A finance director locks up on Friday thinking all is well. Over the weekend, an attacker runs a brute-force attack against the company’s remote desktop service. Nobody notices until Monday, when internal systems stop and sensitive data is already gone.
That gap is the whole problem. IBM’s Cost of a Data Breach Report 2024 put the average time to identify and contain a breach at 258 days, down from 277 the year before. It is still more than eight months in which somebody is inside your systems and nobody is looking.
This article explains what a Managed SOC actually does, the technology behind it, what it costs set against hiring your own team, and the signs that it is time to bring one in.
A Managed SOC is not a product you install. It is people watching your systems at three in the morning, which is when a good deal of this happens, backed by tooling that makes the volume readable.
What Is a Managed SOC?
A Managed SOC is a security control room run by cybersecurity professionals on your behalf. Rather than building an in-house security operations centre, you contract an external team to monitor, detect, investigate and respond to threats around the clock.
It normally includes:
- A team of security analysts working in shifts
- Detection tooling, typically SIEM and SOAR
- Threat intelligence feeds
- Defined incident response procedures
- Continuous monitoring across endpoints, servers, identity and cloud
The distinction that matters is between monitoring and watching. Plenty of organisations have tooling that generates alerts. Far fewer have somebody reading them at two in the morning and deciding which ones are real.
The Technology Behind It
Four technologies do most of the work, and it helps to know what each one is for.
SIEM (Security Information and Event Management)
The collection layer. It gathers logs from servers, firewalls, endpoints and cloud platforms into one place and looks for patterns across them that would be invisible in any single source.
SOAR (Security Orchestration, Automation and Response)
The action layer. Where the SIEM detects something with a known response, SOAR executes it. If ransomware behaviour appears on a laptop, SOAR can isolate that device from the network immediately and raise it for an analyst rather than waiting for one to be free.
Threat intelligence feeds
External context. These supply the indicators, malware signatures and known-bad addresses that let a SOC recognise something it has not seen on your estate before.
EDR and XDR (Endpoint and Extended Detection and Response)
The sensor layer on the devices themselves. EDR watches endpoints; XDR extends the same approach across identity, email and cloud so the signals can be correlated.
24/7 Monitoring, Run From London
Transputec runs a 24/7 Security Operations Centre in London with managed detection and response across endpoints, identity and cloud. Talk to our team about the monitoring work behind your environment.
Get a Strategic ConsultationWhy Businesses Outsource the SOC
The cost of running a SOC yourself is driven by arithmetic more than by tooling. Covering a single seat around the clock takes roughly 4.2 full-time people once shifts, holiday, sickness and training are accounted for. Continuous coverage across triage, investigation and response usually means eight to twelve analysts before you have bought a single licence.
| In-house SOC | Managed SOC | |
|---|---|---|
| Staffing for 24/7 | 8 to 12 analysts, since one seat covered around the clock takes roughly 4.2 full-time people | Supplied by the provider, including holiday and sickness cover |
| Cost shape | Fixed: salaries, recruitment, training, tooling, out-of-hours rotas | Contracted, normally per endpoint per month |
| Time to operational | Months, assuming you can hire | Weeks, depending on estate size and existing log coverage |
| Vacancy risk | Yours. A resignation can remove overnight cover | The provider’s |
| Control | Full, and tailored to your environment | Shared, defined by contract and service levels |
Hiring them is the harder half. ISC2 put the global cybersecurity workforce shortfall at around 4.8 million people in its 2024 study, and its 2025 study found the constraint shifting from raw headcount towards skills, with most organisations reporting at least one capability gap in the team they already have.
That is why Transputec sizes the service to the estate rather than selling a fixed package. The model suits SMEs, healthcare, finance, education and any organisation holding sensitive data under GDPR, HIPAA or PCI-DSS obligations. The regulatory requirement is the same as a large enterprise faces. The hiring budget is not.
Where AI Fits in a Managed SOC
Most SOC tooling now uses machine learning somewhere, and it is worth being precise about where it helps.
What it does well. Volume. A mid-sized estate generates far more events than a human team can read, and the useful ones look ordinary in isolation. Behavioural baselining establishes what normal looks like for each user and device, so a login at an unusual hour from an unfamiliar location surfaces as an anomaly. Correlation joins a failed login, a privilege change and an outbound transfer into one incident instead of three unrelated alerts.
The effect shows up in response time. IBM’s 2024 report found that organisations using AI and automation extensively identified and contained breaches around 100 days faster than those that had not deployed them. Against a 258-day average, that is a material difference in how long an attacker has.
What it does not do. Decide. A model can tell you something is unusual. It cannot tell you whether the finance director is working late or whether somebody is using their credentials. That judgement needs context about the business, which is why a SOC is staffed rather than merely configured.
It also needs watching. Models drift as an environment changes, and a detection tuned for last year’s estate quietly stops catching things. Treating AI as a reason to cut analyst time is the common mistake.
