Home / Knowledge hub / Security operations centre
Knowledge hub
Security operations centre
A team and room that watch for and respond to threats around the clock.
What it means
A security operations centre, or SOC, is a team, and the tools and processes they use, that watches an organisation's systems for signs of attack and responds when they find one. Some are a physical room with screens. Many are distributed teams working from one shared set of tools.
The SOC's daily work is triage. Alerts come in from tools such as a SIEM, analysts decide which are real, investigate, contain the problem and hand over to the wider incident response process. Some SOCs also hunt for threats that no alert caught.
Why it matters
Attacks do not keep office hours. A SOC that watches around the clock cuts the time between a break-in and someone noticing, and that gap often decides how much damage is done. Customers and regulators sometimes ask who monitors your systems and how quickly they respond.
The hard part is staffing and cost. Round-the-clock coverage needs several shifts, trained analysts and tuned tools. Smaller companies usually buy it as a service instead; see MDR, or work with an MSSP. Whichever route you choose, write down who is on call and who decides to act.
How it shows up
A SOC typically has tiers: first-line analysts triage alerts, senior analysts investigate and contain, and specialists handle forensics or hunting. It runs on playbooks for common cases, and on records of what each alert turned out to be. Some also keep a team lead for major incidents.
Check what it can actually see. A SOC watching network and endpoint tools may never notice a signed-in account reading another customer's data through your API, because those requests look normal. That is a gap in what is logged, not in the team. Pentesting and monitoring answer different questions, and you need both.
Questions people ask
Security operations centre, answered
Is a SOC the same as a pentest team?
No. A SOC watches for real attacks on a continuing basis. A pentest is a planned test that finds weaknesses before an attacker does.
Pentest findings can also help the SOC write better detections.
Do we need our own SOC?
Most small and mid-sized companies do not. They use a managed provider, or a smaller in-house monitoring function with outside help for nights and weekends.
Decide by risk, customer expectations and budget.
What does a SOC cost?
It varies widely by size, hours and tooling. The largest cost is people, since round-the-clock coverage needs several analysts working in shifts.
Managed services spread that cost across many customers.
What tools does a SOC use?
Typically a SIEM, endpoint detection, network monitoring, a ticketing system and threat intelligence feeds, plus written playbooks for common alerts.
The mix matters less than whether alerts are reviewed and acted on.
Can a SOC stop an attack by itself?
It can detect and contain, within the authority you give it, for example by isolating a machine or disabling an account. It cannot fix a flaw in your code.
Those fixes stay with your engineering team.
Related
Terms that sit next to this one
SIEM
A system that gathers logs from everywhere and raises alerts on suspicious patterns.
MDR
An outside service that monitors your systems and responds to threats for you.
Incident response plan
A written plan for who does what in the first hours after a security incident.
Threat hunting
Searching your systems for attackers that alerts have not yet caught.
Alert fatigue
Teams ignoring warnings because too many of them turn out to be noise.
Would your SOC notice this?
We can show what an application flaw looks like in the logs, with the exact request and response, so your monitoring team can check whether they would have seen it. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.