SOC

What is SOC?

SOC (Security Operations Center) is the central unit responsible for monitoring an organisation’s security on a continuous basis. The SOC team analyses security events from multiple sources - firewalls, IDS/IPS systems, servers, workstations, email systems - looking for signs of security incidents.

A SOC combines three elements: people (security analysts at various skill levels), processes (detection, escalation and response procedures) and technologies (SIEM, EDR, NDR, threat intelligence platforms). SOC analysts work in shifts, providing monitoring 24 hours a day, 7 days a week.

A mature SOC goes beyond reactive response to alerts. It conducts active threat hunting, analyses trends, refines detection rules and collaborates with IT teams to eliminate risk sources. Many organisations today use external SOC providers (SOC-as-a-Service, MDR), as building an in-house centre requires significant investment.

Why does it matter?

Without continuous monitoring, an organisation learns about a security incident weeks or months later - often only after the attacker has already achieved their objective. A SOC shortens the mean time to detect (MTTD) and mean time to respond (MTTR), limiting potential damage.

Regulations such as NIS2 require organisations to have the capability to detect and report incidents within defined timeframes. Having a SOC - whether in-house or outsourced - is a practical prerequisite for meeting these requirements.

Related topics

• SIEM
• EDR
• NDR
• MITRE ATT&CK