What Is a SOC? Build In-house or Buy as a Service?

What a Security Operations Centre does, its real cost and how to choose the right model for your organisation.

A Security Operations Centre (SOC) is the function that continuously monitors, analyses and responds to an organisation’s cyber security events. It turns thousands of alerts from firewalls, EDR, e-mail and cloud services into prioritised, actionable events that people can understand.

Components of a SOC

People: tier 1, 2 and 3 analysts, threat hunters, detection engineers
Process: alert triage, incident classification, escalation, post-mortem
Technology: SIEM, SOAR, EDR/XDR, threat intelligence, case management

The real cost of an in-house SOC

24/7 coverage needs at least 8–10 analysts (allowing for shifts, leave and sickness). In Türkiye an experienced analyst costs on average 120–180 thousand TRY per month in total. Adding SIEM licensing, storage and detection engineering, the annual budget easily reaches 15–25 million TRY. Analyst turnover is also high; knowledge walks out of the door.

When does a managed SOC make sense?

Fewer than 500 endpoints or a limited security budget
A need for fast deployment (weeks, not months)
Organisations needing out-of-hours cover without a 24/7 team
A need for auditable, reportable structure for compliance

Hybrid model

Most mid-sized and large organisations get the best result from a hybrid model: a managed SOC runs 24/7 triage and first response, while the in-house security team provides business context, critical asset knowledge and decision authority.

Questions to ask when choosing

Performance and SLA: what is the first-response time on critical alerts and how is it measured?
Where is the data stored?
Is it notification only, or are response actions taken too?
Are the reports suitable for presenting to the board?

Our SOC plans come in three levels: Essential, Business and Enterprise. To choose the right level you can take our maturity test or talk to one of our experts.

Success metrics

A SOC’s value is measured not by alert count but by these metrics: mean time to detect (MTTD), mean time to respond (MTTR), false-positive rate and the share of MITRE ATT&CK techniques covered by detection. Ask your provider for these metrics monthly and set quarterly targets.