Tier-less SOC

A tier-less SOC forgoes the classic division into Level 1, 2, and 3 analysts. A Case remains with the same person or small team from the initial Alert until its resolution.

How it works

In a traditional model, Level 1 analysts triage Alerts and escalate based on checklists. Level 2 investigates, and Level 3 handles complex incidents. Every handover costs time and loses context. In a tier-less SOC, automation handles the initial triage and enrichment of Alerts. Experienced analysts then manage the entire Case from start to finish.

For example

An Alert for a suspicious login is generated. Automation enriches it with device information, location, and the account's login history. The analyst immediately sees the full picture, makes a decision, and initiates containment. A handover to another analyst is not required.

What to look out for

• Automation and enrichment: Without effective automation, routine work is simply shifted to senior analysts.
• Analyst experience: The model only works with analysts who can investigate independently.
• Traceability: A complete and clear audit trail is vital, even without formal handovers.
• Key metrics: Compare MTTR and the number of handovers per Case before and after the switch.

Why it matters

Many SOC delays do not happen during analysis itself. They occur while waiting for the next tier. Reducing handovers directly shortens the overall response time.

Questions to ask a provider

Ask how many people handle a typical case before it is closed. Have them show you which steps are automated and which a person performs. Clarify how experienced the analysts are at night. A tier-less model is of little use if only junior staff work at night. Also ask how knowledge from a case flows back into detection and playbooks.

How we implement it

The tier-less approach is our standard operating model. Automation and Agentic AI prepare each Case, which our analysts then manage through to completion.