A good managed SOC for a UK mid-sized firm watches your endpoints, identities, cloud and firewalls around the clock, has UK-based analysts, and is allowed to act when an attack is live. Published prices run from £4 to £24 per asset or endpoint per month before VAT, but the cheaper tiers often only escalate alerts. Compare what each tier lets the provider do at 3am, not just the headline rate.
In short, shortlist providers that publish their UK delivery model, ask for 24/7 cover across endpoints, identity, firewalls and Azure in writing, and require named escalation contacts, incident response terms and a sample board report. For regulated firms, add the NCSC's Enhanced level for incident response. For value, compare matched specifications, not headline rates.
What should a managed SOC do for a mid-sized UK business?
A managed SOC is the people and process behind the tools. A licence for endpoint protection or a SIEM is not a staffed service. Someone has to read the alerts, decide which are real, and take action.
Providers split this work differently. At the lighter end, analysts triage alerts and pass validated ones to your team to investigate. At the fuller end, they contain threats for you, hunt for hidden activity and report to the board.
Socura, a UK provider, lists 24/7 alert triage, threat hunting, automated containment, a dedicated incident portal, and SLAs for triage and response as parts of its managed detection and response service. That is a useful checklist even if you buy from someone else.
Which systems should the service watch?
Ask for a named list of data sources, not a promise of "full coverage". For most mid-sized firms the list should cover laptops and servers (EDR), Microsoft 365 and Entra ID identities, cloud workloads such as Azure, and firewall or network events.
Providers differ here. The 24/7 SOC service from CyPro covers EDR, Microsoft 365 and Entra telemetry at its entry tier, and adds email, cloud, network and SaaS telemetry as you move up the tiers. Socura says it can integrate with your existing security controls during scoping and onboarding.
Tooling matters too. If you already run Microsoft Sentinel, the platform bill is separate from the service fee unless the contract bundles it. Microsoft says Sentinel can be paid for through pay-as-you-go or commitment tiers, so ask the bidder which model the quote assumes.
Before you sign, ask for a test in each area. An endpoint isolation, a suspicious sign-in, a firewall event and an Azure control-plane change will show whether the investigation really joins up.
What does a managed SOC cost in pounds?
Very few UK providers publish prices, so the ones that do are useful anchors. They are not like-for-like quotes.
CyPro's 24/7 SOC publishes three tiers per endpoint per month, excluding VAT, with monthly minimums. Its worked example is a 150-person business with about 170 endpoints on the middle tier, giving £2,550 a month. Checked on 1 November 2026.
Published managed SOC price per endpoint per month
CyPro's 24/7 SOC tier prices per endpoint per month, excluding VAT, checked 1 November 2026.
View the data
| Category | £ per endpoint per month, excluding VAT |
|---|---|
| SOC Monitor | £6.00 |
| MDR Respond | £15.00 |
| MDR Resilience | £24.00 |
Acumen Cyber's MXDR Complete managed SOC and SIEM is listed from £4 per asset per month, with a separate one-off onboarding fee. The G-Cloud pricing document, dated 22 April 2024 in its file name, says headline pricing assumes a 36-month term, excludes VAT and bills recurring costs annually in advance. It also offers pricing by events per second or gigabytes of logs per day.
Socura prices by a different measure. Its annual subscription is mainly based on active IT users and the data sources monitored, with SIEM or EDR licences added where they apply.
Three unit types, per asset, per endpoint and per user, cannot be compared until you convert them for your own estate. Ask every bidder to price implementation, the recurring fee, platform licences, log ingestion, retention, incident response and exit separately.
Which UK managed security providers should a mid-sized firm shortlist?
There is no independent league table of UK providers, so build a shortlist from what each one publishes and test it in your own bid. On the evidence above, three are worth a first conversation.
Socura is a UK provider with a 24/7 SOC. It lists UK-based security cleared staff, a CREST-certified SOC, Cyber Essentials Plus, ISO 27001 and the Data Security and Protection Toolkit, which helps if you sell to the NHS or the public sector. Acumen Cyber offers a managed SOC and SIEM with a published starting price. CyPro's 24/7 SOC publishes all three tiers and says its analysts are UK-based, which makes budgeting easier.
