What an AI SOC Investigation Costs, and How to Keep It Predictable
SIEM taught security teams to budget by ingest volume. SOAR taught them to budget by seat and connector. An AI SOC bills by neither. Its dominant variable cost is the reasoning itself, charged per token, and it scales with alert volume rather than with headcount. Most buyers model it as a flat subscription, discover the real driver in month three, and then either throttle the platform or absorb a number nobody approved.
The cost is controllable. It is controllable through architecture rather than through negotiation, which means the decisions that set it are made before the contract is signed. This post sets out what drives the number and how to hold it flat while alert volume grows.
The Four Cost Drivers
Every reasoning call an AI SOC makes is priced on the same four variables. Vendors rarely present them separately, which is what makes the total look unpredictable.
- Context size: how much evidence is loaded into the model for each call. An investigation that attaches raw log extracts costs several times one that attaches a structured summary of the same evidence. This is the single largest lever and it is entirely an engineering choice.
- Model tier: a frontier model and a small specialist model can differ by an order of magnitude per token. Routing every alert to the largest available model is the default behavior of a platform that has not thought about cost.
- Call count per case: a multi-agent pipeline makes several calls per alert, one per agent, plus retries. An architecture with no upper bound on agent-to-agent handoffs has no upper bound on cost per case.
- Alert volume reaching reasoning: the number of alerts that get a reasoning call at all. Deterministic filtering ahead of the agents is free by comparison, and the alerts it removes are the cheapest ones to handle.
Tiered Routing, and What Belongs in Each Tier
The design that keeps cost flat is to match the cost of the handling to the difficulty of the alert. Three tiers are enough.
- Deterministic: alerts that match a known, unambiguous signature, suppression rule, or prior disposition. A known-good scanner, a duplicate of an alert closed an hour ago, an alert from a decommissioned asset. These close on rules at near-zero marginal cost and never reach a model.
- Small-model reasoning: high-volume alert types with a narrow decision space, such as single-source enrichment questions and structured classification. A smaller model handles these at a fraction of frontier pricing with no measurable loss in agreement rate.
- Full agent pipeline: ambiguous cases, multi-source correlation, anything touching a critical asset or a privileged identity. This is where the five-agent pipeline and the frontier model earn their cost, and it should be the minority of volume.
The ratio between those tiers is the whole economic story. A platform that puts most of its volume in the third tier will be expensive at any unit price. One that filters hard and routes well stays cheap even as the queue grows.
Where Context Discipline Comes From
Tier routing gets attention because it is easy to diagram. Context discipline matters more and gets none. The practical rule is that the reasoning model should receive structured findings rather than raw telemetry. In HawkEye’s AI SOC the retrieval step assembles the entities, the asset’s criticality, the identity’s baseline, and any prior case involving the same indicators, then passes that assembled context to the agents. The agents reason over a compact structured object, not over a log dump.
Two consequences follow. The cost per call stays bounded regardless of how noisy the source telemetry is, and the reasoning quality improves, because a model given forty relevant fields reasons better than one given four thousand lines of which forty matter.
The Cost of the Alternative
Any cost comparison has to include the baseline. ISC2’s 2025 Cybersecurity Workforce Study, drawn from more than 16,000 practitioners, found 59 percent of organizations reporting a critical or significant skills gap, up from 44 percent the year before. The scarce input in a SOC is senior analyst time, and the alternative to spending tokens on an investigation is spending that time, or not investigating at all. The relevant question is not whether reasoning costs money. It is what a defensible verdict costs by each route.
What to Ask Before Signing
- How is this priced: per alert ingested, per investigation, per seat, or on consumption. If consumption, what is the unit and what is a typical month at our volume.
- What share of our alerts would reach a reasoning call: ask them to run it on your week of real alerts rather than estimate.
- Can we see per-case cost: a platform that cannot report cost per investigation cannot help you manage it.
- Can we bring our own model: BYO-LLM converts a vendor margin into a cloud bill you control, and it is the only route to negotiating that line down later.
- What happens when volume doubles: a linear cost curve on a queue that grows every year is a budget problem waiting to surface.
With SecOps Unpacked mapping 74 vendors under AI SOC Capability and 72 under AI SOC Pure Play as of September 2026, pricing models vary more than the marketing does. The five questions above separate them faster than the datasheets.
Where the Spend Hides
Four line items routinely appear in the first real invoice and in nobody’s model.
- Retries on malformed output: a model that drifts from the expected schema forces a re-run of the same call. Track the first-attempt parse rate per agent, because a rate that looks acceptable at 90 percent is a 10 percent surcharge on every call that agent makes.
- Tool outputs pasted whole: an enrichment that returns a large JSON document and is handed to the model unfiltered can dwarf the alert itself. Summarize or project tool responses to the fields the agent will use before they enter the context.
- Context re-reads across agents: if each agent receives the full case context rather than its own slice, you are paying for the same tokens three or four times per investigation. Scope the context per agent role.
- Evaluation and regression runs: re-running a golden set against a candidate model is a legitimate cost that belongs in the budget rather than in a surprise. It is small, and it is the cost that prevents the large ones.
A platform that cannot report tokens and cost per case, broken down by agent, cannot help you reduce any of the above. Treat per-case cost reporting as a functional requirement rather than a reporting nicety.
Frequently Asked Questions about AI SOC Cost
How is an AI SOC priced?
Models vary. The common ones are a flat platform subscription, a per-investigation charge, and consumption-based pricing tied to reasoning usage. The variable that drives the bill in every model is how many alerts receive a reasoning call and how much context each call carries.
Does an AI SOC cost more as alert volume grows?
It does if every alert is routed to a frontier model. With deterministic filtering ahead of the agents and tiered routing by alert difficulty, cost grows far more slowly than volume, because the majority of new volume lands in the cheapest tier.
Does BYO-LLM reduce AI SOC cost?
It changes who you pay and what you can negotiate. The reasoning spend moves from the vendor’s margin to your own cloud or hosting bill, which you can optimize, reserve capacity against, and audit directly. For regulated buyers it also keeps the telemetry inside the required jurisdiction, which is usually the stronger reason.
What is a reasonable cost per investigation?
There is no useful industry number, because it depends entirely on context size, model tier, and how many alerts reach reasoning in your environment. Any figure quoted without those three variables attached is a marketing number. Size it on your own week of alerts during the proof of concept.