Endpoint and identity monitoring for Microsoft 365 and Google Workspace environments, validated alert escalation, and practical response support from a real security engineer. Security Awareness Training and SIEM are optional add-ons, not forced into every plan.
MDR + ITDR foundation · Microsoft 365 or Google Workspace · Optional SAT · Optional SIEM · Project-based IR when needed
All plans start with endpoint monitoring and identity monitoring. SAT and SIEM can be added separately.
Best for small firms using Microsoft 365 or Google Workspace that need real monitoring, validated alert escalation, and a direct line to a security engineer without hiring a full-time security team.
Best for law firms, CPA firms, real estate, and finance teams where account takeover, business email compromise, and wire fraud are active concerns across Microsoft 365 or Google Workspace.
Best for organizations that want a higher-touch security partner for Microsoft 365 or Google Workspace monitoring, advisory, roadmap ownership, and priority response coordination.
SOCaaS should not force every client into the same stack. Core monitoring starts with MDR and ITDR. SAT, SIEM, Microsoft 365 / Google Workspace assessment, and workspace cleanup can be added based on risk, size, and budget.
Phishing simulations, user training, and cyber insurance documentation for businesses that want to reduce employee-driven risk without expanding into a full security program.
Log aggregation and managed detections for clients that need deeper telemetry beyond endpoint and identity monitoring.
A focused review of your Microsoft 365 or Google Workspace environment before monitoring begins, so we understand the identity and email risk we are inheriting.
We clean up and harden your Microsoft 365 or Google Workspace environment before or after monitoring begins, priced based on tenant complexity and scope of findings.
You work directly with the security engineer reviewing confirmed alerts and helping guide next steps.
Every SOCaaS tier includes Huntress MDR and Huntress ITDR for endpoint and Microsoft 365 or Google Workspace identity monitoring.
Security Awareness Training and SIEM are available as add-ons. They are not forced into every plan.
Basic triage and containment guidance are included. Full forensic investigation and insurance documentation are scoped separately.
| Feature | Core SOC Monitoring $3,000/mo |
SOC Response $5,000/mo |
SOC Partner $7,500+/mo |
|---|---|---|---|
| Core Monitoring Stack | |||
| Huntress MDR — Endpoint Detection & Response | ✓ | ✓ | ✓ |
| Huntress ITDR — Microsoft 365 / Google Workspace Identity Monitoring | ✓ | ✓ | ✓ |
| Identity Posture Visibility | ✓ | ✓ | ✓ |
| Suspicious Inbox Rule / Forwarding Detection | ✓ | ✓ | ✓ |
| Monthly Huntress Threat Report | ✓ | ✓ | ✓ |
| Optional Add-Ons | |||
| Huntress SAT — Security Awareness & Phishing Training | Optional | Optional | Optional |
| Huntress SIEM — Log Aggregation & Managed Detections | Optional | Optional | Optional |
| Response & Triage | |||
| Alert Review & Escalation | ✓ | ✓ Priority | ✓ Priority |
| Critical Confirmed-Threat Notification | ✓ | ✓ | ✓ |
| Account Takeover Triage | Basic Guidance | ✓ | ✓ Priority |
| BEC Triage — Inbox Rules, Forwarding, Impersonation | Basic Guidance | ✓ | ✓ Priority |
| Limited After-Hours Critical Response | — | ✓ | ✓ Priority |
| Full Incident Response Investigation | Project-Based | Project-Based | Priority Scheduling |
| Advisory & Reporting | |||
| Quarterly Security Review | — | ✓ | ✓ |
| Executive Security Summary | — | Quarterly | ✓ Monthly |
| Security Roadmap Ownership | — | — | ✓ |
| Hands-On Microsoft 365 / Google Workspace Hardening Support | — | Project-Based | ✓ Within Scope |
| Annual Tabletop Exercise | — | — | ✓ |
Every SOCaaS plan includes validated alert escalation and practical containment guidance. We help you understand what happened, what matters, and what to do next.
When an incident requires a full timeline, root cause analysis, mailbox review, endpoint review, legal summary, or insurance documentation, it becomes a scoped incident response project.
SOC Response and SOC Partner clients receive higher-touch response coordination and priority scheduling, while Core clients still receive clear escalation and guidance.
Start with Core SOC Monitoring, then add response support, SAT, SIEM, or workspace hardening only when your risk and budget justify it.
Schedule a Discovery Call →Free · No Credit Card · Response Within 24 Hours