What are the red flags in a managed SOC offer?

The main red flags in a managed SOC offer are: a promise of total security, “24/7” cover with no named analyst at night, timings quoted without a definition, incident response excluded or quoted mid-crisis, unclear details on who operates the service and where logs are stored, and no exit terms. Each one can be checked with a simple question.

This article complements our guide How to choose a SOC provider by looking at the problem the other way round: what should make you slow down.

Ten red flags

Red flag	Why it is a problem	Question to ask
”No attack will get through”	No SOC can guarantee it	What exactly are you committing to?
”Zero false positives”	Going live without tuning is unrealistic	How does the tuning phase work?
24/7 with no detail	Nights may be covered by automation only	Who analyses a critical alert at 3am on a Sunday?
Undefined timings	An automated acknowledgement is not analysis	What does this timing measure, per severity?
Incident response on quote	Negotiation starts in the middle of a crisis	Who responds, how fast, at what agreed cost?
Unknown operator	Possible subcontracting, in unknown locations	Who runs the SOC, from where, with which employees?
Unclear log hosting	Your security data is sensitive	Where are logs stored, and for how long?
Implicit scope	The SOC may only see the EDR	Which sources are monitored, and which are not?
Generic reports	You cannot check the work done	Can you show me a sample report?
No reversibility	You are locked into the tool	What do we get back when the contract ends?

Promises that are too good

A SOC commits to means and timings: monitor, triage, alert, contain. An offer that promises outcomes (“you will never be breached”) or no false positives at all describes a service that does not exist. Every SOC onboarding includes a tuning period.

Be wary, too, of a pitch built on fear, heavy on worst-case scenarios and light on service detail. A good offer explains what it does, not just what might happen to you.

Vague coverage and timings

“24/7” can mean very different things: analysts on shift, an on-call person woken above a threshold, or a simple automated rule. See 24/7 SOC or business-hours monitoring?. Likewise, a timing only has value if it is defined and measured. See What SLA should you expect from a managed SOC?.

Incident response left out

Some offers stop at detection: the SOC warns you, then leaves you to find a response team. If incident response is optional or quoted separately, ask who responds, how fast and on what terms before you sign. See How to assess a SOC provider’s incident response capability.

Opacity about the operator and the data

It is reasonable to want to know who runs the service, from which country, with which employees or subcontractors, and where your logs are stored. ANSSI’s qualification frameworks in France, for instance, cover the provider and its staff as well as the service itself.

For MSPs: red flags specific to the partner model

• The provider can contact your clients directly or offer them a contract without you.
• Reports carry its brand, with no way to present them under yours.
• The console cannot separate your clients or manage permissions per technician.

How Cyna approaches it

Cyna works through its partner MSPs, who own the relationship with their clients. The SOC runs 24/7 from France with in-house teams, with human analysts on every alert, and monthly reports can be exported under the MSP’s brand, as CSV or PDF. The terms (scope, licences) are set out in the contract concluded with your partner MSP. Cyna’s certifications and security documents are available on its Trust Center.

Talk to an expert

Comparing several managed SOC offers? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Is a very low price a red flag?

Not necessarily, but you need to know what it covers: scope monitored, hours actually covered, incident response included or not. Compare offers on equal scope rather than on price alone.

Should you be wary of a SOC that relies heavily on automation?

No, automation helps triage and react quickly. The red flag is the absence of a human analyst for the decisions that matter, or vagueness about when a human steps in.

Should you rule out a provider with no certification?

Not automatically, but ask what evidence it can provide: ISO 27001 certification, any national qualification, references, a sample report.

What if several red flags appear?

Put your questions in writing and ask for the answers to be written into the contract. Written answers make it possible to compare offers on a clear basis. See Questions to ask a SOC provider before signing.