Security operations centre (SOC)

What it means

A security operations centre, or SOC, is a team of people, processes and tools that continuously oversees the security of an organisation's information systems. It monitors events, assesses alerts, separates false alarms from real attacks and coordinates the response when an incident occurs.

A SOC works mainly with data from a SIEM system, which collects logs from the entire infrastructure, and from EDR tools on endpoints. Analysts are usually organised in tiers: the first triages alerts, the second investigates suspicious cases in depth and the third handles complex incidents and actively hunts for hidden threats.

A SOC can be internal, built by the company itself, or external, provided as a service. There are also hybrid models, where an in-house team handles routine matters and an external partner provides round-the-clock coverage and specialist knowledge. The choice depends on company size, risks and regulatory requirements.

How it works in practice

An in-house 24/7 SOC requires several analysts working shifts, plus tools and their maintenance, which is financially unrealistic for most small and medium-sized companies. It is therefore bought as a service. The company pays a monthly fee based on the number of devices or data volume and gets 24/7 monitoring and incident support.

When choosing a provider we recommend checking which data sources it can monitor, how quickly it responds to critical alerts, whether it intervenes actively, for example by isolating an infected device, and how it communicates. Alignment with ISO 27001 and experience with NIS2 incident reporting requirements also matter.

The contract should be backed by internal incident response procedures: who in the company receives alerts, who decides to shut systems down, who communicates with customers and authorities. Even the best external SOC is powerless if nobody can be reached at night. A SOC service can also improve cyber insurance terms.

What to watch out for

Beware of services called SOC that in fact only forward automated alerts without human assessment. The company then receives hundreds of emails nobody reads. The contract should clearly state what the analysts do, within what timeframes and what outputs the company receives.

A SOC watches but does not secure the system on its own. If the company does not update software, has no backups or uses weak passwords, the SOC may detect an attack but will not prevent it. Monitoring makes sense as part of an overall cybersecurity programme, not as a substitute for it.