Fully managed SIEM/MSSP is an affordable option for establishing a SOC; however, most providers offer black-box solutions with limited visibility and assurance that the environment is secure. Internally managed SIEM is expensive, requiring significant resources and funding, but offers rich features, customization, and visibility. Co-managed SIEM + MSSP offers the benefits of both approaches, including reasonable costs with the additional visibility and assurance.