SOC (Security operations centre)

A security operations centre is a team, supported by tools and processes, that continuously monitors an organization's systems, investigates security alerts and coordinates the response to incidents.

A SOC brings together analysts, monitoring platforms such as SIEM and XDR, and documented procedures. Its job is to spot attacks early, separate real threats from false alarms and take action, whether that means isolating a computer, locking an account or escalating to an incident response team. Large enterprises may run their own, while smaller organizations typically use a shared, outsourced SOC.

Building an in-house SOC requires round-the-clock staffing, which is out of reach for most small and mid-sized Alberta businesses. An outsourced SOC, often delivered as part of a managed detection and response service, gives access to trained analysts and continuous monitoring for a fraction of the cost.

Practical tip: do not confuse a SOC with SOC 2, which is an audit report. When evaluating a SOC service, ask about hours of coverage, where analysts are located, which of your systems they will monitor and exactly what actions they are authorized to take without waiting for your approval.