Managed Detection and Response (MDR) for SMEs: MSP vs MSSP vs In-House SOC

If you are a small or mid-sized business getting serious about detection and response today, you quickly find yourself lost in a forest of acronyms: MSP, MSSP, MDR, SOC-as-a-Service, XDR, SIEM. In sales conversations they sound interchangeable, but they deliver fundamentally different services at very different costs. In this article we explain which service models exist, what they actually cost in 2026 and which option suits which kind of Dutch SME. For a detailed explanation of how outsourcing a SOC works in itself, see our article on outsourcing your SOC and managed detection and response.

The four service models at a glance

In practice, SMEs weigh up four service models.

1. MSP (Managed Service Provider). Runs your IT: endpoints, network, backup, patch management, helpdesk. Security comes with it as a baseline layer (antivirus, patches, some firewall settings), but 24/7 detection is not a core activity.
2. MSSP (Managed Security Service Provider). Delivers deeper security services: threat detection, threat hunting, vulnerability assessments, incident response and compliance support. Often runs its own SOC, with analysts who see attack patterns every day.
3. MDR (Managed Detection & Response). A specific service focused on detecting and stopping threats. MDR is usually endpoint-centric (via EDR/XDR), monitored 24/7 by people, with concrete containment actions when an incident occurs. It is offered both by pure-play MDR vendors and by MSSPs.
4. In-house SOC. Your own 24/7 team of security analysts, tooling and processes. In theory it gives you the most control; in practice it is almost never affordable for an SME.

It is important to understand that MDR is a SERVICE, while MSSP is a PROVIDER MODEL. An MSSP can offer MDR, plus other services such as log management, network monitoring and compliance reporting. If you buy "MDR" alone from a pure-play vendor, you often get fast response to endpoint threats, but not a broad security programme.

What an MSP does and doesn't do for your security

The typical Dutch MSP delivers excellent operational hygiene: centralised device management through Intune, MFA on every account, automated patch management, backup monitoring and a helpdesk. For 70 to 90% of an SME's security baseline, that is the most important layer.

What an MSP without a security team does not provide is 24/7 monitoring for active attacks, threat hunting and rapid containment. If an attacker gets in with a stolen password and starts deploying ransomware at 02:15 on a Saturday, an MSP helpdesk often won't be there for you until Monday morning. That is a fundamental difference.

For many SMEs the logical route is to get the basics right first with a managed IT partner, then add a detection layer on top, often from the same provider if it offers MDR services.

MSSP and MDR: the security specialists

MSSPs are set up to correlate attack patterns across many customers and respond quickly. They work with SIEM tooling, EDR/XDR on endpoints, threat intelligence feeds and a team that responds to alerts in a standardised way. You can read more about that provider model in our overview of what an MSSP actually is.

MDR services within an MSSP watch endpoints, cloud and network. When an incident is confirmed, they can isolate devices, kill processes and block accounts without you first having to spend 40 minutes on the phone explaining what is going on. For a broader explanation of endpoint detection, see what EDR actually is.

In-house SOC: great in theory, unworkable for SMEs in practice

An in-house SOC with full 24/7 coverage needs at least 5 to 7 FTE of security analysts to guarantee continuous cover (three shifts, plus holiday and sick leave). In the Netherlands, a SOC analyst's gross annual salary sits somewhere between €50,000 and €90,000, rising to €120,000 for senior or tier-3 roles in the Randstad. Add the cost of SIEM, EDR and SOAR tooling, threat intelligence, training and retention, and you quickly reach an annual budget of $1.5 to $3 million for a SOC that merely functions at a basic level.

For an SME with 50 to 250 employees, that is simply out of all proportion. Even for organisations with 500 employees the maths usually favours outsourcing, unless you operate in a heavily regulated sector where other reasons force you to keep it in-house.

What is realistic for a larger SME is a co-managed or hybrid model: 1 to 2 in-house security people for business context and policy work, with 24/7 monitoring and tier-1 triage handled externally by an MDR provider. In 2026 this is the fastest-growing deployment pattern.

What does it cost in 2026?

The prices below are in US dollars; European rates are usually comparable in euros.

MSP (without a separate security layer) Basic managed IT with patch management, backup, helpdesk and device management: $100 to $250 per user per month.

MDR (per endpoint or per user)

• Entry level (24/7 monitoring, alert triage, basic containment): $8 to $25 per endpoint per month.
• Full service with response (containment, forensics, remediation guidance): $25 to $50 per endpoint per month.
• Premium with a dedicated analyst and threat hunting: $50 to $100+ per endpoint per month.

Some concrete examples: Huntress Managed EDR starts at around $9 per endpoint per month including a 24/7 SOC. Sophos MDR and SentinelOne range between $7 and $25 per endpoint per month. Arctic Wolf, with its named-team model, sits higher, starting at around $44,000 a year at entry level and 30 to 60% above pooled-SOC vendors. CrowdStrike Falcon Complete comes in at around $25 to $45 per endpoint per month. For a small business with 25 to 75 endpoints, the MDR bill typically lands at $1,500 to $5,000 per month.

Full MSSP services (per organisation per month)

• Small businesses (25-100 employees): $2,000 to $5,000 per month.
• Mid-market (100-500): $5,000 to $20,000 per month.
• Enterprise (500+): $20,000 and up.

An MSP that credibly delivers security services is often priced close to MSSP rates, between $150 and $300 per user per month.

In-house SOC (indicative) Year-one total of $1.5 to $3.3 million (staff plus tooling and infrastructure). Recurring costs of $1.2 to $2 million per year.

Which model suits which SME?

Here is a pragmatic decision framework based on size and risk profile.

