Managed Security Services: What You Should Get, What It Costs and 10 Questions to Ask Before You Sign

Managed Security Services: What You Should Get, What It Costs and 10 Questions to Ask Before You Sign

Managed security services are outsourced security operations: a provider collects your logs into a SIEM, watches for threats around the clock, and responds to incidents under written agreements. A buyer should expect 24/7 analyst monitoring, endpoint detection and response, containment steps with human approval, and audit-ready reporting. The service is defined by written commitments, not a feature list.

Your auditor, your insurer, or your board has told you to buy a managed SOC. The vendor's brochure is full of 24/7, AI, and global team. Two weeks later, you are comparing three proposals that promise different things at different prices, and the words managed SOC, MDR, and SIEM as a service are used so loosely that none of them means the same thing.

The spend is no small decision. The global average cost of a data breach reached $4.99 million in 2026, up 12% from the year before [1]. AI-driven attacks increased 56% over the same period [1]. And the organizations getting the most out of their security tooling are the ones running AI and automation: they saved an average of $1.93 million per breach compared to organizations that do not [1]. A managed security service is how most mid-size organizations get that capability without hiring a team that works shifts.

Clone Systems' position: a managed security service is only as strong as its written commitments. If the contract does not say who responds to an alert, what you own, and where your data is processed, you have bought a dashboard, not a security operation. Everything below exists to force those commitments into writing before you sign.

What Are Managed Security Services?

Managed security services are outsourced security operations: a provider collects your security data, correlates it, watches for threats around the clock, and responds to incidents under a written agreement. The four terms that appear in every proposal, SIEM, managed SOC, EDR, and MDR, describe different layers of the same job.

• SIEM (the data layer). Security information and event management: a platform that collects logs from endpoints, networks, cloud, and identity, and correlates them into one view. "SIEM as a service" means a vendor hosts, tunes, and watches it for you.
• EDR (the sensor). Endpoint detection and response: an agent on each server and workstation that records process activity, flags suspicious behavior, and can isolate a host.
• Managed SOC (the people). A security operations center that works the alert queue around the clock: triage, investigation, escalation, and a record of what was decided.
• MDR (the combined commitment). Managed detection and response: a vendor that commits to respond, not just to see. Some vendors use MDR for the whole bundle; others use it for managed EDR only. That is the loose usage you are navigating.

Clone Systems has a dedicated comparison of SOC, MDR, EDR, and XDR that is worth reading before the first vendor call [9].

What Should Be Included in a Managed Security Service?

A complete service covers collection, detection, response, and evidence. The table below is the minimum a buyer should expect in a proposal.

Two details separate a real operation from a brochure. First, response authority: the proposal should name which containment actions the provider may take without a call and which require your approval. Second, the quiet-source check: a good platform raises an alert when a log source goes silent, so a dead agent does not become a coverage gap.

In-House SOC vs Managed SOC: The Honest Trade-Offs

An in-house SOC gives you full control. A managed SOC gives you coverage faster and at a predictable cost. The honest comparison runs on four dimensions.

When in-house still makes sense: you already have a 24/7 security team; your data must remain in infrastructure you own for regulatory or contractual reasons; or custom detection engineering is a core part of your business rather than overhead. NIST SP 800-61 Rev 3, the current incident response guide, treats incident handling as a program with preparation, detection and analysis, containment, eradication and recovery, and post-incident activity [2][6]. A managed SOC is one way to run that program; it is not the definition of it.

How Is Managed Security Priced?

Four pricing models appear in these proposals. Knowing which one you are looking at is half the comparison.

1. Per endpoint. One predictable price for each server, workstation, or cloud workload you monitor. The bill scales with your environment.
2. Per user or per seat. Common where the service centers on identity or a SaaS stack.
3. Per log volume, or per events per second. The traditional SIEM licensing model. This is the one that surprises buyers.
4. Platform license plus services. The tool is billed separately from the team that watches it.

The log-volume trap. Log-volume pricing turns your own compliance work into a cost increase. The auditor asks for more log sources, you connect them, and the bill rises. You pay more to be more secure. Ask any provider: what happens to my price when my log volume doubles? If the answer is "it goes up," you have found the model.

What Clone Systems does differently. Clone Systems prices per monitored endpoint, with a 50-endpoint minimum and a one-year term. The SIEM, the private AI, and 24/7 analysts are included, and there are no log-ingestion fees, so the bill does not climb as log volume grows [4][5]. No dollar figures are published; quotes are scoped to the environment.

Before you compare numbers, confirm five things: the minimum size, any one-time onboarding fee, the cost to change retention, the price of adding endpoints mid-term, and the contract term.

