What is a SOC? Security operations centers, explained

Start here

What a security operations center actually does

Think of a SOC as the nerve center of an organization’s cybersecurity program, the room (physical or virtual) where analysts sit in front of dashboards, watch network traffic scroll by, and hunt for threats in real time while everyone else in the building sleeps or answers emails. Not after the fact. Not once a quarter. Continuously.

The job breaks into three layers.

Monitoring and detection. SOC analysts watch network traffic, endpoint behavior, login patterns, email activity, and cloud workloads for anything that looks wrong. A login from São Paulo at 2 a.m. on a Tuesday when the account holder lives in Denver? Flagged. An unusual spike in outbound data from a file server at 3 a.m., right around the time nobody should be touching that server? Also flagged. Automated tools generate the alerts, but the analysts are the ones who decide which of those alerts represent a real threat and which ones are just noise from a backup job that kicked off at a weird hour.

Investigation and response. When an alert turns out to be real and not a false positive, the team investigates. The ratio of noise to signal in a typical SOC is brutal, sometimes 10,000 alerts flooding in per day, so the first job is separating the genuinely dangerous signals from the background hum of misconfigured services and employees forgetting their passwords. Once they confirm an actual threat, analysts trace the attack path, figure out what’s been compromised, isolate affected systems, and try to contain the damage before it jumps to the next machine. Ransomware can encrypt an entire domain in under 45 minutes from initial compromise. Speed isn’t optional.

Recovery and improvement. After containment, the SOC handles forensics, documents what happened, restores systems, and updates detection rules so the same attack doesn’t work twice. The best SOCs treat every incident as a training dataset. The ones that don’t repeat the same mistakes.

The stack

The tools inside a SOC (without the acronym soup)

Walk into any SOC and you’ll see dashboards running four categories of software. Here’s what each one actually does.

SIEM (Security Information and Event Management). The central nervous system of the operation. SIEM collects logs from every device, server, application, and cloud service across your environment, then correlates them to spot patterns that a human analyst scrolling through raw log files would never catch on their own, especially not at 3 a.m. on a Tuesday. A failed login on its own means nothing. That same account failing across 14 servers in 90 seconds? That means something. Splunk, Microsoft Sentinel, and IBM QRadar are the platforms you’ll hear about most.

EDR (Endpoint Detection and Response). SIEM watches the network. EDR watches individual devices. Laptops, servers, workstations. It records everything happening on each endpoint and can automatically isolate a compromised machine before an analyst even looks at the alert. CrowdStrike Falcon and SentinelOne are two of the biggest names. If you’ve heard your MSP or MSSP mention either, this is the category.

SOAR (Security Orchestration, Automation, and Response). This is the automation layer, and it’s where things get interesting for companies drowning in alert volume. When SIEM detects a phishing email that slipped past the spam filter, SOAR can automatically quarantine it, block the sender domain, scan every inbox that received it, and open a ticket for an analyst, all before a human touches anything. The catch is that building those automated playbooks takes genuine expertise, because a badly configured SOAR workflow that auto-quarantines legitimate vendor emails or blocks a critical business domain can cause more damage than the phishing email it was trying to stop.

XDR (Extended Detection and Response). The newest addition. XDR tries to unify EDR, SIEM, and email/cloud security into a single console so analysts aren’t jumping between four different screens. It correlates signals across endpoints, network, email, and cloud workloads in one place. Palo Alto Cortex and Microsoft Defender XDR are the big players here. Whether XDR actually replaces SIEM or sits alongside it is still an active debate in the industry.

Not every SOC runs all four. A small managed SOC might run SIEM and EDR and handle orchestration manually. An enterprise SOC with a 15-person team probably runs all four plus threat intelligence feeds, vulnerability scanners, and forensic tools on top. For how these tools map onto what your MSP should already include, see our guide to what cybersecurity your MSP should include.

