)?
Managed detection and response combines security monitoring technology with a vendor's own analysts, who watch a company's endpoints, network, and cloud environment around the clock, investigate alerts, and take action to contain a real threat. It gives organizations 24x7 coverage and incident response without staffing an internal security operations center.
Buy MDR or a co-managed service if you need a vendor to own overnight and weekend investigation and response, and compare providers on response authority, SLAs and what telemetry and licenses are included. If you already have security staff and incident ownership, evaluate AI SOC agents to extend capacity and narrow the MDR scope, judged on production results and safe action controls.
Build it, buy it, or bridge?
When building makes sense
Building an internal security operations center is the wrong default for nearly every organization, and the economics explain why. A functional 24x7 SOC needs a minimum of 8 to 10 analysts, which alone runs past $1 million a year in personnel costs before benefits and overhead, plus SIEM, endpoint detection, threat intelligence, and orchestration tooling that pushes the total to $1.4 million to $1.75 million a year at minimum, according to Expel's own cost breakdown. That buys a capability that takes 12 to 18 months to become operational for a function that carries no competitive advantage once it's running. AI SOC agents are automating a growing share of Tier 1 triage, which narrows the analyst headcount a build would need, but that same trend cuts the cost of MDR providers' own operations too. Building only clears the bar for organizations at genuine enterprise scale, with thousands of endpoints and needs unusual enough that a standard MDR contract stops fitting.
When buying makes sense
Buying MDR is the default for good reason: the cost gap between managed services and an equivalent in-house SOC is enormous, and the coverage gap runs the other way. MDR typically costs $10 to $30 per device a month, landing most organizations in the $50,000 to $300,000-plus a year range depending on size, according to Expel's own pricing analysis. Arctic Wolf, one of the larger MDR providers, shows a median contract value of $79,740 a year across a range of roughly $24,000 to $315,000, with list pricing around $8 to $25 or more per endpoint each month. That is a fraction of the $1.4 million-plus an equivalent internal SOC costs, and it's available immediately rather than after a 12 to 18 month build. Buy MDR when you need overnight and weekend human response and don't already have a security team large enough to staff that coverage yourselves.
The desk read
Build-versus-buy analysis for Managed Detection & Response (MDR) is being written. In the meantime, the framework that drives every B4 call is on the B4 Index page.
Frequently asked
What is managed detection and response (MDR)?
MDR is best understood as renting the overnight and weekend half of a security team you'd otherwise have to hire yourself. The vendor's analysts watch your environment continuously and act on real threats, so your own staff isn't the only line of defense once everyone goes home.
How much does MDR cost compared to an in-house SOC?
MDR runs roughly $10 to $30 per device a month, or $50,000 to $300,000-plus a year for most organizations. A comparable in-house SOC needs a minimum of 8 to 10 analysts and runs $1.4 million to $1.75 million a year once technology and training are added, per Expel's cost analysis.
Is building our own SOC ever the right call?
Only at real enterprise scale, with thousands of endpoints and security needs specific enough that a standard MDR contract no longer fits. AI SOC agents are cutting the analyst headcount a build requires, but that same automation is also lowering MDR providers' own costs, so the gap hasn't closed.
What do MDR providers actually include for the price?
At minimum: 24x7 monitoring by human analysts, automated alert triage, incident response and containment rather than just notification, investigation reports, and ongoing detection tuning. Advanced threat hunting, on-site incident response, and penetration testing are usually separate line items, so confirm what's included before comparing quotes.