What is a SOC provider?
A SOC (security operations center) provider is an outside team that monitors security alerts and helps investigate or respond to threats.
What the provider handles
Some services send you alerts. Others investigate threats, isolate affected devices or run daily SOC operations. The work they take on depends on your agreement.
Compare the five levels of service
| Provider responsibility | What it means |
|---|---|
| Monitor and notify | Sends alerts. Your team investigates and responds. |
| Investigate and advise | Investigates threats and recommends actions for your team. |
| Contain threats | Takes or coordinates containment within agreed permissions. |
| Co-manage the SOC | Shares daily SOC work with your team. |
| Run the SOC | Runs most daily SOC operations within the contracted scope. |
What stays with your team
You still make business decisions, approve access and handle recovery work outside the agreement. Confirm who can act when your team is offline.
Before you choose
- Which systems and hours are covered?
- What can the provider do without waiting for you?
- Which tools, onboarding work and response costs are included?