The people

SOC team roles: who’s actually in the room

Software doesn’t run itself. A SOC is people, and the staffing model matters more than most buyers realize because 24/7 coverage requires far more headcount than you’d expect when you first run the numbers on paper.

Different rooms

SOC vs. NOC: different rooms, different problems

These get confused constantly. Both are operations centers. Both have analysts watching screens. But they’re solving different problems.

A NOC (Network Operations Center) monitors uptime, performance, and availability. Is the network running? Are servers responding? Is bandwidth where it should be? The NOC cares about service delivery. When your internet goes down or a server crashes, that’s a NOC problem.

A SOC monitors threats. Is someone trying to break in? Has malware already gotten past the perimeter? Is data leaving the network that shouldn’t be? The SOC cares about security.

Both watch the same infrastructure, and sometimes the same alert matters to both teams. A server going offline could be a hardware failure (NOC problem) or a ransomware attack that just encrypted the boot drive (very much a SOC problem). What separates them is what they do with that information, what they’re trained to look for, and which playbook they pull off the shelf when the alert fires at 2 a.m.

Smaller businesses often get both from the same provider. Your MSP might run a NOC for uptime monitoring and partner with an MSSP for SOC-level security, or handle both if they’ve built out that capability. Where this trips up buyers is that “24/7 monitoring” on a provider’s website could mean NOC monitoring (keeping the lights on), SOC monitoring (watching for attackers), or both, and the provider’s sales team may not volunteer which one you’re actually getting until you ask directly. Our MSP vs. MSSP guide goes deeper on that split.

Common confusion

Wait, is SOC the same as SOC 2?

No. And this confusion shows up in almost every buyer conversation about managed IT security.

SOC (Security Operations Center) is an operational function. Real people monitoring real systems in real time for threats. It’s a team, a process, and a set of tools.

SOC 2 is a compliance framework. It stands for Service Organization Control Type 2, and it’s an audit standard created by the American Institute of CPAs (AICPA). A SOC 2 audit evaluates whether a company’s internal controls over security, availability, processing integrity, confidentiality, and privacy meet the Trust Services Criteria.

Completely different things.

When your MSP says “we’re SOC 2 certified,” they’re telling you their internal security controls passed an independent audit. That’s a credibility signal. It does not mean they run a security operations center. An MSP can be SOC 2 certified and have zero SOC capability. And an MSSP with a world-class SOC might not have completed a SOC 2 audit yet.

SOC 1 audits cover controls over financial reporting, mostly relevant for accounting and payroll service providers. SOC 3 is a public-facing summary of a SOC 2 report. Neither has anything to do with security operations centers.

Costs

The four SOC models (and what they actually cost)

This is the section no vendor page will write honestly, because every vendor selling SOC services has a financial interest in which model you pick. ITreviews.co doesn’t. Here’s what the data shows.

Cost data sourced from Radicl, Blackpoint Cyber, and Falconer Security (2026 published figures).

That gap between in-house and outsourced is enormous, and it’s the reason most companies under 500 endpoints don’t even consider building their own. Standing up a 24/7 SOC from scratch requires $1M to $2M in upfront infrastructure costs (Blackpoint Cyber, 2026) plus $1.5M or more annually in staffing alone. You’d be spending more on security operations than some companies spend on their entire IT budget. The SOCaaS equivalent for a 100-endpoint company starts around $30k per year.

Per-endpoint pricing for managed SOC services typically falls between $10 and $25 per endpoint per month for SMBs, with volume discounts kicking in above 250 endpoints (Falconer Security, 2026). A 200-endpoint environment paying for standard 24/7 analyst coverage runs roughly $5k to $12k per month.

Fortune Business Insights (2026) puts the global SOCaaS market at $9.6B and growing at 12% annually, projected to hit $23.9B by 2034. That growth rate tells you something about which direction the market is moving, and it isn’t toward more companies building their own.

