Glossary
SOC (Security Operations Centre)
A SOC is the team, process and tooling responsible for monitoring, triaging and responding to security events for an organisation.
Updated 2 Sept 2026
In detail
A SOC exists to shorten the time between something happening and someone doing the right thing about it. In practice that means an alert pipeline fed by a SIEM and EDR, documented triage playbooks, tiered analysts or a flatter on-call rotation, and defined escalation into incident response. SOCs may be in-house, outsourced to a managed provider, or a hybrid where a provider handles overnight coverage.
Why it matters
Detection tooling produces far more signals than any organisation can chase. The SOC is the function that decides which ones matter, and its quality is measured in dwell time and mean time to respond rather than alert volume. For anyone entering security, SOC analyst is still the most common first role because it exposes you to the whole estate.
Examples
- A tier-1 analyst triaging an impossible-travel sign-in alert and disabling the account pending verification.
- An escalation from EDR ransomware-behaviour detection to a full incident with host isolation.
- A weekly detection-tuning review that suppresses a noisy rule generating false positives from a backup agent.