Security Operations Center Platform Development: Build vs Buy

What Splunk, Sentinel, QRadar and Tines actually do well

Say the unpopular part first. If you run a security operations center (SOC) with three analysts, one estate and one detection platform, do not commission software. Buy Microsoft Sentinel if you are a Microsoft shop, Elastic Security if you want to control your own storage costs, and spend the budget on detection engineering instead. You will get more security per dollar from better rules than from a better console, and we have told teams exactly that and lost the work.

Splunk Enterprise Security, Sentinel, IBM QRadar, Google SecOps and Elastic Security are search and correlation engines operating at volumes that took years to make reliable. Nobody sensible rebuilds ingestion, indexing or historical hunting. CrowdStrike Falcon and Microsoft Defender produce detections of real quality on the endpoint. On the automation side, Cortex XSOAR, Swimlane and Tines are all capable, and Tines in particular is pleasant to work in for enrichment and containment flows that you can describe precisely. TheHive gives you open source case management if your requirements are modest, and Shuffle covers similar ground for automation.

Be fair about where the value sits, too. These vendors maintain parsers for hundreds of log sources, keep pace with cloud provider schema changes, and carry a detection content library you would otherwise write and maintain yourself. That is genuine engineering and it is worth paying for.

The honest limit is the layer between them. A SIEM's case management is a byproduct of its detection engine, so it models an alert precisely and an investigation loosely. It has no opinion about which of your assets matter, because asset criticality is business context nobody can ship you. And an automation platform executes the steps you can already write down, which excludes most triage, where the decision is judgement rather than a branch.

Where they stop: three alerts, one story, no shared identity

Tuesday, 02:10. An endpoint console shows suspicious PowerShell on a laptop. The identity provider shows a sign-in from a new country for what may be the same person, except one tool calls the account jsmith and the other calls it john.smith@company.com and nothing joins them. The mail gateway holds a quarantined message that might be the delivery vector. The asset record, which is a wiki page, says the laptop belongs to someone who left in March. The analyst writes four lines in a ticket and closes it as benign at 02:40.

Eleven days later the same detection fires on a different host, and a different analyst spends the same forty minutes reaching the same conclusion, because the first analyst's reasoning went into a free text field nobody searches. That is the real cost center in a SOC. Not licences, not storage. Analyst attention spent re-deriving conclusions the team already reached.

Three specific things generic products handle badly. Identity resolution, because until an entity can absorb jsmith, the email address, the hostname, the serial number, the endpoint agent identifier and the cloud instance identifier as aliases of one thing, three alerts from three tools stay three rows. Asset criticality, because a domain controller, a payment host and a designer's laptop are three different conversations and no vendor knows which is which in your estate. And institutional memory, meaning structured dispositions rather than a text box, so an analyst can see that this detection has fired eleven times, was benign nine times, and that both true positives shared a specific parent process.

There is a commercial dimension too. Every one of these platforms would prefer to be the center of your operation, and most of them are priced on ingestion volume. Owning the workflow layer means you can change detection vendors without abandoning five years of investigative history, and per-gigabyte pricing moves.

The arithmetic: cost per analyst versus cost per gigabyte

Two different units are in play and confusing them is how these business cases go wrong. Detection is priced per gigabyte ingested per day. Your build is priced against analyst hours. Do not put them in the same column.

Work the analyst side with your own numbers. Twelve analysts across three shifts at $110,000 fully loaded is $1.32 million a year. A ten percent improvement in throughput, which is what removing repeat investigation and console pivoting actually delivers, is worth $132,000 a year. Against that, a $350,000 phased platform amortised over five years is $70,000, and support at 15 to 20 percent adds around $60,000. Call it $130,000 a year.

That puts the crossover at roughly ten to twelve analysts. Below it, the throughput saving does not cover the build and you should spend the money on detection content or on a managed detection and response provider. Above it, every additional analyst makes the build cheaper per head while a per-seat case management product gets more expensive.

The second crossover is not a headcount at all. It is four detection vendors with no shared identity. At three tools an analyst holds the mapping in their head. At five they cannot, and the correlation you are paying people to do by hand is a database join you could have written once.

Leave the ingestion bill alone in this calculation. If your storage cost is the problem, the answer is tiering and filtering at the collector, not a custom platform.

