Managed detection and response: when it beats building an in-house SOC

"Let's build our own SOC" is a phrase that sounds great in a budget presentation and breaks down in operational reality. Real 24x7 coverage requires at least three shifts of analysts, every single day of the year, plus a senior team to escalate the cases that require judgment. Most Brazilian companies — including many with a meaningful security budget — simply don't have the scale to sustain that efficiently.

That doesn't mean outsourcing is always the right answer. It means the decision between building an in-house SOC and buying MDR (managed detection and response) should be made with explicit criteria, not by market default or fear of losing control.

The real cost of a 24x7 in-house SOC

The number that shows up in a budget proposal usually covers tooling and maybe two or three analysts — not full shift coverage, on-call rotation, continuous training, and above all retention. Turnover on security teams runs structurally higher than in other technical roles, and every senior analyst who leaves takes institutional knowledge with them that lives nowhere else.

On top of that, the cost of keeping multiple detection tools integrated and up to date falls entirely on the internal team — and that's exactly the kind of operational work MDR is designed to absorb.

What MDR actually delivers, and what it doesn't

A good MDR provider delivers continuous monitoring, alert triage, proactive threat hunting, and in many contracts, automated initial containment — all running on the provider's own team and tooling, not the client's. What it doesn't deliver is deep business knowledge: deciding whether isolating a specific server halts a critical operation requires internal context, not just technical skill.

That's why well-contracted MDR never fully eliminates the need for an internal point of contact with decision authority — it drastically cuts the volume of operational work that point of contact has to handle alone.

The criteria that actually decide between building and outsourcing

Three questions carry most of the decision: what's the real event volume that justifies 24x7 human presence (small companies rarely reach that bar), is security a core competitive differentiator or a support function (banks and fintechs tend to bring more in-house; most other sectors don't need to), and is there budget to sustain senior-team turnover for several years straight, not just the first one.

None of these answers is universal — the same reason a bank builds its own SOC can be exactly what leads a similarly sized retailer to outsource instead and put its internal team on something else.

The hybrid model is what shows up most in practice

Most companies that are mature about this decision don't pick an extreme — they combine MDR for 24x7 coverage and volume triage with a lean internal team responsible for business decisions, critical incident response, and the provider relationship. That model captures the best of both: the practical cost of outsourced operations, with business judgment kept in-house.

Questions to ask before signing an MDR contract

It's worth demanding clarity on four points before closing: the real SLA for time between detection and notification (not generic "response," the exact number), what the provider resolves autonomously versus what always escalates to the client, who owns the collected telemetry and whether it's portable if you switch providers, and how the transition works if the relationship ends. The same vendor evaluation criteria that apply to any other security category apply here — MDR isn't exempt just because it looks like a commodity.

Decide by capacity, not ideology

Neither "outsource everything" nor "build everything in-house" is a default answer — both only make sense after mapping real volume, business criticality, and sustainable mid-term budget. UNIQ helps clients reach that criterion before signing any MDR contract, within the Intelligence & Response architecture that fits the actual size and maturity of each operation.