SOC for MSP: what it is and how it works

A SOC for MSP is a security operations centre that monitors the IT environments of a managed service provider’s clients around the clock. A specialist provider runs it, but the MSP offers it to its own clients. The MSP adds threat detection and incident response to its services without hiring analysts or building an in-house SOC.

This page is the entry point to our series on managed SOC. It explains the principle, how it works and the partnership model, then links to a dedicated article for each question.

Why a SOC “for MSPs”?

An MSP already manages its clients’ endpoints, servers, Microsoft 365 and network. It is the first port of call when an incident happens. But watching for signs of attack continuously, at night and at weekends, is a separate job: trained analysts, detection tooling, procedures, and a team large enough to cover 24 hours.

For most MSPs, building that team makes no economic sense. A SOC for MSPs solves this: a specialist runs monitoring for many MSPs, and each one offers it to its clients under its own service.

Two trends make this model increasingly expected:

• MSP clients face growing security requirements, notably under NIS2, which provides for incident handling and an early warning within 24 hours for significant incidents;
• MSPs themselves may be affected: Annex I of the NIS2 Directive lists managed service providers, with applicability then depending on each provider’s size and situation.

How a SOC for MSPs works

1. Onboarding

The SOC connects to client data sources: the EDR on endpoints and servers, Microsoft 365, firewalls, sometimes Google Workspace. At Cyna, native integration covers SentinelOne and Microsoft Defender EDRs, and connecting a standard environment is quick.

2. Monitoring and detection

Events flow continuously into the SOC platform. Detection rules and behavioural analysis surface suspicious activity: an unusual sign-in, a new mail forwarding rule, an attack tool running, lateral movement. See What does a managed SOC monitor?.

3. Triage by an analyst

Every alert is reviewed by an analyst, who discards false positives and confirms real incidents. That is what sets a SOC apart from a monitoring tool. See SOC vs NOC: what is the difference?.

4. Escalation and response

When an attack is confirmed, the SOC takes the agreed first actions (for example isolating an endpoint through the EDR), alerts the MSP according to the agreed procedure, and brings in an incident response team if needed. See What happens when a managed SOC detects an attack?.

5. Reporting

The MSP receives per-client reports it can pass on to its clients. At Cyna, these monthly reports can be exported white-labelled.

Who does what between the SOC and the MSP?

The split of roles is the heart of the model:

Role	MSP	SOC
Client relationship, contract, billing	Yes	No
IT administration	Yes	No
24/7 monitoring and detection	No	Yes
Alert triage	No	Yes
First containment actions	Per procedure	Yes
Remediation and recovery	Yes, with SOC or CERT support	Support

Details are in Managed SOC and MSP: who does what?.

What a SOC for MSPs should offer

Offers vary. Four points deserve close attention:

1. A multi-client platform, with strict separation between clients and a consolidated view for the MSP. See What is a multi-tenant SOC for MSPs?.
2. Native integrations with the tools clients actually use, especially the EDR. See Do you need an EDR for a managed SOC?.
3. Incident response capability, not just detection. See What is included in a managed SOC?.
4. Respect for the client relationship: a model where the provider works through the MSP, which keeps the relationship with its clients.

SOC for MSPs, managed SOC, SOC as a service: what is the difference?

The three terms describe closely related things:

• Managed SOC: a SOC run by a provider on behalf of an organisation. See What is a managed SOC?.
• SOC as a service: the same idea, seen through the consumption model, on subscription. See What is SOC as a service?.
• SOC for MSPs: a managed SOC designed to be resold and delivered through MSPs, with the multi-client features and commercial model that go with it.

For the general definition of a SOC, see What is a SOC? Definition and how it works.

Environments covered

A SOC for MSPs focuses on what MSPs manage every day: endpoints and servers (through the EDR), Microsoft 365 identities and mail, and the network through firewalls. Microsoft 365 monitoring has become central, as many attacks start with a compromised mailbox. See Does a managed SOC monitor Microsoft 365?.

How regulators frame detection providers

In France, the national cybersecurity agency ANSSI has a qualification framework for security incident detection providers (PDIS). Qualification is not mandatory for most businesses, but the framework sets out what is expected from a detection provider: skills, organisation, protection of collected data. It is a useful lens for assessing any offer.

The NIS2 angle

The text of NIS2 does not mention an obligation to have a SOC. It does provide for incident handling (Article 21) and an early warning within 24 hours for significant incidents (Article 23). Without continuous monitoring, meeting that deadline is hard. A SOC for MSPs lets an MSP support its regulated clients, and organise itself for its own requirements if it is in scope. See Does a managed SOC help with NIS2? and our series Who does NIS2 apply to?.

The Cyna model

Cyna is a managed SOC built for MSPs. In practice:

• a 24/7 SOC run from France by in-house teams, with human analysts on every alert;
• a CERT for incident response, a member of InterCERT France, whose on-call team is available 24/7 from the Report an incident page;
• a multi-client platform, with monthly reports that can be exported white-labelled;
• an indirect model: Cyna works through its partner MSPs, who own the relationship with their clients.

Cyna is ISO 27001 certified; its certifications and security documents are available on its Trust Center.

Partnership details are on our Partner programme page.

Common mistakes when starting out

Connecting too few sources. A SOC that only sees the EDR misses mail-based attacks; a SOC that only sees Microsoft 365 is blind on endpoints. The EDR plus Microsoft 365 is the minimum baseline.

Not defining authorised actions. If the SOC needs the MSP’s approval to isolate an endpoint at 3am, the attacker stays ahead. Containment actions are agreed at onboarding.

Letting the escalation procedure go stale. An on-call number that no longer answers, a contact who has left: the procedure must be tested and updated regularly.

Selling monitoring without explaining its limits. A SOC sharply cuts detection time; it does not make anyone invulnerable. A clear offer on what is covered, and who does what, avoids misunderstandings with the client.

Forgetting the reports. They make the value of the service visible to the end client. Presenting and discussing them regularly is part of the MSP’s offer.

What changes for the MSP’s own business

Adding a SOC changes how an MSP sells and works. Security becomes a recurring service in its catalogue rather than a one-off project. Conversations with clients move from tools to outcomes: how fast an attack is spotted, what happens next, what evidence the client gets. And the MSP’s own teams spend less time chasing raw alerts, because triage is done upstream.

Where to go next

If you are new to the topic, start with What is a managed SOC? and What does a managed SOC monitor?. If you are already comparing offers, go straight to What is included in a managed SOC? and Do you need an EDR for a managed SOC?. If your clients are asking about regulation, read Does a managed SOC help with NIS2?.

Talk to an expert

Are you an MSP looking to offer 24/7 monitoring to your clients? Get in touch to see the platform and talk it through. Are you a business? Ask your MSP: if it is a Cyna partner it can offer it to you, otherwise we can point you to a partner.

Frequently asked questions

Is a SOC for MSPs only for large providers?

No. The model is designed so that an MSP with a handful of staff can offer 24/7 monitoring without a dedicated team. The real work is in organising escalation and packaging the offer.

Does the SOC talk directly to the MSP's clients?

It depends on the provider. Cyna works through its partner MSPs, who own the relationship with their clients. See Managed SOC and MSP: who does what?.

How long does it take to get started?

When integrations are ready, technical onboarding is quick. Fine-tuning detection rules and escalation procedures then takes a few weeks.

Does a SOC for MSPs cover compliance too?

It provides detection, incident handling and evidence (logs, reports) that help with NIS2 or ISO 27001. It does not replace the compliance programme itself. See Does a managed SOC help with NIS2?.