24/7 SOC or business-hours monitoring: which should you choose?

For most organisations, a 24/7 SOC is the safer choice: business-hours monitoring covers roughly 50 of the 168 hours in a week, leaving nights, weekends and bank holidays without human analysis. Business-hours cover can suit a low-exposure environment, as long as you know exactly what happens outside those hours.

This article expands on one of the criteria in our guide How to choose a SOC provider.

The basic maths

A week has 168 hours. Business hours from 8am to 6pm, Monday to Friday, cover 50 of them, which is less than a third. The remaining two thirds are not quiet time for an attacker: nothing forces them to work during your office hours, and a period when nobody is watching alerts gives them time to move forward.

So the question is not only “how many alerts come in at night?” but “how long can an attack launched on Friday evening progress before anyone notices?”.

The three options

Option	Who watches outside business hours	Night-time reaction	Best suited to
24/7 SOC	Analysts on shift	Comparable to daytime	Most organisations, especially those in scope of NIS2
Business hours plus on-call	One person woken by critical alerts	Depends on the threshold and availability	Mid-sized environments with a sound escalation rule
Business hours only	Nobody, only automated blocking	Deferred to the next working day	Very low-exposure environments

24/7 SOC

Analysts monitor continuously. A night-time alert is handled like a daytime one: triaged, then contained if needed. It is the only option where reaction time does not depend on the clock.

Business hours plus on-call

Outside business hours, only alerts above a set threshold wake the on-call person. Everything hinges on that threshold: too high and weak signals slip through; too low and the on-call rota burns out. Weak signals are often the ones that herald an attack. See 3 weak signals an EDR can’t see without a SOC.

Business hours only

Outside business hours, only the tools react, with their automated blocking. Alerts that need a human decision wait until Monday morning. This can be acceptable when the systems in scope hold little sensitive data, offer no remote access and can be rebuilt quickly. Even then, document the choice and review it whenever the environment changes, for example when remote access or new cloud services are added.

How to choose

• Exposure: remote access, Microsoft 365 mailboxes, internet-facing servers, activity outside office hours.
• Impact of downtime: what does a day of disruption cost, and how long would recovery take?
• Regulatory framework: for entities in scope of NIS2, Article 23 of the directive provides for an early warning within 24 hours of becoming aware of a significant incident. Late detection delays that awareness, and with it the whole incident response.
• Internal resources: can your MSP or team sustain a credible on-call rota all year round, holidays included?

The MSP case

An MSP typically works business hours, sometimes with on-call cover. Relying on a 24/7 partner SOC lets it cover nights and weekends without hiring a night shift. The SOC monitors and contains; the MSP keeps the client relationship and handles remediation. See SOC for SMEs.

How Cyna approaches it

Cyna’s SOC runs 24/7 from France with in-house teams, with human analysts on every alert. Cyna’s CERT, a member of InterCERT France, works with the SOC teams and can be mobilised quickly. The incident response on-call team is available 24/7 from the Report an incident page. The terms of the SOC service (scope, licences) are set out in the contract concluded with the partner MSP.

Talk to an expert

Unsure what level of cover suits your organisation or your clients? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Is an EDR enough to cover nights and weekends?

An EDR blocks some threats automatically, at any hour. But it does not triage ambiguous signals or decide to isolate a critical server. See Do you need an EDR for a managed SOC?.

Is a 24/7 SOC always much more expensive?

For a company building its own SOC, round-the-clock cover means several teams on rotation. With a managed SOC, that cost is shared across many clients, which puts 24/7 cover within reach of smaller organisations. Price depends mainly on the scope monitored.

How can you check that a SOC is truly 24/7?

Ask who analyses a critical alert at 3am on a Sunday: an analyst on shift, someone on call or just an automated rule. Ask for timings per severity, by night as well as by day. See What SLA should you expect from a managed SOC?.