If you are shortlisting providers, look at the price structure before the feature list. Clone Systems publishes its pricing model on the Managed SOC + SIEM Pricing page, and a demo of the console is one call.

10 Questions to Ask Before You Sign

Run every provider on your shortlist through the 10 questions below. We call this the 10-Question Managed Security Scorecard: score each answer 1 if the provider confirms it in writing, 0 if it is verbal only. Ten is what a security operation looks like. Under seven is a monitoring product with extra steps.

1. Who watches the alerts, and at what times? A good answer names analysts on 24/7 shifts in stated regions. "We have on-call coverage" scores 0.
2. What response times are in writing? A good answer is a statement of work with an SLA, such as sub-minute response to critical alerts and detection rules that run every minute [4]. "We are fast" scores 0.
3. Which containment actions can you take without calling me? A good answer is a written pre-approved list: block an address, isolate a host, disable an account. Everything else requires your approval. Our post on the response authority clause goes deeper on this one [6].
4. Where are logs stored, and are they sent to any outside AI service? A good answer names the hosting location or your environment, and commits that logs and prompts never leave the provider's own infrastructure.
5. What do we own, and what can we export? A good answer: the data stays yours, and you can export logs, incidents, and reports in standard formats at any time, including when you exit.
6. What reporting and audit evidence do we get? A good answer names the report list, for example a monthly executive report and a compliance evidence pack, and shows alerts mapped to your frameworks [4][7].
7. How long does onboarding take, and what do we need to provide? A good answer is a fixed number of weeks, a checklist (agents, syslog, integrations), and named contacts on both sides.
8. Which integrations are ready for the tools we already run? A good answer is a concrete list, for example CrowdStrike, Microsoft 365, Okta, and AWS, that covers your stack [4].
9. What is the log retention, and what does changing it cost? A good answer states retention aligned to your framework, for example 12 months for PCI DSS, and prices the change in writing [7].
10. How do we exit, and what do we take with us? A good answer defines offboarding: data returned in usable form, access removed, and no charge for getting back your own data.

How Do Managed Services Help With Compliance?

The frameworks do not name vendors, but they do name the evidence. Here is what each one asks for, and what to bring back from the vendor call.

PCI DSS. PCI DSS v4.0.1 has required automated review of audit logs under Requirement 10 since March 31, 2025 [4], and Clone Systems' service retains logs for 12 months for PCI DSS [4][7]. Ask any provider for a sample of the log review evidence and for the mapping between alerts and requirements. Clone Systems keeps a page on PCI DSS Requirement 10 logging if you want the requirement-level detail.

HIPAA. The Security Rule requires audit controls: mechanisms that "record and examine activity in information systems that contain or use electronic protected health information" (45 CFR 164.312(b)) [3]. A managed service that produces a reviewable record of what was detected, when it was investigated, and how it was handled is the evidence that control expects.

SOC 2. A Type II report depends on evidence that your security controls operated over the audit period. Monthly reports, incident records, and log retention become the raw material your auditors test. Ask for a sample monthly report before you sign, and check whether the format survives auditor review.

Cyber insurance. Questionnaires increasingly ask whether you monitor continuously, how quickly you respond, and how long you keep logs. The written SLA and the monthly report are what you send back.

How Clone Systems Approaches Managed Security

The rebuilt Managed SOC + SIEM was announced on October 28, 2026, and is documented in the press release [4]. The facts, as stated on Clone Systems' own pages:

• Coverage. 24/7 monitoring and response by analysts in the US and EU, with sub-minute response to critical alerts and detection rules that run every minute [4][7].
• Platform. The SIEM is included, with 100+ integrations including CrowdStrike, SentinelOne, Microsoft 365, Okta, AWS, Azure, Google Cloud, Proofpoint, and Mimecast. Nearly 1,900 detection rules written by Clone Systems run against your data, and each incident is mapped to a MITRE ATT&CK attack path [4][8].
• Endpoints. Lightweight agents on Windows and Linux servers and workstations, with confirmed containment actions from the console [8].
• Private AI. The Clone Systems AI Assistant investigates alerts and drafts response steps inside Clone Systems' own infrastructure. An analyst approves every action, and customer logs are never sent to an outside AI provider or used to train public models. Each customer gets a dedicated instance hosted in Clone Systems data centers in Philadelphia, Athens, or Limassol, or deployed in the customer's own environment [4]. The SIEM with private AI page covers the full flow.
• Pricing. Per monitored endpoint, 50-endpoint minimum, one-year term, no log-ingestion fees, SIEM and AI included [4][5].
• Evidence. Twelve standard reports including a monthly executive report and a compliance evidence pack, with alerts mapped to PCI DSS, HIPAA, GDPR, NIST 800-53, and SOC 2 [4][7]. Onboarding takes a few weeks [5].

