Also known as: SOC · security operations centre
A security operations center (SOC) is the team and function responsible for continuously monitoring an organisation's environment for security threats, triaging alerts, and initiating incident response.
SOCs are typically tiered, with initial triage handling alert volume and escalation to more experienced analysts for genuine investigation. Coverage models range from business hours to full 24/7 rotation, often supplemented or replaced by a managed provider.
Analyst burnout is the chronic operational risk, driven overwhelmingly by false positive volume. SOC quality correlates far more strongly with detection tuning discipline than with tooling spend.
SIEM
A SIEM (Security Information and Event Management) system centralises log and event data from across an organisation's infrastructure, correlating it to detect suspicious activity and support investigation.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.
Threat Hunting
Threat hunting is the proactive search for attackers already present in an environment, driven by hypotheses about adversary behaviour rather than by alerts from automated detection tools.
EDR
EDR (Endpoint Detection and Response) is security software installed on endpoints that continuously records process, file, and network activity, detects suspicious behaviour, and enables remote investigation and containment.
Dwell Time
Dwell time is the length of time an attacker remains undetected inside a compromised environment, measured from initial intrusion to detection.