Fewer than 25 employees, standard SME. A good MSP with a Microsoft 365 foundation, Intune, MFA and backup covers 80% of your risk. Consider lightweight MDR (Huntress-style solutions) if you handle sensitive customer data or your cyber insurance requires it.

25 to 100 employees. Invest in an MSP that offers MDR services through a pooled SOC. Budget €200 to €400 per user per month all-in for IT plus MDR. You get 24/7 detection, containment and incident support that an in-house team can't match.

100 to 500 employees, regulated. An MSSP with a dedicated MDR service, plus 1 to 3 in-house security people for policy and business context. Budget €5,000 to €20,000 per month for the external part. Add a co-managed SIEM if you want to manage your logs yourself.

500+ employees, high threat level. A hybrid model: in-house tier 2/tier 3 for business context, an external provider for tier-1 triage and 24/7 coverage. Going fully in-house is rarely justifiable unless regulation demands it.

The NIS2 context: why detection is enforceable in 2026

Since 15 August 2026, the Dutch Cybersecurity Act (Cyberbeveiligingswet) has been actively enforcing the NIS2 obligations. For essential entities, fines can reach €10 million or 2% of global turnover; for important entities, up to €7 million or 1.4%. Directors can be held personally liable for negligence, with temporary bans from holding management positions as an option.

The incident reporting obligation is tight: an initial notification within 24 hours, an interim report within 72 hours and a final report within one month. Without detection and response capability, you will not meet those deadlines. There is more context in our overview of NIS2 compliance in the Netherlands. For SMEs that fall under NIS2 (or are affected indirectly through the supply chain), a demonstrable MDR or MSSP relationship is no longer a luxury but an expectation from regulators, insurers and enterprise customers alike.

Pitfalls when outsourcing security

In our own managed cyber security practice, we see the same mistakes come up again and again.

• Buying MDR without an EDR foundation. Some providers require their own EDR tool, others work with what you already have. Check this up front, because licence costs for Defender for Endpoint, CrowdStrike or SentinelOne can add up quickly.
• A contract without a response commitment. Receiving alerts is not the same as getting help. Make sure the contract explicitly states what the provider will do itself during an incident (isolate devices, kill processes, block accounts).
• A vague SLA on response times. "Best effort" is not an SLA. Ask for concrete MTTA and MTTR targets backed by penalty clauses.
• Endpoint-only coverage. MDR that only looks at endpoints misses what happens in the cloud and at network level. Most SMEs also need detection on Microsoft 365 (identities, mail forwarding rules) and the network.
• No periodic review. Test every quarter with a tabletop exercise or simulated attack to check whether the provider really delivers what the contract promises.

Frequently asked questions about MDR, MSSP and in-house SOCs for SMEs

What is the practical difference between an MSP with security and an MSSP? An MSP provides IT management with security as a baseline layer; an MSSP is primarily a security organisation built around a 24/7 SOC, an analyst team and threat intelligence. If what you mainly want is to outsource operational IT, with security as an essential baseline, an MSP is the right fit. If you need active detection and fast response, choose an MSSP or an MSP that can demonstrably deliver MDR services.

Can an MSP without its own SOC still offer MDR? Yes. Many Dutch MSPs work with a pure-play MDR vendor (Huntress, Sophos, SentinelOne, Bitdefender) behind the scenes. For SMEs this is often the pragmatic route: you have a local IT partner you can talk to, while a specialist SOC in the background does the heavy detection work.

What does a basic MDR service cost for 50 workstations? Expect €500 to €1,500 per month for entry-level MDR (pooled SOC, endpoint focus, 24/7 monitoring, basic containment). Full MDR with response and cloud integration comes closer to €1,500 to €3,500 per month. Premium with a dedicated analyst is considerably more expensive. Combine that with your existing MSP contract to see the full picture.

Do I need both an MSSP and an MSP? Not necessarily. The trend in 2026 is for MSPs to build in security services (sometimes via an MSSP partner behind the scenes), so you have a single point of contact. For mid-market and enterprise-sized SMEs, the combination of MDR plus MSSP is common: MDR for endpoint detection, MSSP for a broad security programme and compliance reporting.

What if an incident happens at night and the provider is slow to respond? Ask about this explicitly before you sign the contract. Ask for MTTA and MTTR targets with penalty clauses, and for references from customers who have been through a real crisis. Test it every quarter with a simulated incident or tabletop exercise. Make sure you also have clear internal escalation protocols, because even the best provider needs input from your side.

When is an in-house SOC worth it after all? Almost never for a pure SME (up to 500 employees). From around 1,000 employees, in regulated sectors with specific sovereignty or business-context requirements, an in-house SOC becomes a realistic option. Even then, in 2026 we see hybrid models (in-house tier 2/3, external tier 1) more often than fully in-house 24/7 SOCs.

Conclusion

For SMEs in 2026, the choice between MSP, MSSP, MDR and an in-house SOC is rarely black and white. For the vast majority of Dutch SMEs, the pragmatic route is a strong MSP foundation for operational IT, complemented by an MDR service for 24/7 detection and response. A fully in-house SOC is financially out of reach for almost every SME and operationally unnecessary. More important than the model is that the service demonstrably delivers what you need: 24/7 human monitoring, fast containment, concrete SLA commitments and regular testing.

TRON Group delivers exactly this combination in the Netherlands: managed IT with integrated MDR, 24/7 detection through a pooled SOC with Dutch-speaking points of contact, and NIS2-ready reporting for regulators and insurers. Want to know whether your current detection set-up would stand up to a real attack or a NIS2 audit? Call us on +31 85 303 5869 or request a free, no-obligation security scan. We are happy to help, and honest about where your foundations stand.