Definition
SOC as a service
SOCaaS
In one sentence
SOC as a service (SOCaaS) is a subscription model in which a provider operates a security operations centre on behalf of a client, supplying the analysts, technology and processes for 24/7 monitoring, investigation and response.
Security operations centreManaged detection and responseSecurity information and event management
SOC as a Service Explained
SOC as a service gives organizations the capabilities of a security operations centre without hiring a team or buying and running the platforms themselves. The provider ingests logs and alerts from the client's environment, monitors them continuously, investigates suspicious activity and either takes containment action or escalates with clear guidance.
Scope varies considerably between providers. Some focus on endpoints, others cover identity, email, cloud workloads, firewalls and SaaS applications. Some include a SIEM with long-term log retention for compliance, while others concentrate on detection and response. The line between SOC as a service and MDR is blurry; what matters is what is monitored, who responds and how fast.
For Canadian SMBs, important questions include where logs are stored and processed, given privacy obligations under PIPEDA and Quebec Law 25; whether incident response is included; how the provider works with the existing IT provider; and what reporting is provided for management, auditors and cyber insurers.
General information for Canadian organizations, not legal advice.