What is included in a managed SOC, and what is not?

A managed SOC usually includes continuous monitoring, alert triage by analysts, first containment actions, escalation to the MSP or client and regular reports. In-depth incident response is only included in some offers. IT administration, patching and compliance stay outside its scope.

This article is part of our series on managed SOC. For the general principle, see SOC for MSP: what it is and how it works.

What is usually included

Item	What it covers
Onboarding	Connecting sources (EDR, Microsoft 365, firewalls) to the SOC platform
24/7 monitoring	Analysts on duty day and night, weekends included
Detection	Rules, behavioural analysis, threat intelligence, tuned over time
Triage	Human review of every alert, false positives removed
Containment	First-line actions agreed in advance (isolating an endpoint, blocking an account)
Escalation	Alerting the right contacts according to a set procedure
Reports	Regular summary of activity, incidents and recommendations
Platform	Console access to follow alerts and incidents

What varies between offers

Incident response. This is the most important point to check. Some SOCs stop at detection and alerting; others include an incident response team (CERT) that investigates, contains a wider attack and supports recovery. At Cyna, incident response is handled by its CERT, a member of InterCERT France, which works with the SOC teams and can be mobilised quickly; the incident response on-call team is available 24/7 from the Report an incident page.

Remote actions. A SOC that can isolate an endpoint through the EDR can act quickly; a SOC that sends an email waits for someone to react. See Do you need an EDR for a managed SOC?.

Sources covered. Not every offer monitors Microsoft 365 or firewalls. See What does a managed SOC monitor?.

Licences. Some offers include the EDR, others do not. Cyna integrates natively with SentinelOne and Microsoft Defender; licence terms are set out in the contract concluded with your partner MSP.

Report format. For an MSP, per-client reports it can brand as its own make a real difference. On the Cyna platform, monthly reports can be exported white-labelled.

What is usually not included

• IT administration: updates, patching, account management. That is the job of the MSP or internal team.
• Full remediation: rebuilding a server, restoring backups, hardening a configuration. The SOC advises, the MSP executes. See Managed SOC and MSP: who does what?.
• Audits and penetration tests: separate, point-in-time services.
• The compliance programme: a SOC provides useful evidence but does not replace a NIS2 or ISO 27001 programme. See Does a managed SOC help with NIS2?.
• Staff awareness: training and phishing simulations are separate services.

Questions to ask before signing

1. Do analysts really monitor 24/7, or is the night covered by automated alerts?
2. Which actions can the SOC take itself, and how fast?
3. Is incident response included, and how far does it go?
4. Which sources are natively integrated?
5. Where are the service and the data operated?
6. What do the reports contain, and how often?

In France, ANSSI’s PDIS framework for qualifying security incident detection providers is a useful checklist for these points.

Talk to an expert

Cyna operates a 24/7 SOC from France, alongside its CERT, and works through its partner MSPs; the terms of the service are set out in the contract concluded with the MSP. Cyna’s certifications and security documents are available on its Trust Center. If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Are EDR licences included in a managed SOC?

It depends on the offer. Cyna integrates natively with SentinelOne and Microsoft Defender; the terms (scope, licences) are set out in the contract concluded with your partner MSP.

Does a managed SOC do penetration testing?

No, that is a separate service. A pentest assesses security at a point in time; a SOC monitors continuously. The two complement each other.

Does the SOC handle crisis communication?

It provides the technical facts (what happened, what was affected). Communication with customers, partners or authorities remains the business's responsibility, supported by its MSP.

Does the SOC do proactive threat hunting?

Some offers include threat hunting: analysts look for signs of attack without waiting for an alert. Ask whether it is included and how often.

Is vulnerability management part of a managed SOC?

Sometimes, as a dashboard of known vulnerabilities across the estate. Fixing them remains the MSP's or internal team's job. The Cyna platform provides a vulnerability dashboard and monthly reports.