What's the difference between a SOC and MDR? Do we need both for a 20-person company?

SOC pricing scales with log volume, so as your log sources grow, the bill climbs fast. MDR is usually priced per endpoint. Paying for 28 agents—covering 20 employees and, say, 8 servers—is far more predictable both cost-wise and operationally.

Have you checked the exact wording on the client's audit questionnaire? Sometimes they just ask for 24/7 threat detection and response, other times they explicitly require all corporate logs to be centrally retained for at least 1 year. If log retention is mandatory, you might need to pair MDR with a basic cloud log archiving setup.

If you're getting quotes for a client audit, definitely lean towards the MDR option. The firm quoting you 3,200 dollars for SOC will probably just throw alerts your way. In a 20-person team, who's going to investigate those alerts? If you don't have in-house staff to look into an alert that hits at night, SOC will just burn through your budget.

We started with SOC 2 years ago with our team of 35. We were paying 2,800 dollars a month, but almost all the alerts coming in every month turned out to be harmless system activity, and our own engineers were wasting time on them. We switched to an MDR model, the monthly cost dropped to 1,300 dollars, and the vendor directly took over the remediation.

getting a soc for small teams is like installing a smoke detector and waiting for the fire dept when no one's home. it makes noise but no one puts out the fire. at least mdr shuts off the valve and takes action right when there's a threat so it makes way more sense for you.

I recommend carefully reviewing the Service Level Agreement clauses in the contract. If the managed SOC proposal only commits to detection time rather than incident response time, the actual security enforcement and obligation to take action will remain entirely on your company.

In short: SOC collects logs and alerts you, while MDR directly stops and remediates the threat on the endpoint. Since you don't have a dedicated in-house security operations team, you can't manage a SOC with 20 people; MDR is definitely the right call, both for the audit and for operational peace of mind.

Thanks a lot, I'll try it today.

Let me write how it's done in practice. Don't hesitate to ask; those who don't ask always pay more.

If you have questions, write them; I'll answer as best I can.

I'd say don't rush. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Good luck with that.

It's rare to find an explanation this clear.

My questions are cleared up thanks.

I went through the same thing.

I agree with this. If permission and scope aren't in writing, don't start that test.

If you post the result here, it will help others too.

I have an objection here. If you don't write this down from the start, it leads to arguments later.

Everything goes well for the first three months; problems arise in the fourth. Good luck with that.

good call starting this thread. when making decisions write down the worst-case scenario too, not just the best.

good luck with that.

The opposite happened to me, that's why I'm writing. Taking measures without an inventory leaves doors you haven't seen open.

Of course, it varies if your situation is different.

We need to take it step by step. When we decide without measuring, we always end up in the same place.

Hope this helps.