SIEM vs MDR TCO – PoCLAB Cost Studio

PoCLAB Cost Studio

SIEM vs MDR TCO calculator

Inputs & Assumptions

SIEM + SOC vs MDR – TCO model

Compare an in-house SIEM + SOC against a Managed Detection & Response (MDR) service across your endpoints, including ingest licensing, infrastructure, and analyst FTEs.

In-house SIEM + SOC

MDR / XDR provider

Includes ingest GB/day and FTEs

Endpoints e.g. 5,000 endpoints

Time horizon (years) 3–7 typical

In-House SIEM Model

Log volume / endpoint / day (GB) avg GB/day per endpoint

SIEM price ($ per GB/day per month) licensing metric

SIEM infra OPEX / year ($) storage, compute, platform

SIEM ops FTE count engineering + content

MDR Model

MDR / endpoint / month ($) MDR/XDR subscription

MDR setup / year ($) onboarding, tuning

MDR ops FTE count internal liaison / tuning

Ops Cost (Shared)

Ops cost / FTE / year ($) fully loaded analyst / engineer

5-Year TCO Comparison

In-house SIEM SIEM + SOC

$0 / endpoint / month

MDR Managed detection

$0 / endpoint / month

Relative 5-Year TCO –

💡

MDR is neutral vs. SIEM in this model.

Adjust ingest, FTE and MDR price assumptions to explore upside.

MDR price break-even vs SIEM ($ per endpoint / month)

Adjust assumptions to see the MDR price break-even curve.

All values are directional only. This calculator is designed to compare architectures rather than provide a formal quote. Tune inputs to match your contracts (log volume tiers, MDR pricing, staffing model, etc.).