What is a managed SOC?

A managed SOC is a security operations centre (SOC) run by an external provider on behalf of an organisation. The provider supplies the analysts, the detection tooling and the procedures. It continuously monitors the client’s security events, often around the clock, triages alerts and helps respond to incidents.

This article is part of our series on managed SOC. For the model delivered through managed service providers, see SOC for MSP: what it is and how it works.

The definition in three parts

A managed SOC combines three things:

1. People: analysts who review alerts, investigate and decide. Without analysts, it is a tool, not a SOC.
2. Technology: a platform that collects events (endpoints, servers, mail, firewalls) and applies detection rules.
3. Processes: what to do when an alert fires, who to notify, which actions to take, and how fast.

In a managed SOC, all three come from the provider. The client, or its MSP, stays in control of its IT and of decisions that affect it.

For the general definition of a SOC, in-house or external, see What is a SOC? Definition and how it works.

How a managed SOC works day to day

1. Collection: security events flow continuously into the provider’s platform.
2. Detection: rules, behavioural analysis and threat intelligence surface suspicious activity.
3. Triage: an analyst reviews each alert, discards false positives and confirms incidents.
4. Response: first containment actions, escalation to the client or its MSP, incident response team if needed.
5. Reporting: regular reports, metrics and recommendations.

What the SOC actually watches is detailed in What does a managed SOC monitor?.

Managed SOC vs in-house SOC

	Managed SOC	In-house SOC
Team	The provider’s, shared across clients	Yours, to hire and retain
24/7 coverage	Part of the service, as set out in the contract	Requires several analysts on rotation
Tooling	Supplied and maintained by the provider	To buy, integrate and maintain
Business context	Built up with the provider	Native
Time to start	A few weeks	Several months

We compared both models in detail for MSPs in Managed SOC vs in-house SOC: which should MSPs choose?.

What a managed SOC is not

• It is not an antivirus or an EDR. An EDR is a tool installed on endpoints; the SOC is the team that works its alerts and those from other sources.
• It is not traditional IT monitoring. A NOC watches availability and performance; a SOC watches for attacks. See SOC vs NOC: what is the difference?.
• It is not a guarantee of immunity. A SOC aims to reduce the time between the start of an attack and its detection, which can limit damage. It does not replace prevention.

Who is it for?

A managed SOC suits organisations that need continuous monitoring but cannot or do not want to build a dedicated team: SMEs and mid-sized companies, entities in NIS2 scope, and MSPs who want to offer the service to their clients.

MSPs play a particular role: they already run their clients’ IT. A managed SOC built for them lets them offer 24/7 monitoring under their own service. See Managed SOC and MSP: who does what?.

How to assess a managed SOC

A few benchmarks to compare offers:

• real coverage: 24/7 with analysts, or only automated alerts at night;
• available integrations with your tools;
• incident response capability;
• where it is operated and how data is handled;
• response time commitments and report content.

In France, ANSSI’s PDIS framework for qualifying security incident detection providers is a useful checklist of what to expect.

Talk to an expert

Cyna is a 24/7 managed SOC with a CERT team, run from France by in-house teams. Cyna works through its partner MSPs, who own the relationship with their clients; the terms (scope, licences) are set out in the contract concluded with the partner MSP. Cyna’s certifications and security documents are available on its Trust Center. If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Are managed SOC and outsourced SOC the same thing?

Yes, in everyday use both terms mean a SOC run by a provider. "Outsourced" stresses the choice not to run it in-house; "managed" stresses that a third party operates it for you.

Does a managed SOC see all my data?

It accesses the security logs and events needed for detection, not all your files. The collection scope, retention period and processing location should be set out in the contract.

Can a managed SOC be hybrid?

Yes. Some organisations keep a small internal team that handles part of the alerts and hand nights, weekends or certain scopes to a provider.

Do I need to change tools to move to a managed SOC?

Not necessarily, but the SOC must integrate with your tools, starting with the EDR. See Do you need an EDR for a managed SOC?.