SOC Configuration
Adjust the number of clients per tier to see the real-time impact on headcount and savings. Each tier has different staffing ratios — Enterprise clients require ~5× more analysts than SMB.
~700 MB/mo · Low complexity
~5 GB/mo · Medium complexity
~25 GB/mo · High complexity
Who is available 24/7 vs. business hours only?
How are complex incidents handled?
Each additional platform adds ~30% to Security Engineer, Lab, and PS headcount. Consolidating on Cyrebro eliminates this multiplier.
Total Data Volume
Enter the total data volume ingested across all clients. You can enter in EPS, GB/month, or TB/month — all three are shown after input.
Converted Values
Personnel & Headcount
⚠️ Note: HR costs and employee retention costs are not included in this model. These can add 15–25% to total personnel cost and should be considered in addition to the figures below.
Headcount is auto-calculated from your client count and configuration. All values are editable. Salaries are fully-loaded (base + 30% benefits burden). Sources: D3 Security (2026), SANS SOC Survey 2019, Cyrebro operational data.
| Role | Legacy FTEs | Cyrebro FTEs | Cost / FTE / yr | Legacy Total | Cyrebro Total | Savings / yr |
|---|---|---|---|---|---|---|
Tier 1 Analysts 1 FTE per 5 clients (24/7 model). Min 4. Source: D3 Security (2026), Quora SOC community (2024). | auto | $ | $800K | $0 | +$800K | |
Tier 2 Analysts ~40% of T1 count. Min 2. Source: Industry consensus; ConnectWise SOC tiers guide. | auto | $ | $380K | $95K | +$285K | |
Tier 3 / Threat Hunters 1 FTE per 25 clients (legacy SOC). Min 1. Cyrebro: 1 per 60 clients. Source: Cyrebro operational data. | auto | $ | $270K | $135K | +$135K | |
SOC Manager 1 FTE per 50 clients. Min 1. Source: SANS SOC Survey 2019. | auto | $ | $150K | $150K | $0 | |
Security Engineers 1 FTE per 25 clients × SIEM multiplier (×1.3 for 2 platforms, ×1.6 for 3+). Source: Cyrebro ops data. | auto | $ | $250K | $0 | +$250K | |
Lab Engineers 1 FTE per 25 clients × SIEM multiplier. Source: Cyrebro ops data. | auto | $ | $270K | $0 | +$270K | |
Professional Services 1 FTE per 50 clients × SIEM multiplier. Source: Cyrebro ops data. | auto | $ | $150K | $0 | +$150K | |
Technical Support 1 FTE per 20 clients. Source: Cyrebro ops data. | auto | $ | $240K | $0 | +$240K | |
Internal IT 1 FTE per 50 clients. Source: General IT staffing benchmarks. | auto | $ | $80K | $0 | +$80K | |
| Total Personnel | $2.6M | $380K | +$2.2M | |||
Technology Costs
SIEM cost is auto-calculated from your data volume using blended MSSP rates. All other costs are editable. With Cyrebro, all technology costs go to $0 — SIEM is replaced by the Cyrebro MDR platform fee, and all other tools (SOAR, threat intel, ticketing, infrastructure) are bundled into the MDR subscription.
| Item | Legacy / yr | With Cyrebro / yr |
|---|---|---|
SIEM / Log Management auto-calculated from volume | $ | $1.3M |
Infrastructure & Hosting | $ | $0 |
SOAR Platform | $ | $0 |
Threat Intelligence Feeds | $ | $0 |
Ticketing / Case Management | $ | $0 |
| Total Technology | $875K | $1.3M |
Facilities & Operations
SOC Facility Lease, Compliance Audits, and Cyber Liability Insurance are unchanged — these are fixed business costs. Staff Training & Certifications reduces with headcount (85% in steady state). 3rd-Party Experts & Tool Maintenance goes to $0 — fully replaced by Cyrebro MDR.
| Item | Legacy / yr | With Cyrebro / yr |
|---|---|---|
SOC Facility Lease | $ | $75K |
Staff Training & Certifications | $ | $6K |
Compliance Audits | $ | $45K |
Cyber Liability Insurance | $ | $30K |
3rd-Party Experts & Tool Maintenance | $ | $0 |
| Total Ops | $440K | $156K |
Cyrebro MDR Pricing
Cyrebro MDR is priced at $36,000 per TB/month per year. The total is auto-calculated from your data volume. Override the TB/month value or the rate if you have a specific quote.
Cyrebro Platform Cost