Comparing SOC providers: the neutral selection checklist

The questions are written so any serious provider, ANOMAL included, must answer them. When a provider dodges, that is the answer. For the broader context, this page sits under SOC as a Service Switzerland. Are you still deciding whether a SOC is the right building block? Start with Managed SOC or in-house and What is a SOC.

A provider that only sees endpoint telemetry cannot triage a cloud or identity attack. Check which sources are included by default and which cost extra.

• Endpoint (EDR or XDR), identity (Entra ID, Okta), cloud (M365, Google Workspace, AWS, Azure, GCP), network, SIEM, OT where relevant.
• Which sources sit in the base price and which are billed as add-ons?
• Are customer data processed in Switzerland or the EU? Ask for location and sub-processors in writing.
• Is customer-specific detection content maintained or only standard rules shipped?

Visibility without the authority to act is an alert forwarder. The contract must state which actions the provider may execute, which need customer approval, and how that approval is documented under pressure.

Marketing numbers on MTTD and MTTR are worthless without a reference point. A serious provider states target values per severity and delivers reports showing how often those values were met in recent quarters. For terminology see MTTD and MTTR in the SOC. For critical cases, ask for the contractual and the typical value separately.

• Are targets stated per severity (critical, high, medium) or only as averages?
• Is there a quarterly achievement report with values reached?
• How is the difference between a response target and a contractual SLA made transparent?
• At which escalation step is a named provider contact pulled in?

In an incident or audit, what is written down counts. Regulators, insurers and boards read logs. For regulatory triggers see FINMA requirements for the SOC and ISG reporting duty.

• Are detection, triage and response documented per incident (who, what, when) in a traceable way?
• Are the evidence artefacts exportable into a customer-controlled system (not just a portal view)?
• Does the evidence scope match insurer requirements (MFA for privileged accounts, documented response, notification deadline up to 72h)?
• Is there a process for handing over evidence after termination? Evidence must remain available at contract end.

Offers only become comparable once scope and response mandate are clearly described. International MDR providers publish around USD 10 to 30 per endpoint per month in public price overviews (as of 2026). Swiss providers hardly publish prices; offers differ sharply by scope. Details on cost drivers and models on Pricing models and Managed SOC cost.

• Is billing tied to endpoints, log volume or users, and how does the price scale over 12 months?
• Which setup costs are one-off, which recurring, which hidden in the offer?
• How is the exit clause worded (notice period, data handover, assistance window)?
• Is there a defined onboarding framework with milestones or an ad hoc start?

• Response authority only with case-by-case approval, without fallback when business hours end.
• Achievement reports qualitative only, no hard numbers on MTTR targets met.
• Detection content limited to standard vendor rule packs.
• Evidence only in-portal, no export, no handover at contract end.
• Unclear scope of service: it remains open whether and under which mandate the provider responds.

This page is the selection checklist. To learn how a SOC works in the first place, read What is a SOC. To decide make or buy, see Managed SOC or in-house. To understand round-the-clock operations, read How a 24/7 SOC works.