A SOC, or security operations center, continuously monitors the environment, detects signs of attack, investigates, and responds. Building an in-house SOC usually makes sense for large companies with complex environments and the budget for a 24/7 team. For most others, an outsourced or hybrid model is more viable.
Beyond who operates it, the question that determines SOC quality is whether someone acts when an alert fires.
What a SOC does
A SOC has four jobs. Collect logs from servers, workstations, cloud environments, applications, and networks in a central platform. Detect suspicious activity among millions of normal events. Investigate to distinguish false positives from real attacks. And respond by containing the threat, engaging the right people, and tracking remediation.
Many operations called SOCs perform collection and detection well but stop at investigation. The alert is generated, but no one addresses it in time.
How much 24/7 coverage matters
The largest cost of an internal SOC is people. Staffing a single position 24 hours a day, seven days a week requires about five professionals, accounting for shifts, days off, vacations, and leave. A SOC needs more than one position: triage, investigation, detection engineering, and management.
Added to this are the challenges of hiring and retaining analysts and the fatigue of people who spend the night analyzing alerts, increasing the likelihood of a real alert being classified as noise.
In-house, outsourced, or hybrid
In the internal model, an in-house team operates the SOC, with higher, mostly fixed costs, a long setup period, and deep business knowledge. In the outsourced model, a specialized partner operates it, with lower, predictable costs, a quick start, and insight into threats observed across multiple clients.
In the hybrid model, the partner operates and the internal team makes decisions, combining scale with business context. This model suits most companies that already have some security staff.
What testing reveals about detection
In the 2026 Cyber Risk Landscape, a Vultus study of 132 organizations, average maturity in the detect function was 1.82 on a scale of 0 to 5, and the average impact of simulated attacks was 8.28 out of 10. Most companies have a detection tool, yet the simulated adversary still progresses considerably before being contained. The bottleneck is usually in the operations surrounding the sensor.
The M-Trends 2026, from Google Cloud, reinforces this point: median attacker dwell time before detection rose to 14 days in 2025 and reached 122 days in espionage cases. The report also warns that 90-day log retention policies leave companies without visibility into prolonged intrusions.
Consider a fictional company with a monitoring platform and an analyst working business hours. At 3:12 a.m. on a Saturday, the platform records an administrator login from a country where the company does not operate, followed by account creation. On Monday, the alert sits among 340 others, and the attacker has had 54 hours.
Questions to ask before hiring a SOC
A few questions help compare providers:
- After hours: who acts on a critical alert overnight, and how quickly?
- Response: does the service investigate and respond, or merely forward the alert?
- Rules: who tunes detection to the environment, and how often?
- Retention: how long are records retained, and does that meet regulatory requirements?
- Indicators: are detection and response times included in the report?
- Outside the perimeter: does monitoring include leaked credentials and company mentions?
- Scale: how does pricing change as data volume grows?
There is also a governance issue: whoever operates the SOC should not be the one testing whether it works, as explained in the article on how to choose a pentesting company.
Hybrid SOC with automation and specialists
In SOC Vultus by Google SecOps, automation provides 24-hour coverage with detection, triage, and immediate response to known patterns, while specialists investigate and manage critical incidents. Explore Vultus SOC by Google SecOps and read about dark web monitoring.
