We got three SOC proposals — what kind of matrix should I build to compare scope and SLAs?

Pay close attention to when the SLA clock actually starts ticking for MTTD and MTTR. Many firms don't start the timer when the alert hits their SIEM, but rather when an on-duty analyst manually acknowledges the ticket. That can easily turn a 15-minute response window into an actual 2-hour wait.

We signed a deal last year with an 80,000 TL budget for a similar setup. Because they underestimated our log quota, our servers blew past the cap by month three, and we got hit with a 28,000 TL surprise bill. Lock in the daily overage pricing per GB in writing before signing anything.

Never blindly trust the "24/7" badge in proposals. At many shops the graveyard shift is just an intern or an L1 contractor staring blankly at a dashboard. If a suspected ransomware incident kicks off at 3 AM will there be an actual L2/L3 engineer on call ready to isolate the server or will you be waiting for the 9 AM morning shift?

The 4 most critical checkpoints you need in your comparison matrix: 1) Cost of daily log GB and EPS overages. 2) Whether unused monthly incident response hours roll over. 3) Frequency of detection rule updates and tuning. 4) Historical log retention and indexing periods required for audit compliance.

false positives were our biggest headache. getting fifty useless alerts a day meant everyone just started ignoring them. make sure to put a line in the matrix for how many man-days/hours per month they commit to rule tuning and maintenance.

note: I wrote this based on my own experience, it might not apply to everyone.

When presenting to the board, skip the technical jargon and focus on risk vs. total cost. Add an 'out of scope' column right next to the bids. If you don't clearly map out which steps fall on your internal team versus what the SOC vendor actually owns, both sides will just point fingers at each other when an incident hits.

Demand a 15-day Proof of Concept (PoC) before signing any contract. Hook up at least two critical servers and a handful of endpoints. Do not commit that kind of money without seeing their dashboard usability and alert response speeds with your own eyes in real time.

Who is managing the EDR on the endpoints? Are these vendors just ingesting the telemetry, or do they have the authority and tooling to actively isolate a compromised host from the network the moment a threat is confirmed?

I'm a small business, let me explain from my side. Don't hesitate to ask; those who don't ask always pay more.

Of course, it varies if your situation is different.

here's how it went for us then if 2FA is on a stolen password alone is useless.

if I were you, Id go this route.

My questions are cleared up, thanks.

Ive been dealing with this for a long time. An automated scan report is not the same as a penetration test.

When making a decision, first look at what data you have on hand.

Good call starting this thread.

Great work.

Sorry, but this doesn't apply in every case. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

I'm curious too.

I completely agree. Payment information changes are never verified through the channel they came from.

Quick summary for newcomers: When making decisions, write down the worst-case scenario too, not just the best.

Most incidents start with a leaked password, not a vulnerability.