MDR vs SOC vs SIEM: the definitive guide to choosing the right protection

What each one is — without the sales jargon

SIEM (Security Information and Event Management) is software for collecting, normalizing and correlating logs. It aggregates events from firewalls, endpoints, applications and cloud infrastructure, cross-references that information with rules and threat intelligence, and generates alerts. Tools like Splunk, Microsoft Sentinel and IBM QRadar are established market examples. On its own, the SIEM does not act: it's the instrument panel; someone has to fly the plane.

The SOC (Security Operations Center) is the operation — the team of analysts that monitors alerts, investigates incidents, triggers responses and continuously improves detection rules. A SOC can be in-house, outsourced (MSSP) or hybrid. The effectiveness of the SOC depends on the quality of the tools it operates and the maturity of its processes, documented in playbooks and integrated with SOAR (Security Orchestration, Automation and Response).

MDR (Managed Detection and Response) is a complete service: the provider delivers proprietary or licensed technology, a 24×7 team of analysts, threat intelligence and active containment capability — all in a single contract. The fundamental difference from a traditional MSSP is the response: MDR acts directly in the client's environment (isolating endpoints, blocking accounts) without depending on manual approval for each routine action.

XDR (Extended Detection and Response) is a platform-based evolution: it unifies telemetry from endpoint (EDR), network (NDR), cloud and identity into a single console with native correlation. It reduces investigation time by eliminating manual pivoting between tools. It can be operated internally or contracted as managed XDR (MXDR), which is, in practice, an MDR with an underlying XDR platform.

Comparison table: MDR vs SOC vs SIEM vs XDR

The table below compares the four approaches across the criteria that weigh most in the buying decision: | Criterion | SIEM | In-house SOC | MDR | XDR | |---|---|---|---|---| | **What it is** | Correlation tool | Team + processes | Managed service | Unified platform | | **Includes a team?** | No | Yes (your own) | Yes (the provider's) | No (or optional as MXDR) | | **Active response** | No | Yes | Yes | Depends on the operation | | **24×7 coverage** | N/A | Requires minimum scale | Included in the SLA | N/A | | **Time to value** | 3–6 months | 6–12 months | 2–8 weeks | 4–10 weeks | | **Estimated annual cost (BR)** | R$ 150k–800k (license) | R$ 1.2M–3M+ (total) | R$ 180k–900k | R$ 200k–1.2M | | **Maturity required** | High | High | Low to medium | Medium to high | | **Best for** | Mature SOC that wants telemetry | Companies with budget and retention | Companies without their own team | Teams with a visibility gap | *Cost ranges estimated from market benchmarks (Gartner, SANS 2024). Values vary by number of assets, log sources and contracted SLA.*

By maturity and size: who should buy what

Companies with up to 500 employees and no dedicated security team rarely manage to operate a SIEM effectively. The cost of a senior SOC analyst in Brazil ranges between R$ 8,000 and R$ 18,000 per month, and a 24×7 operation requires at least four overlapping shifts. For this profile, MDR is the rational choice: it externalizes the operational complexity and delivers a response SLA from month one.

Mid-sized companies (500–5,000 employees) with a structured IT team but no specialized security analysts find in MDR the fastest way to raise their defensive posture while developing internal capability. Some MDR providers offer co-managed models, where the internal team retains full visibility and can act alongside the outsourced SOC.

Large or regulated companies (banks, healthtechs, fintechs subject to LGPD with a high volume of sensitive data) with established security teams benefit from combining their own SIEM or XDR with a mature in-house SOC. In that case, MDR can be contracted for weekend and holiday coverage, or for specific niches such as detection in OT/ICS.

Startups and early-stage companies should prioritize basic controls (MFA, EDR, backup) before investing in a full SIEM or MDR. An MDR solution focused on endpoint and cloud, sized for the company's stage, delivers protection without compromising the runway.

Real cost ranges and what's included

The cost of a SIEM varies widely with the volume of data ingested (usually billed per GB/day or per events per second). Enterprise solutions like Splunk and QRadar start at R$ 200,000 per year for smaller deployments and can exceed R$ 1 million in complex environments. Microsoft Sentinel, being cloud-native and based on ingestion in Azure, can be more accessible for those already in the Microsoft ecosystem.

The total cost of ownership of an in-house SOC is systematically underestimated. Beyond salaries (4–6 analysts + 1 detection engineer + 1 coordinator), there are costs for SIEM licenses, threat intelligence feeds, SOAR, continuous training and certifications (GCIH, GCIA, CEH). SANS Institute benchmarks indicate that the total annual cost of a mid-sized in-house SOC in Brazil runs between R$ 1.5 million and R$ 3 million.

MDR is priced per number of monitored endpoints, per event volume, or per covered critical asset. In the Brazilian market, MDR services from global providers (CrowdStrike, SentinelOne, Arctic Wolf, Rapid7) range between R$ 150 and R$ 600 per endpoint/year, with minimum contracts that usually require at least 100–200 endpoints. Regional providers can offer more competitive ranges for mid-sized companies.

XDR, when licensed standalone (without the managed component), is priced per user or per endpoint, with values that compete with advanced endpoint protection suites. The real value emerges in the correlation: an environment with EDR + firewall + CASB + IdP managed separately can consolidate costs into XDR. As MXDR, the costs approach those of MDR.