The full service is described on the Managed SOC + SIEM page, and the platform on the Managed SIEM with EDR Integration page.

Frequently Asked Questions

What is a managed SOC? A managed SOC is a team of analysts that monitors your security alerts around the clock and investigates and responds to incidents for you. You typically buy it with the SIEM that collects and correlates the log data they watch.

What is the difference between MDR and a managed SOC? MDR (managed detection and response) is a vendor commitment to detect and respond to threats, usually centered on endpoint detection and response. A managed SOC is the broader operation: monitoring, investigation, and response, and the two terms overlap heavily in vendor materials.

How much does a managed SOC cost? There is no standard price. Most providers price per monitored endpoint, per user, or per log volume, and the quote depends on endpoint count, environment mix, and retention needs. Ask for the pricing model, the minimums, and what moves the bill before you compare numbers.

Do I need a SIEM if I have EDR? EDR sees the endpoint; a SIEM correlates those signals with network, identity, and cloud events. Most frameworks that require log review and monitoring need the SIEM layer even when endpoint tooling is separate.

How long does onboarding take? Most providers need a few weeks: a scoping call, agent deployment, log source connections, and verification that everything reports. Ask for the number of weeks in writing and the checklist of what you must provide.

Where are my logs stored with a managed SOC? Either in the provider's data centers or in your own environment, depending on the contract. Ask for the exact hosting location, the encryption in transit, and whether any logs or prompts are sent to outside services, including AI providers.

Can a managed SOC actually respond, or only alert? A real MDR contract gives the provider a written list of pre-approved containment actions, such as isolating a host or blocking an address, with everything else requiring your approval. If the proposal is silent about who may act, it is a monitoring service, not a response service.

What is the difference between a managed SOC and vulnerability scanning? Scanning finds known weaknesses on a schedule; a SOC watches for active compromise continuously. They answer different questions, and most buyers need both.

Do managed security services work for small organizations? The service scales with endpoint count, but some providers set a floor. Clone Systems' managed SOC starts at 50 endpoints [5], and below that, scanning and penetration testing are usually the better first step.

What compliance frameworks do managed SOC reports map to? Ask for the list in writing, because the right answer is the frameworks your auditors actually ask about. Clone Systems maps alerts to PCI DSS, HIPAA, GDPR, NIST 800-53, and SOC 2 [4].

What happens to my data if I cancel? The contract should state that your data is returned in usable form and then deleted, with access removed. If the exit is not written down, negotiate it before you sign, because offboarding is when it matters.

Is AI in a managed SOC a risk to my data? The risk depends on where the AI runs. If it is the provider's own private platform in its own infrastructure, with every action approved by a person, your logs never reach an outside model host [4]. Ask exactly where inference happens before you sign.

What to Do Next

Getting a managed security service is a hiring decision, not a shopping decision. You are buying a team that will act in your environment on the quiet nights and the bad ones. Run your shortlist through the 10 questions above, and compare the pricing structure before the feature list. If you want a second pair of eyes, schedule a demo of the Clone Systems console or contact the team with the proposals you have. The 10-Question Managed Security Scorecard above is the same one to run on us.

References

[1] IBM Security and Ponemon Institute, Cost of a Data Breach Report 2026. https://www.ibm.com/reports/data-breach [2] NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, April 2025. https://csrc.nist.gov/pubs/sp/800/61/r3/final [3] 45 CFR 164.312, HIPAA Security Rule Technical Safeguards, Legal Information Institute, Cornell Law School. https://www.law.cornell.edu/cfr/text/45/164.312 [4] Clone Systems, Clone Systems Adds Private AI to Its 24/7 Managed SOC + SIEM, October 28, 2026. https://www.clone-systems.com/blog/clone-systems-adds-private-ai-managed-soc-siem [5] Clone Systems, Managed SOC + SIEM Pricing. https://www.clone-systems.com/managed-soc-pricing [6] Clone Systems, Managed SOC Statement of Work: The Response Authority Clause Nobody Writes Down, October 22, 2026. https://www.clone-systems.com/blog/managed-soc-statement-of-work-response-authority-clause-nobody-writes-down [7] Clone Systems, Managed SOC + SIEM with AI. https://www.clone-systems.com/managed-soc-service/ [8] Clone Systems, Managed SIEM with EDR Integration. https://www.clone-systems.com/managed-siem-edr-service [9] Clone Systems, Managed SOC vs MDR vs XDR. https://www.clone-systems.com/managed-soc-vs-mdr-vs-xdr