A security operations center (SOC) is the function that watches an organization’s systems for security threats and responds when it finds them. It is defined by what it does more than where it sits: a SOC can be a room of analysts in your building, a provider’s team working remotely, or a mix of both. Its core job is continuous monitoring, investigation of suspicious activity, and coordinated response to confirmed incidents.
Not to be confused with SOC 2 (System and Organization Controls 2), an independent CPA firm’s attestation report on a service organization’s controls.
At a glance
- A SOC is people, processes and technology, not a single product.
- Typical tools include a SIEM, EDR or XDR, threat intelligence and automation (SOAR).
- Analysts triage alerts, investigate incidents, hunt for hidden threats and start the response.
- Round-the-clock coverage takes enough staff for every shift, which is why many companies outsource it.
- SOCs can be in-house, fully outsourced (including through MDR) or co-managed.
What problem it solves
Security tools produce a constant stream of alerts, and attackers often work outside business hours. Without a team whose job is to watch, investigate and act, alerts go unread, and the time between an attacker getting in and someone noticing stretches into days or weeks. That delay is what turns a single compromised account into a data breach or a ransomware outbreak.
A SOC provides that dedicated attention. It also gives the organization a single place where security events are judged, so decisions about severity, escalation and response are consistent and documented. Auditors, cyber insurers and large customers increasingly ask how threats are detected and handled; a SOC, in-house or outsourced, is usually the answer.
How it works
Monitoring and triage. Data from endpoints, identity systems, email, firewalls and cloud services flows into a central platform, often a SIEM or XDR. Detection rules raise alerts, and analysts check each one to decide whether it’s real, how serious it is and what it affects.
Investigation and response. For real incidents, analysts work out scope and take or request containment actions, such as isolating devices, disabling accounts and blocking addresses, following playbooks agreed with the business. Serious incidents move into the organization’s incident response process.
Threat hunting and detection engineering. Mature SOCs proactively search for signs of attackers that didn’t trigger alerts and continually tune detection rules to cut false alarms and cover new attack techniques.
Staffing. SOCs often organize analysts in tiers, with first-line staff triaging and more experienced staff investigating and hunting. Covering all hours, weekends and holidays, with allowance for leave and turnover, requires a larger team than many expect.
Sourcing models. In-house SOCs give the most control and business context but are the most expensive. Outsourced SOCs, through managed detection and response (MDR), a managed security service provider (MSSP) or SOC-as-a-service, share analysts and tools across customers. Co-managed models split the work.
When it matters for buyers
- When deciding build versus buy. Compare the full cost of an in-house team (salaries for every shift, tools, training, turnover) with outsourced options covering the same hours and data sources.
- When compliance or customers require it. Frameworks and contracts often require continuous monitoring and documented incident handling.
- When you’re growing fast. More users, sites and cloud services mean more to watch and more alerts.
- When reviewing an existing provider. Check what the SOC actually monitors and what it does when it finds something, not just how many alerts it reports.
Questions to ask vendors
- Which data sources do you monitor, and what is excluded?
- Is coverage truly 24/7 with analysts awake and working, and where are they based?
- What actions will you take on our behalf, and which require our approval?
- What are your response times for critical incidents, and how are they reported?
- Which tools do you use, and who owns the data and detection rules if we leave?
- How do you tune detections to our environment and reduce false positives?
- Do you include incident response for serious incidents, or is that separate?
How it differs from MDR, a NOC and SOC 2
A SOC is the security monitoring function; managed detection and response (MDR) is one of the most common ways to buy it as a service, usually focused on detection and fast response. A network operations center (NOC) monitors network and system health and performance, not threats, though some providers run both. And a SOC has nothing to do with a SOC 2 report, which is an audit of a provider’s controls under the AICPA’s System and Organization Controls framework. See our security operations center overview and our article on MDR vs SOC.
Problems this helps with
- No one monitoring security around the clock
- Security alerts piling up with nobody to investigate them
- Deciding whether to build a security team or outsource it
- Auditors or customers asking how we detect and respond to threats
