In short
A security operations centre (SOC) is the team, processes and technology that monitor an organisation's systems for cyber attacks, investigate suspicious activity and respond to incidents. It collects logs and alerts in tools such as a SIEM and EDR or XDR platform, and analysts work through them around the clock.
Get a quote for SOC as a service
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What a security operations centre does
A SOC exists to find attacks early and limit the damage they do. Its day-to-day work falls into a few areas:
- Monitoring: watching alerts and telemetry from endpoints, servers, identities, email, networks and cloud services
- Triage: deciding which alerts are real, which are noise and which need urgent action
- Investigation: piecing together what happened, which systems and accounts are affected, and how the attacker got in
- Response: containing the threat, for example by isolating a device or disabling an account, then supporting recovery
- Threat hunting: searching for attacker activity that has not triggered an alert
- Improvement: tuning detections, closing gaps found in incidents and reporting on risk
The term "security operations centre" once meant a physical room full of screens. Today a SOC is as likely to be a distributed team working in cloud consoles, and for many organisations it is a service run by a vendor or provider rather than an internal department. You will also see "cyber security operations centre" or "cyber SOC" used for the same thing.
People, process and technology
A SOC is usually described in three parts. All three have to work for the SOC to work.
People
Analysts are the core of a SOC. A common way to organise them is in tiers: first-line analysts triage incoming alerts, second-line analysts investigate the ones that matter, and senior analysts or incident responders hunt for threats and lead response to serious incidents. Around them sit detection engineers, who write and tune the rules, and a SOC manager. Covering every hour of the year means a rota with enough people for nights, weekends, leave and sickness, which is why staffing is usually the hardest part of running a SOC.
Process
Processes turn alerts into consistent action: playbooks for common incident types, escalation paths, rules about what analysts may do on their own authority, and how incidents are recorded and reported. The UK's National Cyber Security Centre (NCSC) guidance, *Building a Security Operations Centre (SOC)*, organises SOC design around the operating model, onboarding of log sources, detection, threat intelligence and incident response and management, and makes the point that there is no one-size-fits-all SOC.
Technology
| Tool | What it does in a SOC |
|---|---|
| SIEM | Collects, normalises and stores logs from across the organisation and correlates them into detections; see SIEM as a service |
| EDR or XDR | Records activity on endpoints (EDR) or across endpoints, email, identity, network and cloud (XDR), and lets analysts respond, for example by isolating a device |
| SOAR | Automates repetitive response steps with playbooks |
| Threat intelligence | Context on attackers, infrastructure and techniques to enrich and prioritise alerts |
| Case management | Records each investigation, the evidence and the actions taken |
Many vendor platforms now combine several of these in one console, which is one reason SOC services have become more accessible to smaller organisations.
Not sure which tier fits? Ask us
Tell us what you need and we will recommend the right tier for your organisation, with a quote.
What a SOC needs to work
A SOC is only as good as what it can see and what it is allowed to do. Before any SOC, in-house or managed, can be effective it needs:
- The right log sources. Endpoints, identity provider sign-ins, Microsoft 365 audit logs, email security, firewalls and key servers are the usual starting point. A SOC cannot investigate what it cannot see.
- Agreed detections. Rules and analytics that match the attacks you are most likely to face, tuned so that analysts are not buried in false positives.
- Response authority. Clear rules about which actions analysts may take without asking, and who to contact for everything else.
- Escalation contacts. Named people, in and out of hours, who can make business decisions during an incident.
- Log retention. Enough history to trace an attack back to the start; regulators, insurers and standards such as ISO 27001 often set expectations here.
- Continuous staffing. Attacks do not keep office hours, so the monitoring cannot either.
Why UK organisations need SOC capability
Few UK regulations say "you must have a SOC", but many expect the outcomes a SOC delivers: knowing when you have been attacked, acting on it and reporting it on time.
- Incident reporting deadlines. UK GDPR expects personal data breaches that pose a risk to be reported to the ICO within 72 hours where feasible, and the NIS Regulations set a 72-hour limit for operators of essential services. You cannot meet a deadline for an attack you have not detected.
- Logging and monitoring controls. ISO/IEC 27001:2022 includes Annex A controls on logging and monitoring activities; see ISO 27001 logging and monitoring.
- Health and care. NHS England's Cyber security charter for suppliers to the NHS includes a commitment to effective 24/7 cyber monitoring and logging of critical IT infrastructure; see cyber security for NHS suppliers and the Data Security and Protection Toolkit.
- Financial services. FCA operational resilience rules expect firms to stay within impact tolerances for important business services; see FCA operational resilience.
- Customers and insurers. Supply chain questionnaires and cyber insurance proposals increasingly ask who monitors your systems out of hours.
Our UK cyber security compliance hub maps each regime to the monitoring and response evidence it asks for.
Is SOC as a service the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Build or buy a SOC?
Building an in-house SOC gives you full control and analysts who know your business well. It also means recruiting and retaining scarce security staff, running a 24/7 rota, and buying and maintaining the SIEM, EDR or XDR, SOAR and threat intelligence tooling. That is realistic for large and highly regulated organisations; for most others it is not.
Buying a SOC as a service gives you an established team and tooling on subscription. Most such services are now sold as managed detection and response or managed XDR. The trade-off is that the SOC knows less about your business at the start, so onboarding, tuning and clear escalation matter.
There is also a middle way: a co-managed SOC, where your own team works alongside an external SOC. For a side-by-side view of the service models, see MDR vs SOC vs SIEM.
UK security operations centre services from Forever Systems
Forever Systems does not operate its own SOC. We supply and manage SOC services run by security vendors, including Sophos, Check Point, Cisco, WatchGuard, Blackpoint Cyber, CrowdStrike, SentinelOne and Todyl, whose analysts provide the 24/7 monitoring and response. Some of these services offer a choice of data location; Check Point MDR, for example, lists the UK among its data residency options. We confirm the region for your contract.
What we do:
- Recommend the service that fits the tools and licences you already own
- Set it up: agents, integrations, response authority and escalation contacts
- Manage it: tuning requests, exclusions, licence changes and renewals
- Handle escalation with you when the vendor SOC raises a case, within the scope agreed at quote
See managed SOC services for how this works, or contact us to discuss what your organisation needs.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What does a security operations centre do?
A security operations centre monitors an organisation's systems for cyber attacks, triages and investigates alerts, responds to confirmed incidents by containing them, hunts for threats that have not triggered alerts, and improves detections over time.
What is the difference between a SOC and a SIEM?
A SOC is the team and processes that detect and respond to attacks. A SIEM is a tool that collects and correlates logs. A SOC usually uses a SIEM, among other tools, but a SIEM on its own does not investigate or respond to anything.
Do small businesses need a security operations centre?
Most small businesses cannot build one, but many need what a SOC provides: someone watching for attacks outside office hours and acting quickly. A SOC delivered as a service, usually sold as managed detection and response, is the practical route.
What are SOC analyst tiers?
A common model has first-line analysts who triage alerts, second-line analysts who investigate significant ones, and senior analysts or incident responders who hunt for threats and lead response to serious incidents. Vendor SOCs organise their teams in their own ways.
Is there UK guidance on building a SOC?
Yes. The NCSC publishes Building a Security Operations Centre (SOC), which covers the operating model, onboarding log sources, detection, threat intelligence and incident response, and notes that there is no one-size-fits-all SOC.
Still have a question about SOC as a service?
Ask us and a member of our team will reply by email.