Most organizations without a dedicated security team can't staff an internal SOC themselves, and the math shows why. A week has 168 hours and an analyst works about 40 of them, so round-the-clock coverage takes at least four or five analysts even before you account for vacations, sick days, and turnover.

The tools add to the bill: security information event management (SIEM), endpoint detection and response (EDR), threat intelligence, and the engineering time it takes to keep detections useful. Hiring is usually the hardest piece, since analysts take time to train and one departure leaves a hole in the overnight schedule.

An in-house SOC makes sense when you already staff overnight shifts, have budget for a detection engineering practice, or face data residency rules that rule out a third party. For nearly everyone else, a provider or a hybrid model is the practical path.

Vendors use these labels loosely, and "fully managed" on a website means whatever that vendor decided it means.

Read the contract, not the product name. If you need a refresher on the basics, start with what a SOC is, what SOC-as-a-Service covers, and what SOC services actually do.

Five answers, written down before the first demo, will make every vendor conversation sharper. They also keep you from buying coverage for an environment you don't have.

1. List what needs watching. Count your endpoints, then add your identity platform (Microsoft 365 or Google Workspace), email, cloud apps, and network. Many intrusions start with a stolen login or a phishing email, so a provider that only watches endpoints leaves a lot of doors unwatched.
2. Know your compliance obligations. HIPAA, PCI DSS, CMMC, and state regulations each expect specific monitoring and reporting. Ask your cyber insurance broker what they require too, since a policy can set its own minimums for monitoring and response.
3. Decide what your team can handle. Who picks up at 2 a.m. when something fires? If the honest answer is nobody, you need a provider who can contain a threat without waiting for you.
4. Inventory what you already own. Write down your EDR, firewall, identity provider, and any SIEM. You'll want to know which tools a provider reuses and which it asks you to replace.
5. Set a budget range and a single owner. One person makes the call, and a range lets you compare quotes that are priced per endpoint, per user, or per data volume. Our managed SOC pricing guide breaks down how each model works.

Bring this list to every call. Vendors who ask about it before they quote are showing you how they'll work with you once you're a customer.

These eight criteria decide whether a provider will protect you or just report on you. Each one pairs what good looks like with what should make you pause.

1. Coverage: what do they actually watch?

"Monitoring" means different things at different providers. Some watch endpoints only, others add identity, email, cloud, and network logs. A SOC can only investigate what reaches it, so the source list matters more than the logo on the proposal.

What good looks like: A line-item list of the sources in scope (for example, your Microsoft 365 sign-in logs and your Windows and Mac endpoints) and an honest list of what isn't covered.

Red flag: "We cover everything."

2. Response authority: do they act or just alert?

This question decides most of the value you'll get. An alert-only provider sends you a ticket and waits for you to wake up. A responding provider isolates the machine, stops the process, or disables the account, then tells you what it did.

What good looks like: A written list of actions the provider takes without asking, a clear approval process for the rest, and a plain answer on whether remediation is included.

Red flag: "We'll notify you immediately," with no mention of containment.

3. Detection quality: who investigates, and how much noise reaches you?

Every SOC generates alerts. What counts is how many reach you, how many were real, and who decided. Ask how the provider keeps noise down, because a flood of false positives causes your team to ignore the one that matters.

What good looks like: A described triage process, a way to measure noise (alerts versus confirmed incidents), and an example of a detection that changed after a false positive.

Red flag: "Our AI handles it," with nothing about who reviews what the AI decides.

4. People: who's on shift at 3 a.m.?

The overnight queue is where weak providers show their seams. Ask whether analysts are working the shift or carrying a pager, how they escalate when the first analyst is stuck, and what experience the people on your account bring.

What good looks like: Staffed shifts around the clock, a documented escalation path, and a straight answer about analyst qualifications.

Red flag: Overnight coverage that turns out to be an on-call rotation, or a vendor that won't say who works nights.

5. Response time: what starts the clock?

A "15-minute response" means nothing until you know time zero. It could start at ticket creation, analyst assignment, or a confirmed threat, and "response" might mean an acknowledgment or an actual containment.

