Who does what
Provider
- Monitor and investigate alerts
- Refine detections with your team
- Coordinate playbook responses
Your team
- Retain internal security ownership
- Make business decisions
- Complete assigned remediation
Coverage
- Endpoints
- Network
- Cloud Workloads
Details
Service scope
Best for Security teams retaining internal ownership while sharing recurring SOC work and detection improvement
Shared work goes beyond alert review
Monitoring and investigations include shared detection and escalation improvement, with a named internal owner.
Playbooks define the response split
Agree containment permissions, approval rules and recovery handoffs. The public scope does not list standard actions.
Adjacent managed services are separate
Firewall, network-access and incident-readiness services can connect to the SOC but are separate scope decisions.
Full service analysis
Secon.SOC monitors security data, investigates incidents and works with your team to refine detections, escalation paths and response playbooks. In its co-managed model, you retain the internal security role, business decisions and the response or remediation tasks assigned to you in the agreed plan.
- Your team owns
- Retain an internal security owner and decision contacts
- Agree and maintain the shared response plan
- Perform customer-assigned remediation and recovery
Shared work goes beyond alert review
Secon.SOC combines monitoring and investigation with ongoing detection-rule refinement, escalation design and response coordination. The co-managed option needs a named internal owner and a clear division of recurring operational work.
Playbooks define the response split
Analysts coordinate incident response according to defined playbooks. The public service page does not specify a standard action matrix for device isolation, account changes or recovery. Put those permissions and handoffs in the agreement.
Adjacent managed services are separate
Secon also sells managed firewall, network-access control and incident-readiness services. They can be coordinated with the SOC, but the SOC description does not establish that their ongoing administration is included in every engagement.
Pricing & contract
- Billing
- Custom
Request a quote for the selected operating model, tools, data sources and response responsibilities. Confirm whether onboarding, consumption and separate firewall, network-access or incident-readiness services are included.
Tradeoffs & buying questions
Strengths
-
Supports an explicit co-managed operating model
-
Includes ongoing detection and escalation refinement
Considerations
-
A detailed response permission matrix requires agreement
-
Internal security ownership remains necessary
-
Adjacent security-tool management may require separate services
Ask before buying
- Which recurring platform, detection and incident tasks will Secon own, and which remain with our team?
- Which containment actions can analysts execute, with what approval and out-of-hours escalation rules?
- What tools, data charges and extra managed services are included, and who operates each part of the contracted service?
Common questions
Does Secon also offer a fully managed SOC?
Yes. The current service page offers both fully managed and co-managed engagements. This profile covers the shared model. Request a separate responsibility schedule if you want Secon to take over daily SOC ownership.