Glossary · Security Operations Centre
SOC
The 24/7 function — people, process, and tooling — that monitors security telemetry, triages alerts, and responds to incidents on an organisation's behalf.
A SOC (Security Operations Centre) is the operational function responsible for watching an organisation’s security telemetry around the clock, investigating alerts, and responding to incidents. It’s people first, tooling second.
The three delivery models
- In-house SOC — the organisation hires and runs its own analyst team. Realistic only for organisations large enough to staff 24/7 coverage — typically 5–7 analysts minimum, plus tooling and detection-engineering overhead. Rare below enterprise scale.
- Outsourced (MDR) — the SOC function is delivered by a specialist provider as a service. This is the dominant model for SMB and mid-market because the economics of a single in-house analyst team don’t make sense below a certain size.
- Hybrid — internal staff handle business-context triage and incident command; an external provider handles 24/7 monitoring and tier-1 response.
How Symsafe delivers SOC functions
Symsafe does not operate an in-house SOC. 24/7 SOC monitoring runs on a specialist MDR platform: the platform’s analysts watch telemetry around the clock, triage alerts, and escalate confirmed threats to Symsafe under formal SLAs. Investigation, containment and client communication are handled by Symsafe engineers, with the Sydney service desk coordinating on-the-ground response during incidents.
This is a deliberate architectural choice: at SMB scale, buying the monitoring layer from a platform whose entire business is detection produces better outcomes than a thinly-staffed internal analyst team, while keeping the response actions with the engineers who know each client’s environment.