What good looks like: Definitions for each severity level, plus real numbers from the last 90 days instead of targets.

Red flag: A speed claim with no definition behind it.

6. Fit with your stack

Your EDR, identity provider, and firewall all feed into the SOC, and a provider that can't work with them creates more work for your team instead of protecting it. Ask how long deployment takes and which of your existing tools you get to keep.

What good looks like: A clear integration list, a realistic deployment timeline, and no forced replacement of tools that work.

Red flag: A requirement to rip out recent purchases without a technical reason.

7. Reporting and compliance support

You'll need to show the SOC's work to executives, auditors, and insurers. The incident report is the most important artifact: Make sure it shows a timeline, the actions taken, who approved them, and the evidence behind it.

What good looks like: A sample incident report from a real engagement (sanitized), a sample recurring report, and a clear map to the frameworks you answer to.

Red flag: Reporting that amounts to a dashboard login, or a refusal to show a sample.

8. Pricing and contract terms

Pricing models vary by endpoint, user, or data volume, and the surprises hide in the fine print: onboarding fees, data overage charges, minimum commitments, incident response retainers, and auto-renewal clauses.

What good looks like: A fully itemized quote, clear exit terms, and a way to export your data if you leave.

Red flag: Volume-based pricing with no cap, or separate fees for responding to an actual incident.

Ask these on every call and in every RFP so the answers are comparable side by side. Copy the list into your notes and fill in what each vendor says.

Coverage and tools

• Which of our data sources are in scope, and which aren't?
• What do you deploy on our systems, and how long does rollout take?
• Which of our existing tools do you integrate with, and which would you ask us to replace?
• How do you find out when a source quietly stops sending data?

Detection and response

• What can you do without asking us first, and what needs our approval?
• Is remediation included, and what exactly does it cover?
• Who investigates an alert: an analyst, automation, or both, and who signs off on the call?
• How do you cut false positives, and can you show a recent example?
• Do you hunt for threats on your own, or only respond to alerts? What does that look like week to week?

People and process

• Who works the overnight and weekend shifts, and how are those shifts staffed?
• What happens when the first analyst can't resolve something?
• How do you handle a major incident that needs more than the usual response?
• Will we have a named contact, and how fast can we reach a human?

Speed and reporting

• What starts your response clock, and what stops it, at each severity level?
• What were your actual median times over the last 90 days?
• Can we see a sanitized incident report from a real engagement?
• What recurring reports do we get, and who are they written for?

Compliance and data

• Which frameworks do you support, and how do you help us produce audit evidence?
• Where is our data stored, and how long do you keep it?
• What happens to our data if we leave?
• How do you protect your own access to our environment?

Commercial terms

• What does the price include, and what costs extra?
• What are the minimums, renewal terms, and exit terms?
• Can we run a trial or proof of concept before we commit?
• Can you connect us with a customer our size?

Listen for specifics. A provider who answers with names, numbers, and examples has done this before, and one who answers with adjectives probably hasn't.

Most bad SOC decisions are preceded by warning signs during the sales process. Watch for these while you're still free to walk away.

• They won't name what they don't cover. Every environment has gaps, and a provider who says "everything" either hasn't looked or won't tell you.
• Nobody can say who works the night shift. If the answer shifts between "our team" and "on-call," you've learned how overnight actually works.
• The response time has no definition. A fast number with no starting point is marketing.
• The demo is all dashboard and no incident. Ask for a walkthrough of one real investigation, with timestamps, from first alert to closure.
• AI is the whole answer. Automation speeds up triage, and that's useful. You still need to know which decisions a human reviews.
• There's no sample report. A provider who does this work every day has anonymized incident reports to show you.
• The price moves. Quotes that change after the demo, or fees that appear in the contract, predict how billing will go later.
• They resist a trial. A provider confident in the service will let you test it on your own environment.
• Every reference looks nothing like you. Ask for a customer near your size and industry, and talk to them without the salesperson on the line.

One red flag is a conversation. Two is a pattern.

Take these questions into your next provider call, and ask them of us too. You can start a free trial to see the Huntress SOC work in your own environment, or book a demo.