What is a security operations center (SOC)?
A security operations center (SOC) is the team, processes and tools that monitor an organization for threats, investigate alerts and respond to incidents, often around the clock. It can be in-house, outsourced or a mix.
How it works
SOC analysts work from the SIEM, EDR and other tools, triaging alerts by severity, escalating real incidents and coordinating containment.
Many SOC alerts start with a person: a reported phish, a risky sign-in, a DLP event. Reducing people-driven risk upstream reduces the SOC’s load.
Why it matters
The SOC is the last line before an incident becomes a breach. Fewer avoidable alerts give analysts time for the real ones.
