SOC provider glossary

A Security Operations Center is a centralized facility or team responsible for monitoring, detecting, analyzing, and responding to cybersecurity threats and incidents on an ongoing basis.

A Managed Security Service Provider is a third-party company that provides outsourced monitoring and management of security devices and systems, including managed firewalls, intrusion detection, VPN, vulnerability scanning, and SOC services.

Managed Detection and Response is a cybersecurity service that combines technology and human expertise to perform threat hunting, monitoring, and response to detected threats, going beyond traditional alert-based monitoring.

SOC as a Service is a subscription-based model where a third-party provider delivers full security operations center capabilities — monitoring, detection, investigation, and response — as a managed cloud service.

Managed SIEM is a service where a third-party provider deploys, manages, and monitors a SIEM platform on behalf of the customer, handling log ingestion, rule tuning, alert triage, and compliance reporting.

Managed EDR is a managed service that provides outsourced monitoring, investigation, and response for an organization's endpoint detection and response platform.

Extended Detection and Response is a security approach that collects and correlates data across multiple security layers — email, endpoint, server, cloud workloads, and network — to provide unified threat detection and response.

A Virtual Chief Information Security Officer is an outsourced security executive who provides strategic security leadership, risk assessment, and compliance guidance on a fractional or part-time basis.

SIEM is a security solution that aggregates and analyzes log data from across an organization's IT infrastructure to detect anomalies, threats, and security events in real time.

SOAR refers to technologies that enable organizations to collect security threat data, automate responses to low-level threats, and orchestrate complex incident response workflows.

Endpoint Detection and Response is a cybersecurity technology that continuously monitors end-user devices to detect and respond to cyber threats like ransomware and malware.

Network Detection and Response is a security solution that monitors network traffic in real time, using behavioral analytics and machine learning to detect threats that bypass traditional perimeter defenses.

Incident Response is the organized approach to addressing and managing the aftermath of a security breach or cyberattack, with the goal of limiting damage, reducing recovery time and costs.

Digital Forensics and Incident Response combines the disciplines of investigating cyberattacks to determine what happened (forensics) and containing and remediating the threat (incident response).

Threat hunting is the proactive practice of searching through networks and systems to detect and isolate advanced threats that evade existing automated security solutions.

Detection engineering is the practice of designing, building, testing, and maintaining threat detection rules and logic within security platforms. Detection engineers create and tune the alerts that SOC analysts investigate.

A false positive is a security alert that incorrectly indicates a threat or malicious activity when none actually exists, consuming analyst time and contributing to alert fatigue if not properly managed.

Mean Time to Detect is a key SOC performance metric that measures the average time elapsed between the onset of a security threat or incident and when the security team first identifies it.

Mean Time to Respond is a key SOC performance metric that measures the average time from when a security threat is detected to when containment or remediation actions are initiated.

User and Entity Behavior Analytics uses machine learning and statistical analysis to establish baseline behavior patterns for users and devices, then detects anomalies that may indicate compromised accounts, insider threats, or policy violations.

Cloud Security Posture Management is a category of security tools that continuously monitor cloud infrastructure for misconfigurations, compliance violations, and security risks across IaaS, PaaS, and SaaS environments.

A Cloud-Native Application Protection Platform is a unified security solution that combines cloud security posture management (CSPM), cloud workload protection (CWPP), and application security to protect cloud-native applications across their full lifecycle.

A Cloud Workload Protection Platform is a security solution designed to protect workloads — including virtual machines, containers, and serverless functions — running in cloud environments from threats and vulnerabilities.

Identity and Access Management is the framework of policies and technologies that ensures the right individuals have appropriate access to technology resources, managing digital identities and their permissions.

Privileged Access Management is a security discipline that controls and monitors access for accounts with elevated permissions — such as system administrators, database admins, and service accounts — to reduce the risk of credential-based attacks.

Identity Threat Detection and Response detects and responds to identity-based attacks like credential theft, privilege escalation, and account takeover across Active Directory, Entra ID, and cloud identity providers.

Zero Trust is a security framework that requires all users and devices — whether inside or outside the network perimeter — to be authenticated, authorized, and continuously validated before being granted access to resources.

Data Loss Prevention encompasses the strategies, tools, and processes used to prevent sensitive data from being lost, misused, or accessed by unauthorized users, whether through exfiltration, accidental sharing, or insider threats.

An endpoint is any device that connects to a network and can serve as an entry point for threats, including laptops, desktops, mobile phones, servers, IoT devices, and virtual machines.

The attack surface is the total sum of all points — including software, hardware, network endpoints, APIs, cloud services, and human factors — where an unauthorized user could attempt to enter or extract data from an environment.

Threat intelligence is evidence-based knowledge about existing or emerging cyber threats, including context, mechanisms, indicators of compromise (IOCs), and actionable advice for defensive decision-making.

MITRE ATT&CK is a globally recognized knowledge base and framework of adversary tactics, techniques, and procedures (TTPs) based on real-world observations of cyberattacks.

Vulnerability management is the continuous process of identifying, evaluating, prioritizing, and remediating security vulnerabilities in systems, software, and configurations across an organization's IT environment.

Penetration testing is an authorized simulated cyberattack performed against an organization's systems to evaluate the security posture by identifying exploitable vulnerabilities before real attackers do.

A red team is a group of security professionals who simulate real-world adversary tactics, techniques, and procedures to test an organization's defenses, detection capabilities, and incident response in a controlled engagement.

A blue team is the defensive security team responsible for maintaining an organization's security posture, detecting threats, responding to incidents, and continuously improving defenses — often the team that operates the SOC.

A purple team is a collaborative security exercise or function where red team (offensive) and blue team (defensive) work together to test, validate, and improve detection and response capabilities in a feedback loop.

Security posture refers to the overall strength and effectiveness of an organization's cybersecurity defenses, encompassing its policies, controls, technologies, awareness, and ability to detect and respond to threats.

A compliance framework is a structured set of guidelines, standards, and best practices — such as SOC 2, HIPAA, PCI DSS, ISO 27001, or NIST CSF — that organizations follow to meet regulatory requirements and demonstrate security due diligence.

Cyber insurance is a specialized insurance product that helps organizations mitigate the financial impact of cyber incidents — including data breaches, ransomware, and business interruption — by covering costs such as forensics, legal fees, notification, and recovery.

Log management is the practice of collecting, storing, normalizing, and analyzing log data generated by systems, applications, and network devices to support security monitoring, troubleshooting, and compliance requirements.

A breach warranty is a financial guarantee offered by some MDR providers that pays out a specified amount (typically $1M-$5M) if the customer suffers a security breach while using the service.

The threat landscape is the full scope of current and emerging cyber threats facing an organization or industry, including the actors, methods, motivations, and attack vectors that define the overall risk environment.