Security operations centre (SOC)

A SOC is an organisational capability - people, process and technology - rather than a room or a product. Its core loop is detect, triage, investigate, respond and improve. Many SOCs are organised in tiers: tier 1 analysts triage incoming alerts against runbooks and close false positives or escalate; tier 2 performs deeper investigation, scoping and containment; tier 3 covers threat hunting, malware analysis, forensics and detection engineering. The tier model is increasingly criticised because it concentrates repetitive, burnout-prone work at the bottom and slows escalation, and many teams are replacing tier-1 triage with SOAR playbooks and automated enrichment so that humans handle judgement rather than copy-paste.

The technology stack usually centres on a SIEM for log correlation, EDR for endpoint telemetry and response, network detection (IDS/NDR), a case-management or ticketing system, threat intelligence feeds and a SOAR platform. The process layer consists of use cases mapped to MITRE ATT&CK, playbooks for common incident types (phishing, account compromise, ransomware precursor activity), escalation matrices with the business, and shift handover. The SOC-CMM model is a widely used self-assessment for SOC maturity across business, people, process, technology and services domains.

Sourcing is a strategic decision. Staffing one 24/7 seat in-house takes, by a common rule of thumb, around five to six analysts once shifts, leave and training are covered, which is beyond most small and mid-sized organisations. Alternatives are managed security service providers (MSSP) that monitor devices and forward alerts, managed detection and response (MDR) services that also investigate and take containment actions using their own or the customer's EDR, and hybrid models with an internal team during business hours and a provider at night. The contract must specify response authority - may the provider isolate a production server at 3 a.m.? - as well as log ownership, retention and exit terms.

A SOC is distinct from a CSIRT or CERT, which coordinates incident response, communication and recovery once an incident is declared, although small organisations merge the roles. NIST SP 800-61 Rev. 3 (2025) repositions incident response within the NIST CSF 2.0 functions rather than as a standalone lifecycle. Under NIS2, essential and important entities must submit an early warning to the CSIRT or competent authority within 24 hours of becoming aware of a significant incident and an incident notification within 72 hours (Art. 23); in practice the SOC is where awareness starts the clock. Common metrics are mean time to detect, mean time to respond, alert-to-incident ratio and detection coverage, although chasing speed metrics alone can encourage premature alert closure.