Security operations centre (SOC)
Also known as: security operations center, SOC team, security operations centre
A security operations centre (SOC) is the team and set of tools responsible for monitoring an organization's networks, devices, and cloud services for threats, investigating alerts, and responding to incidents, often 24 hours a day.
It can be built in-house or bought as a service from a managed provider. While a SOC is central to modern security, an understaffed one drowning in alerts can miss real attacks, so tuning and automation matter as much as headcount.
Security operations centre (SOC), explained at three levels
At home
A SOC is like a security guard room with screens showing every camera, except it watches computer systems for signs of hackers instead of people in hallways.
At work
A SOC gives organizations constant monitoring, so attacks are spotted and stopped before they cause major damage.
At home
SOC analysts look at alerts from security tools, decide which are real threats, and take action, such as locking an account or isolating an infected laptop.
At work
SOCs use SIEM, EDR, threat intelligence, and ticketing systems, with tiered analysts for triage, investigation, and incident response. Key metrics include mean time to detect and mean time to respond. Many organizations use MDR providers for 24/7 coverage.
At home
SOC work can be stressful, with long shifts and endless alerts. In my opinion, burnout is one of the biggest hidden risks in cybersecurity.
At work
Effectiveness depends on log coverage, detection quality, playbooks, authority to act (such as isolating systems without waiting for approval), and integration with IT. When outsourcing, clarify response responsibilities, escalation paths, data residency, and service levels.
Real-world examples
At home
Sophie's bank texted her within minutes when someone tried to sign in to her account from overseas. The alert came from the bank's SOC noticing the unusual login.
At work
Thomas runs IT for a 150-person Ottawa consulting firm. Instead of hiring a 24/7 team, he contracted a managed SOC service, which caught a compromised account at 3 a.m. and disabled it immediately.
How it compares
| feature | Security operations centre (SOC) | Network Operations Center (NOC) |
|---|---|---|
| Focus | Security threats | Network performance and uptime |
| Watches for | Attacks, breaches, suspicious activity | Outages, slowdowns, failures |
| Typical tools | SIEM, EDR, threat intelligence | Network monitoring, ticketing |
| Goal | Protect | Keep running |
The NOC keeps systems up. The SOC keeps attackers out.
For analysts
When choosing a managed SOC, I'd ask exactly what they'll do at 3 a.m.: just alert you, or act? The answer determines whether an attack is stopped or merely reported.
History & origin
Military and government agencies set up network security monitoring centres in the 1990s, and large banks and telecoms followed. Security information and event management (SIEM) tools, emerging in the mid-2000s, gave SOCs central views of logs. As attacks grew and skilled staff became scarce, managed security service providers and, later, managed detection and response (MDR) services offered SOC capabilities to smaller organizations. Automation tools known as SOAR, along with AI-assisted investigation in the 2020s, aimed to reduce analyst workload. In Canada, the Canadian Centre for Cyber Security supports government and critical infrastructure monitoring. In my view, for most small and mid-sized organizations, buying a SOC service is smarter than building one.