What a SOC does and how to choose an operating model
A security operations centre combines detection, investigation and response. In-house, managed and shared models should be compared against the same responsibilities.
The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.
A security operations centre, SOC, is the function that monitors security activity, investigates suspected threats and coordinates a response. It may be internal, supplied as a service or shared between your team and a provider.
Here, SOC does not mean SOC 2, the assurance report on a service organisation’s controls.
Define the job before the staffing model
Start with the systems to cover and the incidents the function should be able to identify. Determine the monitoring hours, expected response times and actions responders may take.
Then include the work behind the alerts: maintaining data sources, improving detections, reviewing false positives, preserving evidence and keeping incident procedures current. A tool licence does not provide those responsibilities by itself.
Coverage need not have the same operating model for every organisation. Where round-the-clock response is required, the rota must account for absence, training, escalation and continuity. Dividing a week’s hours by one person’s working hours gives only a theoretical minimum, not a sustainable staffing plan.
Compare the options fairly
An internal team can provide close knowledge of business systems and direct control over priorities. It also needs recruitment, leadership, tools and enough depth to handle serious incidents while routine work continues.
A managed service can provide capacity and specialist support, but the agreement must identify covered sources, response authority, handoffs and exclusions. Data handling and access requirements belong in the comparison.
A shared model may let the provider handle monitoring while internal staff supply application context and business decisions. That arrangement works only if the interface is explicit and contact details remain current.
Keep the service distinctions clear
FM’s Falcon Complete offering combines CrowdStrike’s managed detection and response with FM onboarding, tuning and local escalation. Secured by FM CyberSecurity uses FM’s own agentic SOC built on CrowdStrike. They are different service arrangements.
Neither removes the need for an internal incident lead, recovery ownership or decisions about customer communication. Use the incident response guide to identify those responsibilities.
Ask each proposal to demonstrate the same scenario: an important system shows suspicious activity outside normal working hours. Who notices, who can act, who calls the business and what happens if that person cannot be reached? The answers are more useful than the number of screens in a SOC photograph.
