SOC
Security Operations Center
A Security Operations Center (SOC) is a centralised team and facility that continuously monitors, detects, analyses, and responds to cybersecurity threats across an organisation's IT environment. Operating around the clock, a SOC combines skilled analysts, defined processes, and technologies such as SIEM to reduce the time it takes to identify and contain security incidents.
A SOC's core functions include real-time monitoring, threat detection and triage, incident response, and continuous improvement of defences. Analysts typically work in tiers — from initial alert triage to deep investigation and threat hunting — supported by playbooks that standardise how incidents are handled.
Building an in-house SOC requires significant investment in people, tooling, and 24/7 staffing. Many organisations instead use a managed SOC (SOC-as-a-service), gaining round-the-clock coverage and specialist expertise without the cost and complexity of running one themselves.
Practical context
Using SOC in a real decision
Definitions are most useful when they help a team decide what to scope, who should own the work, and what evidence supports the next step. Use these questions to turn the term into a practical conversation.
- Which systems, identities, and data would be affected by this security concern?
- What evidence would help the team decide whether the risk is material?
- Who owns the next control, remediation, or monitoring decision?