Security Operations Centres were known for years as activity involving people, process and limited technology. They were largely about the physical side of the threat landscape rather than the virtual side. As technology and solution sets have evolved, sophisticated systems have become the component most frustrating to master and most difficult to maintain within an organisation.
Tools are becoming more complicated, require more advanced training. Threat hunting has become more an art than a science. The industry needs to find stability in its current tools, people and processes, and extract value from what is already in place rather than always chasing the next product.
The people and technology balance
Gartner observed that organisations with effective SOCs put the premium on people rather than technology or process. In practice, the right technology matters too. Highly skilled team members leave companies because of lack of executive buy-in and budget for the right tools and process. If an organisation invests heavily in its team without the supporting tooling, expect turnover. Smart teams know when they are set up to fail and look elsewhere for the right culture and leadership.
Where this is going
Today's SOC is changing and the need for automation is becoming mission critical. The security orchestration market was projected to be worth 1.6 billion dollars by 2021, and we are still early.
As organisations grow or mature their security capabilities, a properly configured SOC becomes more evident. Operational security functions, processes and departments justify a centralised, coordinated operations centre.
What the SOC covers
- Cyber incident management
- Vulnerability management
- Threat intelligence and hunting
- Network monitoring and detection
- Governance and compliance management
- Physical security and physical threat management
Common pitfalls
Organisations debate fully outsourcing versus doing a better job in-house at lower cost. Building a next-generation SOC takes months, sometimes years, to plan, execute and deploy across team, tools and processes. Companies need to think beyond the traditional "throw bodies at the problem" approach.
Originally published 28 October 2016. Migrated to the new IRC site in 2026.