1.1 SOC Operating Models

SOC Operating Models

Introduction

A SOC operating model defines how security monitoring, detection, and response are staffed and delivered. The model you choose determines your coverage hours, your response speed, your staffing costs, and your ability to scale. There is no universally correct model — the right choice depends on your organization’s size, budget, risk tolerance, and existing security maturity.

This subsection describes the four primary operating models, their trade-offs, and selection criteria. Most mid-sized organizations do not operate a pure model — they run a hybrid that combines elements based on their specific constraints.

Model 1: Dedicated in-house SOC

What it is: A fully staffed security operations team employed by the organization, operating from a dedicated facility or virtual workspace. All analysts, detection engineers, and incident responders are internal employees.

Coverage: Typically 8×5 (business hours) for smaller teams, 24×7 for larger teams. 24×7 requires a minimum of 5–6 analysts to cover three shifts with redundancy for leave and training.

Advantages:

• Complete control over detection rules, investigation priorities, and response actions
• Deep institutional knowledge — analysts understand the business, the users, the environment
• No data sharing with external parties
• Fastest response for high-severity incidents (no handoff delay to a third party)

Disadvantages:

• Expensive — 24×7 coverage with qualified analysts, a SOC manager, and a detection engineer costs $400,000–$600,000+ annually in the UK
• Recruitment and retention challenge — experienced SOC analysts are in high demand
• Single point of failure for expertise — if your senior analyst leaves, institutional knowledge leaves with them
• Requires investment in training, tools, and continuous development to keep pace with the threat landscape

Best for: Large organizations (1,000+ employees) with significant security budgets, regulated industries requiring data sovereignty, or organizations with unique threat profiles that generic managed services cannot adequately address.

Model 2: Managed SOC (MSSP / MDR)

What it is: Security monitoring and initial triage are delivered by an external managed security service provider (MSSP) or managed detection and response (MDR) provider. The provider operates their own SOC and monitors your environment alongside other clients.

Coverage: Typically 24×7 — the provider’s SOC operates continuously across their client base.

Advantages:

• 24×7 coverage without the cost of staffing three shifts internally
• Access to the provider’s collective threat intelligence across their client base
• Faster time to operational than building an internal team from scratch
• Predictable costs (monthly subscription rather than salary and benefits)

Disadvantages:

• Limited customization — the provider’s detection rules and playbooks are designed for their entire client base, not your specific environment
• Handoff friction — when the provider identifies a potential incident, there is a handoff to your internal team for investigation and containment. This handoff adds latency and can lose context.
• Less institutional knowledge — the provider’s analysts do not understand your business processes, your user behavior patterns, or your organizational context
• Data sharing — your log data flows to the provider’s platform, raising data sovereignty and confidentiality considerations
• Alert fatigue transfer — many MSSPs generate high volumes of low-context alerts and declare them “your responsibility to investigate”

Best for: Small to mid-sized organizations (100–1,000 employees) that need 24×7 coverage but cannot justify the cost of an internal 24×7 team. Organizations early in their security maturity journey that need immediate monitoring while building internal capability.

Model 3: Hybrid SOC

What it is: Internal analysts handle business-hours monitoring, investigation, and response. An external provider handles after-hours monitoring and initial triage. Complex investigations and containment are escalated to the internal team regardless of the hour.

Coverage: 24×7 through the combination of internal (business hours) and external (after hours).

Advantages:

• 24×7 coverage at lower cost than a fully internal 24×7 team
• Internal team retains deep investigation and response capability
• The external provider handles the highest-volume, lowest-complexity work (overnight alert triage)
• Internal team focuses on high-value work: detection engineering, complex investigations, improvement

Disadvantages:

• Handoff complexity — transferring context between internal and external teams at shift boundaries
• Requires clear escalation criteria so the external provider knows what to escalate versus what to handle independently
• The external provider’s quality determines overnight coverage quality — if they miss something at 02:00, you find out at 08:00
• Contract management overhead — SLAs, performance reviews, and relationship management

Best for: Mid-sized organizations (200–2,000 employees) with a small internal security team (2–5 people) that cannot staff 24×7 but need continuous coverage. This is the most common model for organizations at intermediate security maturity.

Model 4: Virtual SOC

What it is: Security monitoring responsibilities are distributed across IT team members who have other primary roles. There is no dedicated SOC team — instead, IT administrators, network engineers, and system administrators share monitoring duties alongside their primary responsibilities.

Coverage: Best-effort during business hours. No dedicated after-hours coverage.

Advantages:

• Lowest cost — no dedicated security headcount
• Leverages existing IT team knowledge of the environment

Disadvantages:

• Security monitoring is always secondary to primary job responsibilities — when a server goes down at the same time an alert fires, the server gets attention first
• No consistent investigation quality — each team member has different security skills and different approaches
• No detection engineering, no playbook development, no systematic improvement
• Reactive only — incidents are discovered when they become visible problems, not when detection rules fire

Best for: Small organizations (under 100 employees) with no security budget. This model is a starting point, not a destination. The goal should be to mature into a hybrid or managed model as the organization grows.

Selecting your model

Most organizations in this course’s target audience — mid-sized companies running M365 with 1–5 security staff — operate a hybrid model or a managed model. The detection rules, playbooks, and documentation from this course are designed to work within any model, but they deliver the most value in hybrid and dedicated models where the internal team has the authority and capacity to deploy and maintain them.