What a custom SOC platform actually costs

From Digital Heroes delivery experience across more than 2,000 projects, a first release covering entity resolution, alert ingestion from your top three or four detection sources, case management with structured dispositions and a basic playbook engine runs $90,000 to $180,000 and ships in 14 to 20 weeks. That is a system analysts run a shift in, not a prototype. A full platform adding the complete playbook library, automated containment with approval and rollback, asset criticality integration, retention rules by case type, metrics and a threat intelligence layer runs $250,000 to $600,000 phased over 9 to 15 months.

Data migration runs 10 to 25 percent of the build. Importing closed cases from a ticketing system is cheap. Making them useful is not, because free text dispositions have to be classified before similarity search does anything, and that is a genuine piece of work usually done semi-automatically with analyst review.

Year two runs 15 to 20 percent of build cost annually. It pays for detection vendor schema changes, which arrive whenever a vendor updates its own product, new tool integrations, and the playbook library being revised as your escalation rules change.

What pushes the number up here: the number of detection tools, since each has its own interface, rate limits and idea of what an alert is. Containment actions, because isolating a host touches production and needs approval flow, blast radius checks and an undo. Multi-region data residency where security telemetry cannot cross a border. And classification handling in government or defense environments, which changes the architecture rather than adding a feature.

The four situations where building wins

• Regulatory fit. If you carry reporting clocks, the case record is the evidence. Item 1.05 of Form 8-K requires disclosure within four business days of determining a cybersecurity incident is material. NIS2 sets a 24-hour early warning and a 72-hour notification. Article 33 of the GDPR sets 72 hours for personal data breaches, and DORA adds its own reporting for major information and communication technology incidents. A clock that starts on a defined event and escalates by itself is a build feature, not a template.
• Scale economics. Past roughly ten to twelve analysts, the throughput gain from removing repeat investigation exceeds an amortised build, and per-seat case tooling grows with the team while the build does not.
• A workflow that is your competitive advantage. A phishing playbook in a bank with a fraud desk escalates differently from one in a manufacturer where the same mail lands on an engineering workstation attached to a plant network. Out of hours authority, who may isolate a production host, when legal is told: none of that is generic, and a vendor template actively gets in the way.
• Integration sprawl across three or more systems. Endpoint detection, identity provider, mail gateway, cloud posture, a configuration management database and a ticketing system all describing the same laptop. Once four or more tools name the same entity differently, the analyst joining them by hand is your correlation engine.

How to decide in a week, with last month's closed cases

Monday, export every case closed last month. Group them by detection rule and count how many rules produced more than five cases that all closed with the same disposition. That number is your repeat-investigation bill, and it is usually larger than anyone on the team expects.

Tuesday, take five of those cases and try to answer one question from the records alone: what was the reasoning that closed the first one. If the answer is in a free text field or in somebody's memory, you have the institutional memory problem and no product will fix it, because no product owns your history.

Wednesday, pick one real incident and list every console an analyst opened. Then count how many distinct names the same user and the same host carried across those consoles. Four or more names is the identity resolution problem stated as a number.

Thursday, put the same three exercises to every developer on your shortlist. Ask specifically how they resolve identity, and expect alias tables, confidence scoring and a manual merge path for ambiguous cases. Ask what happens when a misconfigured rule produces two hundred thousand events in an hour, because it will, and listen for backpressure, deduplication and a way to suppress a noisy detection without deploying code. Then ask about containment, because anyone can call an isolate endpoint and fewer people design the approval and the undo.

Friday, run the per-analyst arithmetic against the repeat-case count and decide. If it points to build, start with a paid discovery whose deliverable is a signed product requirements document covering the entity model, the case schema with dispositions, the playbook and escalation design and acceptance criteria. At Digital Heroes no code is written before that is signed, and the document is yours whichever way you go.

We are wrong for you if what you need is detection content, because that is a detection engineering engagement and not a software one. We are also wrong if you have no security engineer who can own the platform after handover, since a SOC tool nobody maintains decays inside a year. Where we fit: more than fifty specialists, over 2,000 delivered projects, our own products including ShopScore, HeroCheckout and Section Vault, and India LLP, US LLC and UK LTD entities so intellectual property assigns under your own law. You meet the named team before signing, and our record is checkable on Clutch, Trustpilot, Fiverr Vetted Pro and our D-U-N-S listing.

Book a 30-minute call with Digital Heroes and get a written plan and a fixed quote within 48 hours.