Most common mistakes — and how to avoid them

The most frequent and most expensive mistake is buying a SIEM without planning who will operate it. Organizations acquire Splunk or Sentinel licenses, drawn in by the impressive dashboard in the demos, deploy the integrations and, months later, discover that alerts pile up untreated. An unoperated SIEM is worse than no SIEM: it creates a false sense of security and data that goes unanalyzed.

Another recurring mistake is contracting MDR on lowest price without assessing the real response coverage. Some providers sell 'MDR' but, in practice, deliver an MSSP with monitoring and ticket generation — no active response. When evaluating proposals, demand clarity on what the provider can do autonomously in your environment (endpoint isolation, account blocking, network containment) and what depends on manual approval.

Underestimating MTTD (Mean Time to Detect) and MTTC (Mean Time to Contain) is a risk-assessment mistake. A SIEM without 24×7 operation can take days for an alert to be investigated. The average cost of a ransomware incident in Brazil, according to CERT.br data and Ponemon Institute benchmarks, exceeds R$ 1 million once downtime, recovery and regulatory impact are considered. That number must enter the solution's ROI calculation.

Finally, treating the decision as permanent is a strategic error. Most companies that start with MDR migrate, partially or fully, to a hybrid model as they build an internal team. A good MDR provider offers full visibility into the investigations, fostering internal learning — not creating dependence.

How to evaluate providers: the criteria that matter

When evaluating an MDR provider, ask for the detection methodology: if it's based exclusively on static rules, coverage against novel threats is limited. Mature providers combine behavior-based detection (UEBA), proprietary threat intelligence and machine learning models to identify MITRE ATT&CK TTPs (Tactics, Techniques and Procedures) that have no known signature.

Check operational transparency. Does the provider deliver real-time visibility into investigations? Can you see the alerts, the hypotheses raised and the evidence collected? A quality MDR is not a black box: it's a service that accelerates the internal team's maturity by exposing the analysts' reasoning.

Assess environment coverage. Does your environment include cloud workloads (AWS, Azure, GCP), critical SaaS (Microsoft 365, Google Workspace, Salesforce), OT or IoT devices? Make sure the provider has native connectors and documented experience in those environments before signing.

Finally, require measurable SLAs: maximum MTTD per alert severity, MTTC for critical incidents and availability of the investigation portal. A 'best effort' SLA is not an SLA — it's a promise with no contractual penalty.

Key terms

SIEM

Security Information and Event Management — software for collecting, normalizing and correlating logs that generates alerts from security events. It does not act on its own; it requires an operational team to deliver value.

MDR

Managed Detection and Response — a managed service that combines detection technology (EDR, NDR, cloud telemetry) with a 24×7 team of analysts and active response capability in a single contract with a defined SLA.

MTTC

Mean Time to Contain — the average time between the detection of an incident and the moment the threat is contained or neutralized. It's the most relevant KPI for assessing the operational effectiveness of a SOC or MDR.

XDR

Extended Detection and Response — a platform that unifies telemetry from multiple vectors (endpoint, network, cloud, identity) with native correlation, reducing investigation time. It can be standalone or managed (MXDR).

How to decide and hire well

1. Map your current security team. Count how many dedicated security professionals you have, their seniority levels and availability. If the answer is zero or fewer than two, rule out SIEM and in-house SOC as first options.
2. Estimate your total budget — not just the license. Add up the license, deployment, training, support and personnel cost. Use the R$ 1.5M–3M range for an in-house SOC as a benchmark to compare against an equivalent MDR.
3. Assess your attack surface. Identify where your critical assets are: Windows/Mac endpoints, Linux servers, cloud workloads, SaaS applications, OT. An MDR provider should have native coverage for the environments you need to protect.
4. Define your acceptable response SLA. What is the maximum tolerable time between detecting a ransomware attack and the start of containment? If the answer is under 1 hour, MDR with autonomous response is practically mandatory. An in-house SOC without night coverage will not meet that SLA.
5. Request proofs of concept and industry references. Demand a PoC with your real data (or a representative lab environment) from at least two providers. Ask for references from clients in the same segment and size. Assess the sales team's response time as a proxy for the technical team's quality.
6. Evaluate the contractual SLAs with rigor. Read the MTTD and MTTC clauses. Check whether there are financial penalties for non-compliance or only 'best efforts.' Require monthly operational KPI reports as part of the contract.
7. Plan the evolution — don't buy forever. Decide whether the MDR or external SOC is a starting point while you build internal capability, or a permanent model. Make sure the contract allows portability of investigation data and does not create insurmountable technological lock-in.

Frequently asked questions

References

• ›Gartner Market Guide for Managed Detection and Response Services, 2024 — Market analysis with criteria for evaluating MDR providers, adoption trends and differentiation from traditional MSSPs.
• ›NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide — NIST reference guide for structuring incident response capability, the basis for SOC and MDR playbooks.
• ›SANS 2024 SOC Survey — People, Process, Technology — The SANS Institute's annual survey with benchmarks on cost, maturity, tools and operational challenges of SOCs around the world.
• ›MITRE ATT&CK Framework v15 — A knowledge base of adversary tactics and techniques used as the standard for assessing detection coverage in SIEM, MDR and XDR.