What is a SOC? Definition, tasks and structure

A Security Operations Center (SOC) is a team of people, processes and technology. It monitors an organisation's IT and OT environment around the clock, detects attacks and coordinates the response. A SOC is not a piece of software; it is an operating unit.

All

What a SOC does

  • Continuous monitoring of logs, endpoints, network and cloud
  • Triage and investigation of every alert
  • Threat hunting beyond existing rules
  • Incident response, including containment and recovery coordination
  • Reporting to management and regulator

Tools: SIEM, EDR, SOAR

SIEM collects and correlates logs. EDR delivers endpoint telemetry and response. SOAR automates repeatable playbooks. None of these technologies alone is a SOC. A SOC is the team that orchestrates them.

The classic tier model and why it is outdated

Historically a SOC was split into Tier 1 (triage), Tier 2 (investigation) and Tier 3 (hunting/engineering). Modern SOCs drop the rigid split: automation and agentic AI handle triage, and every analyst works with contextualised alerts.

SOC vs. NOC

A NOC (Network Operations Center) manages availability and performance. A SOC manages security. Both run 24/7. A NOC asks whether systems are running; a SOC asks whether they are compromised.

Frequently asked questions

What does a SOC analyst do?

SOC analysts review alerts, weigh context, decide on response and coordinate with IT and management. Modern analysts focus on decisions and avoid spending time copying and pasting between consoles.

What is the difference between SOC and NOC?

A NOC monitors availability and performance; a SOC monitors security events and attacks.

Does an SME need a SOC?

Yes, as soon as an incident would seriously affect operations. For SMEs, an outsourced managed SOC is usually the only economical option.

What is the difference between SOC and MDR?

A SOC is the operating unit; MDR is a service model with a contractual commitment to respond. Read more on [SOC vs. MDR](/en/soc/soc-siem-edr-xdr-mdr-terms).

How long does it take to set up a SOC?

An in-house SOC build takes several weeks to months for onboarding, plus several quarters to mature. A managed SOC delivers operations within the [onboarding phase](/en/soc/soc-onboarding-switzerland).

Continue reading in this cluster
SOC as a Service in Switzerland: The Complete Guide
SOC as a Service is an externally operated Security Operations Center that monitors your environment around the clock, detects attacks and triggers the response. According to Mandiant M-Trends 2026, attackers went undetected for a median of 14 days in 2025. With a SOC that detects and assesses around the clock, typical detection time becomes much shorter.
SOC, SIEM, EDR, XDR, MDR: the terms explained
SOC is the function; SIEM, EDR and XDR are tools; MDR is a service. The label matters less than whether response happens and in whose mandate. At ANOMAL, SOC as a Service covers detection and response and is often called MDR; a managed SIEM is part of the SOC with analysts and response in the mandate. Customers keep their existing tools.
SOC for SMEs in Switzerland: what is realistic, what it costs, what makes sense
For Swiss SMEs between 50 and 500 endpoints, managed SOC is almost always the right answer. An in-house SOC rarely pays off at that size: one 24/7 seat covers 8,760 hours, which requires at least 5 to 6 full-time roles and a capable platform. Managed SOC delivers 24/7 detection, documented response and regulatory evidence for revFADP (revised Federal Act on Data Protection), ISG and customer contracts.
Look up short definitions in the glossary

Related terms