Decision

Do you actually need a SOC?

It depends on your size, your industry, and how much risk you’re comfortable carrying. Smaller companies have different math than enterprises, and the answer changes depending on what kind of data you’re protecting and who’s regulating you.

You probably need dedicated SOC capability if:

• You’re in a regulated industry (healthcare, financial services, government contracting) where compliance frameworks like HIPAA, PCI DSS, or CMMC require continuous monitoring, incident response documentation, and audit trails
• You have more than 200 endpoints across your organization
• You handle sensitive data (protected health information, payment card data, controlled unclassified information) that’s subject to breach notification laws
• You’ve already experienced a breach or a near-miss and don’t have the internal capability to detect the next one

You probably don’t need to build your own SOC if:

• You have fewer than 200 endpoints. The cost math doesn’t work. An in-house SOC costs $855k+ per year. A managed SOC for a 100-endpoint company costs $30k to $60k. The gap is too wide to justify for most SMBs.
• You already work with an MSP or MSSP that includes SOC-level monitoring in their managed security offering

The in-between

Companies with 200 to 1,000 endpoints, some compliance requirements, and no internal security team almost always land on SOCaaS or a co-managed model. The question isn’t whether you need SOC capability. It’s whether you build it, buy it, or blend it.

IBM’s 2026 Cost of a Data Breach Report puts the global average breach cost at $4.99M, with organizations taking an average of 247 days to identify and contain an incident, which is more than eight months of an attacker living in your environment before anyone notices. Companies using security AI and automation extensively cut that lifecycle by 65 days and saved roughly $1.93M compared to those using no automation (IBM, 2026). SOC capability, whether in-house or outsourced, is where that detection and automation actually happens.

Before you sign

What to ask your MSP or MSSP about their SOC

If you’re evaluating a managed IT or managed security provider, these questions separate the ones who actually run security operations from the ones who just list “24/7 monitoring” on their website.

• “Is your SOC in-house or outsourced?” Some MSSPs run their own SOC with their own analysts. Others white-label a third party’s SOC and resell it. Neither is inherently wrong, but you should know which one you’re buying. An in-house SOC means the provider controls the quality of the analysts, the tools, and the response process. A white-labeled SOC means they’re a middleman.
• “What’s your mean time to detect and mean time to respond?” A well-run managed SOC should detect critical threats in under an hour and respond to critical incidents (ransomware, account takeover) in under 15 minutes. If they can’t give you a number, that’s a red flag. MTTD and MTTR are the two metrics that matter most.
• “Do you run 24/7 or 8×5 with after-hours automation?” There’s a significant difference between a SOC staffed with live analysts around the clock and one that runs automated detection overnight with on-call escalation. Both can work. But the pricing should reflect the coverage model.
• “What SIEM platform do you use, and do I get access to the dashboards?” Some providers give clients full visibility into their security posture. Others hand you a monthly PDF summary. If you’re paying for SOC monitoring, you should be able to see what the SOC sees. Ask for portal access.
• “Can you walk me through your last incident response?” Any credible SOC provider should be able to describe, in general terms without naming clients, how they detected, contained, and resolved a real incident. If the answer is vague or theoretical, the SOC capability might be too.

Bottom line

Where SOCs fit in your security stack

You don’t bolt a SOC on at the end of a security buildout. It’s the operational layer that makes every other security investment actually work. Without someone watching the alerts your firewall, endpoint protection, and email security generate, those tools are just writing logs that nobody reads until three months after the breach, when a forensic investigator pulls them up and shows you exactly when the attack started.

For most SMBs and mid-market companies, the path isn’t building a SOC. It’s finding a provider that runs one. That means evaluating MSSPs, understanding what their SOC actually does versus what their website claims, and asking the five questions above before signing anything.

Browse cybersecurity companies by city on ITreviews.co to compare providers with verified SOC capabilities, scored on independently researched criteria with no paid rankings.