For a regulated organisation, or one with sites in several countries, ask the same questions of any larger European provider you also invite. Where the analysts sit, where logs are stored and who leads a major incident matter more than the logo on the proposal.
If you want a list of companies rather than a shortlist, the NCSC publishes a find a provider tool for assured incident response suppliers. It covers incident response, not every managed security service, so use it alongside the checks in this guide.
What will give a board confidence in the service?
A board wants to know three things: are we covered, did anything serious happen, and who decides what. The service should answer all three in a short regular report.
Ask for a sample before you buy. At the top published tier, CyPro lists board and compliance reporting, named service management and an annual incident response tabletop exercise. Socura lists a dedicated Customer Success Manager and monthly service reviews. Whichever you choose, the report should show coverage gaps, material incidents, open remediation and decisions needed from management.
For compliance support, ask the provider to name the standards its own service meets and the evidence it will give you for yours. A badge on a website is not evidence for your auditor. Ask for the exact scope of each certificate and which service it covers.
Who is allowed to act during a live attack?
A SOC that sees an attack but cannot isolate a laptop or disable an account is a monitoring service, not a response service. Write down which actions the provider may take without calling you, and which need approval.
CyPro's published tiers draw this line clearly. Its entry tier escalates validated alerts to your team, while the middle tier contains threats on your behalf. The page itself notes that escalation-only costs less but does less at 3am.
Forensics and recovery are a separate question. Socura lists digital forensics and breach support as delivered through an IR partner. That is a sensible model, provided you know how the handover works and who pays.
The NCSC recommends that all UK organisations use an NCSC-assured Cyber Incident Response provider when dealing with cyber incidents. It assures providers at two levels, Enhanced and Standard. It strongly recommends the Enhanced level if you operate in a regulated sector, in more than one country, are likely to be targeted by nation state attackers, or are part of Critical National Infrastructure.
What do UK rules expect from your provider?
Outsourcing monitoring does not outsource your legal duties. A good contract helps you meet them on time.
Under Article 33 of UK GDPR, a controller must notify a notifiable personal data breach to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it. The same article says a processor must tell the controller without undue delay. Make sure your SOC contract states how fast, and to whom, the provider reports.
If you are an FCA-regulated firm, the regulator says firms in scope had until 31 March 2025 to operate their important business services within impact tolerances, as set out on its operational resilience page. Map your SOC's monitoring and recovery to those services.
What changes next is on the way for providers. The government's factsheet, updated on 30 June 2026, says it will bring medium and large managed service providers that meet the definition of a relevant managed service provider into the NIS Regulations 2018. They would need to manage risk and report significant incidents to their regulator, the Information Commission.
How should you run the shortlist?
Start with three bidders. Pick one UK specialist, one provider that publishes its pricing, and one that fits your existing tools, such as a Microsoft-heavy stack. Socura, Acumen Cyber and CyPro are each worth a conversation on the published evidence, alongside any provider you already trust.
Send every bidder the same brief. It should list your endpoints, users, identity sources, firewalls and cloud subscriptions, plus the actions you want taken without approval. A matched brief is what makes the quotes comparable.
Before you sign, run a joint incident exercise and ask for a sample executive report. Check that the report shows exposure, material incidents, open remediation and decisions needed from management. Then agree the exit terms while you still have the choice.
Sources
- Socura, MDR key features and FAQs, 2026
- 24/7 SOC, MDR pricing UK, checked 1 November 2026
- Acumen Cyber, MXDR Complete pricing document, G-Cloud 14, 2024
- Microsoft Learn, Plan costs and understand pricing and billing for Microsoft Sentinel
- NCSC, Information for Cyber Incident Response buyers
- legislation.gov.uk, UK GDPR Article 33
- FCA, Operational resilience
- GOV.UK, Relevant managed service providers factsheet, 30 June 2026
