IT operations vs Security operations centre (SOC)

Why they differ

IT operations keeps systems running; a SOC watches the same systems for attacks.

Fundamentals

The team and daily work that keep an organisation's computers, systems and networks running.

Formal

The function that installs, runs, updates and supports an organisation's IT systems day to day - the people who in practice carry out most security controls, such as patches, backups and account changes.

In plain English

Like the ground crew at an airport - they refuel, load and check the planes so flights leave on time; the pilots are the ones people notice, but nothing moves without the crew.

In practice

At a Danish home-care provider, the security officer agrees with IT operations that critical updates go out within 14 days, and the IT department reports each month how many machines are still behind.

Why it matters

A security plan only works if the people who run the systems can carry it out, so security roles must speak their language and fit their workload.

Security operations centre (SOC)

Controls & technical basics

A team that watches an organisation's systems around the clock and acts when an alarm points to a real attack.

Formal

A central function, run in house or bought as a service, whose analysts follow alarms from tools such as SIEM and EDR, sort real threats from noise, look into them and start incident response.

In plain English

Like the control room of a fire service - people who never sleep, watch every call that comes in, and decide which ones need a truck right now.

In practice

At 3 a.m., at a SOC that a Danish region buys as a service, an analyst sees an admin login from an unknown country, checks with the region's on-call IT lead that it was not him, and locks the account.

Why it matters

Tools raise alarms, but only people decide what they mean; without someone watching, a warning at night can sit unread until the damage is done.