Managed SOC services (SOC as a service)

What a managed SOC service does

A security operations centre is the people, processes and tools that watch an organisation's systems for attacks and respond to them. Building one in-house means log collection, detection rules, playbooks, threat intelligence and, above all, enough trained analysts to cover every hour of every day, including nights, weekends and holidays. For most small and mid-sized UK organisations, that is out of reach.

A managed SOC, or SOC as a service, delivers the same outcome on subscription. A typical service includes:

• Continuous monitoring of alerts and telemetry from endpoints, and, depending on the service, identities, Microsoft 365, email, firewalls and cloud platforms
• Triage and investigation by analysts who separate genuine threats from noise and work out what happened
• Response actions taken within limits you agree in advance, such as isolating a device, stopping a process or disabling an account
• Threat hunting for attacker activity that has not triggered an alert
• Case reports and guidance so your IT team, or ours, can finish the clean-up and close the gap that let the attacker in

Most modern managed SOC services are sold as managed detection and response (MDR) or managed XDR, because the emphasis has moved from forwarding alerts to acting on them. If you are weighing up the labels, our guide to MDR vs SOC vs SIEM sets out the differences.

How the vendor SOCs we supply work

Forever Systems does not run its own SOC. We resell and manage services in which the vendor's own analysts do the 24/7 watching and responding. That gives you an established, specialist team, and gives us the freedom to recommend whichever service fits the tools you already own.

We also supply ThreatDown MDR, in which ThreatDown's analysts monitor your endpoints and contain confirmed attacks, and Acronis MDR, which runs on Acronis EDR or XDR and in its Advanced tier can, with your agreement, roll back an attack and recover from backup. See managed security for small business and the full list on our vendors page. The table describes how each service works; it is not a ranking.

What Forever Systems does

The vendor's SOC watches and responds. Our job is to make sure it is the right service, set up properly, and connected to the people in your organisation who need to know. A typical engagement:

1. Assess what you have. We review your endpoint, identity, email and firewall tools, your Microsoft 365 licences and your out-of-hours arrangements, so the service builds on what you already pay for.
2. Recommend a service. We shortlist the vendor SOC services that fit your estate and explain the trade-offs in plain English, including coverage, response authority and how each is licensed.
3. Set it up. We deploy or confirm agents, connect integrations such as Microsoft 365, and check that data is arriving and detections are working.
4. Agree escalation. We write down with you who the SOC contacts, in what order, and what it may do without asking. We can be one of the escalation contacts if you want us to be.
5. Manage and review. We handle tuning requests, exclusions, licence changes and renewals, and we can review cases and recommendations with you at intervals we agree.

The exact split of responsibilities between you, the vendor and us is written into your quote, so there is no doubt about who does what when an incident happens. If you want your own IT team to share the work, see co-managed SOC.

In-house vs outsourced SOC

Organisations often ask whether SOC as a service is a substitute for a dedicated security team. The honest answer is that they do different jobs, and many organisations end up with a mix.

A common middle path is a vendor SOC for 24/7 detection and response, with an internal IT lead or security manager who owns risk, policy and remediation. That is the model we support.

Response authority and escalation

The single most important decision in any managed SOC is what the analysts may do without asking. Services differ:

• Act, then tell you. Sophos calls this Authorize: the SOC contains the threat and then informs you.
• Investigate, then ask. Sophos's Collaborate mode: the SOC investigates but takes response actions only with your consent, with an option to switch to Authorize if nobody answers.
• Notify only. The SOC alerts you and takes no containment action. Sophos does not recommend this mode for extended periods.

Other vendors use different names for similar choices, and most let you set rules per type of action. Identity actions need particular care: disabling a director's account in the middle of the night may be exactly right during a business email compromise, but everyone should know in advance that it can happen. We help you set these rules at onboarding and revisit them as your organisation changes.

Choosing a SOC as a service provider

Compare services on the things that matter when an incident happens, not on the length of the feature list:

• Coverage: endpoints only, or identities, email, firewalls and cloud too
• Your existing tools: whether the service works with the EDR and Microsoft licences you already own
• Response: what the SOC can contain itself and what it hands back to you
• Incident response: whether full investigation and recovery after a serious breach is included, capped or separate (see incident response retainers)
• Data: where telemetry is stored and for how long, which matters for UK GDPR and compliance
• Reporting: whether incident write-ups are clear enough for your board, insurer or auditor

Our guide to choosing an MSSP has the full checklist, and MSSP pricing explains how these services are licensed. Pricing depends on the service, the number of users, endpoints or devices, and options such as data retention, so ask us for a quote.

Contact us to compare managed SOC services for your organisation.