How we verify SOC providers

What we track

We track provider facts that affect shortlisting: service model, response ownership, coverage areas, target buyer, platform approach, pricing signals, compliance claims, SOC regions, onboarding notes, and questions a buyer should ask before contracting.

The directory currently includes 41 provider profiles, 24 comparison pages, and 1 guide page.

How profiles are researched

1. Collect public sources. We start with provider websites, product documentation, pricing pages, press releases, public partner pages, compliance pages, customer reviews, buyer stories, and other sources a buyer could verify.
2. Review provider input. Providers can send corrections or additional information, but submitted claims are reviewed before publication and are not copied into profiles as marketing copy.
3. Normalize the claims. Provider language is mapped into shared fields: service type, response level, technology approach, coverage, compliance, target market, and public pricing signal.
4. Write buyer-side summaries. Profiles are written to explain the service in plain language, not to repeat vendor positioning.
5. Remove weak facts. If a field is not clear enough to publish, we omit it instead of showing placeholders such as unknown or not published.

Editorial rules

• No paid rankings, paid placements, or provider-sponsored profile order.
• No invented scores, star ratings, or review totals.
• No “best overall” claims where buyer context matters.
• No placeholder facts when the public evidence is weak.
• No marketing copy copied into profiles as-is.

What we do not verify

We do not perform private security testing, penetration testing, live incident simulations, or contractual due diligence for every provider. Public information can show scope, positioning, and buying signals, but it cannot prove day-to-day analyst quality.

We work to keep the directory accurate, but we cannot guarantee that every provider fact, price signal, integration claim, compliance claim, or service detail is complete or current at all times. Provider offerings change, public pages move, and customer experiences vary.

Buyers should still ask for sample investigations, detection methodology, escalation paths, response authority, references, and proof-of-concept results before signing.

Corrections

If a provider profile is inaccurate or out of date, send the correction and source link to [email protected]. We review factual corrections and update profiles when the evidence supports the change.