A team and facility that monitors an organization's systems around the clock to detect, analyze, and respond to cybersecurity threats.
A security operations center (SOC) is the nerve center of an organization's defense. Analysts watch alerts generated by tools that collect logs and telemetry from networks, endpoints, cloud services, and applications, often through a security information and event management platform.
SOC work is typically organized in tiers. Entry-level analysts triage alerts and filter false positives, more senior analysts investigate confirmed incidents, and threat hunters proactively search for hidden attackers. SOCs coordinate incident response, apply threat intelligence, and continuously tune detection rules. Smaller organizations often outsource this function to managed security service providers. Common challenges include alert fatigue, staffing shortages, and keeping up with fast-changing threats, which is driving adoption of automation and AI-assisted analysis.
An organization's structured process for detecting, containing, investigating, and recovering from security incidents.
Managed Detection and ResponseAn outsourced security service, known as MDR, in which a provider monitors an organization's systems around the clock and responds to threats.
SOC 2An auditing framework from the AICPA that assesses how a service company protects customer data, based on five trust services criteria.
Security Information and Event ManagementA security system, known as SIEM, that collects and analyzes log data from across an organization to detect threats and support investigations.
Threat IntelligenceEvidence-based information about cyber threats, attackers, and their methods, used to anticipate and defend against attacks.
XDRExtended Detection and Response: a security approach that combines data from endpoints, networks, email, cloud, and identity to detect and stop threats.
A practical roadmap to becoming a cybersecurity analyst: the skills employers want, which certifications to earn first, realistic entry paths and official BLS pay data.
What a SOC does, the roles and tiers inside one, the tools it relies on and how to choose between building in-house, outsourcing to MDR or a hybrid model.
EDR and XDR are tools. MDR is a team. Here's one clear chart showing what each covers, who runs it and which one a small or mid-sized business actually needs.