Insourcing the SOC vs subscribing to one

The honest framing for a security operations function at twenty engineers is that the choice is rarely between two products on a shelf. It is between two costs that scale differently, two headcount shapes that read differently on the org chart, and two on-call pockets that read differently on a founder’s calendar. Below is the side-by-side, told in plain English across the four dimensions a lean team actually weighs.

Cost

An in-house security analyst carries a fully-loaded annual cost that lives well above the number on the offer letter. Recruiter fee, base salary, payroll burden, an EDR plus SIEM seat bundle, the on-call premium a lean rotation has to pay to be tolerable, and the half-time of a senior engineer who reviews the new hire’s first month. The conservative range for a single US-based junior-to-mid analyst in a market with real competition for talent is one hundred and forty to one hundred and eighty thousand fully loaded, and the cost of two analysts — the floor for after-hours coverage that anyone would call sane — doubles the line. To that you add forty to eighty thousand in tooling per analyst that the team owns and renews: log retention, an EDR, an identity-platform seat bundle, an MSSP data feed. The annual line for a two-analyst in-house function lands before incentives at roughly three hundred and eighty to five hundred and twenty thousand dollars.

A per-seat subscription lands the same coverage at line items a CFO can compare on a single row of a spreadsheet. Crowmark’s per-seat pricing — Bronze at forty-nine dollars, Silver at ninety-nine, Gold at one hundred and ninety-nine — measures the humans covered, not the laptops or cloud accounts watched. A twenty-person team on Silver runs under twenty-four thousand dollars for the year. The same team on Gold runs under forty-eight thousand. Both numbers sit below one junior analyst’s fully-loaded cost and below the tooling burden a lean team would carry even if the analyst did not.

Headcount

The org chart for insourcing is one or two more full-time roles added to engineering — sometimes reporting to engineering, sometimes to ops, occasionally to a founder who has personally shouldered the queue long enough to want a named successor. The reality at twenty engineers is that the new role rarely reports to engineering: the team’s velocity does not absorb a queue-sitting peer who is not shipping, and the new analyst’s review path is structurally simpler with a stretch assignment outside the engineering ladder. The org-shape consequence is that the team is now running a function that needs its own manager track, its own feedback loops, and its own backlog grooming — for one or two people, in an org that grew to forty to ship a product, not to staff a SOC.

A subscription adds zero headcount. The morning brief lands at seven a.m. with three sections; the requests for sign-off route to whoever in the founder’s calendar already approves expense reports. The team ships on a Tuesday morning without adding a queue-sitting peer who isn’t on the product side. Same coverage, no org chart, no new manager track, no named successor who is one offer letter away from leaving for a bigger role.

Time-to-value

An analyst’s first productive week is rarely productive. The first two weeks are onboarding. The third week is the analytics environment becoming navigable. The fourth through eighth week is the analyst getting faster than the senior engineer who has been holding the queue in their peripheral vision. The credible time-to-value for a single in-house hire is three to six months, with the longer end of that range closer to the truth for a lean org whose context the analyst has to learn — the property that connects the billing service over a private VPC link, the manual on the dark-web watchlist that lives in finance’s shared inbox, the AWS account structure that grew from a single dev org to four sub-orgs at the last budget review.

A subscription is not a hire. The Monday-equivalent onboarding for a ten-to-forty person team is two integrations wired before lunch and a brief in the inbox the next weekday morning. The time-to-value is the time it takes to walk through an SSO claim and a cloud org, minus the time it takes a recruiter to call back. The first brief lands on day two, not in month four.

After-hours coverage

One analyst means one human pocket. If the queue fires after eleven p.m. on a Friday, the on-call rota is one person, and the brief holds until Monday. Two analysts covers most weekends at the cost of one of the two engineers being on rota every third weekend — a load on retention that a ten-person engineering org rarely measures in isolation. Either way, the seconds between a Friday-night pager and a Monday-morning postmortem are the seconds the attacker has.

A subscription is always-on. Auto-containment runs across the indicator-of-compromise egress, the malicious destination, and the expiring access token without a screen on a human’s desk. The weekend coverage question stops being a question because the analytics pocket is closed before the team wakes up on Monday. The evening brief is the version of that coverage a lean team can audit the next morning without paging anyone.

The right answer, told plainly

The shape of the right answer for a ten-to-forty person company is rarely “hire an analyst” and rarely “cancel the queue and hope.” The shape is that the team has to be shippable at scale without a queue-sitting peer, the after-hours coverage has to be a property of the system rather than a property of whoever is on rota this weekend, and the morning brief has to be the deliverable. A subscription is the version of that answer at per-seat pricing a lean team can run as a monthly line item. An in-house function is a different answer — a stronger one for an org past four hundred employees with a dedicated security org, a weaker one for the lean band the rest of the site speaks to.

The arithmetic above is the version a CFO and a CTO can run against each other on a single page. The decision is not a preference; it is a function of org size, time-to-coverage, and what the on-call rota is allowed to cost on the founder’s calendar. For a lean team in the band the founder notes in the twelve-to-forty read live in, the subscription is the version of the answer that closes the headcount and weekend questions in the same line.

The companion read on the vendor-bought alternative to building in-house — a managed detection and response engagement instead of an insourced SOC — runs the per-seat vs per-endpoint math, the onboarding window, the integration footprint, the false-positive model, and the morning-brief-vs-ticket-queue shape on the /vs/traditional-mdr side-by-side.