The Patterns a SOC Actually Deals With
Three patterns account for most of the real work. What decides the outcome in each is not the tooling but how quickly the behaviour is recognised and acted on.
1. Ransomware reaching an endpoint
Someone opens an attachment and encryption begins. Where the behaviour is recognised in the first minutes and the device is isolated, damage stops at one machine. Where it takes hours, it moves laterally and the job changes from containment to restoring from backup.
2. Brute force against exposed services
An RDP port or admin portal reachable from the internet will be found and tested. The signature is a spike in failed logins from unfamiliar addresses, trivial to detect if something is watching the authentication logs and invisible if nothing is.
3. Credentials that should have been revoked
A leaver’s account still works, or a contractor’s access was never scoped down. The login looks legitimate because the credentials are legitimate. What flags it is context: the location, the hour, the systems being reached.
None of these are exotic. They are the ordinary cases, and they turn on whether anyone is watching when they happen.
When Should You Bring One In?
Most organisations act after an incident. These are the signals worth acting on before one.
- You have had a recent incident. A breach, a phishing compromise or a ransomware infection tells you the current arrangement did not catch it.
- Your IT team is already stretched. Security monitoring is the first thing to slip when the same people handle support tickets.
- You cannot answer basic questions. If nobody can say what security tooling you run or whether it is working, that uncertainty is itself the finding.
- You have compliance obligations. GDPR, ISO 27001 and PCI-DSS all require logging, monitoring and evidence you can produce on request.
- You are moving to cloud or growing. Every new user, system and SaaS application widens the attack surface.
- Hiring has not worked. If a security role has been open for months, the market is telling you something.
Transputec usually starts with an initial security assessment rather than a proposal, because which of these apply is easier to establish from the environment than from a conversation.
What to Expect From a Provider
A provider worth contracting should be clear about five things before you sign.
Onboarding and asset discovery. The engagement should start by establishing what you actually run: devices, user accounts, cloud applications and the security tooling already in place. Anything that skips this is guessing at your scope.
What is monitored, and what is not. Ask explicitly which log sources are in scope. A SOC watching endpoints but not identity will miss a whole class of attack.
Reporting you can read. Monthly output should cover what was detected, what was done, and what to fix, written for a board rather than an engineer.
Response authority. Establish in advance what the SOC may do without asking. Isolating a compromised laptop at 3am is only fast if somebody already agreed it can happen.
Escalation and people. Know who you reach during an incident, where they sit, and what the contracted response time is. Transputec staffs its analysts and incident response team in the UK, so this is a short answer rather than a complicated one.
How Transputec's Managed SOC Works
Transputec runs a 24/7 Security Operations Centre in London, where analysts triage alerts rather than forward them on. Engagements follow the same sequence.
1. Onboarding and asset mapping. A full review of the estate: devices, accounts, cloud applications and existing tooling, so scope is established rather than assumed.
2. Continuous monitoring. SIEM, EDR and behavioural detection across endpoints, identity and cloud, watched by UK analysts on shift.
3. Triage and prioritisation. Correlation rules and behavioural analysis rank what matters. Filtering out noise is the point, because an alert queue nobody can clear is the same as no alerting.
4. Response and containment. Confirmed threats are contained, compromised hosts isolated, and forensic evidence captured for the investigation that follows.
5. Reporting and evidence. Monthly board-level reporting, with evidence packs mapped to ISO 27001, Cyber Essentials Plus, FCA, ICO and GDPR Article 32 requirements.
Fuller detail sits on the managed SOC services page, and our guide to managed SOC pricing sets out what drives the number for a given estate.
Conclusion
Cyber threats do not keep office hours, and perimeter defences no longer describe where most attacks land. Identity, endpoints and cloud are where the activity is, and all three need watching continuously rather than reviewed afterwards.
Transputec supplies the two things that are hard to buy separately: people on shift who can tell a real incident from noise, and the tooling that makes the volume readable in the first place. Whether you build that or contract it comes down to estate size and how much out-of-hours cover you genuinely need.
If you want a view of what it would take for your environment, talk to our team about the monitoring and response work behind it.
FAQs
What is a Managed SOC and how does it work?
A Managed SOC is an outsourced security operations centre that monitors, detects and responds to threats 24/7. It combines SIEM and SOAR tooling with analysts on shift, who investigate what the tooling surfaces and decide what needs action.
How much does it cost?
Pricing is normally per endpoint per month and depends on estate size and the level of cover. Our managed SOC cost calculator gives an indicative figure, and the cost guide explains what drives it.
Is it cheaper than building one in-house?
Usually, because covering one seat around the clock takes roughly 4.2 full-time people and continuous coverage needs eight to twelve analysts before any licence spend. For a large estate with heavy out-of-hours demand, in-house can work out better. It is worth modelling against your own numbers.
Can it help with compliance?
Yes. Transputec produces evidence packs mapped to ISO 27001, Cyber Essentials Plus, FCA, ICO and GDPR Article 32 requirements as standard monthly outputs, which is the documentation an audit asks for.
How quickly can it be deployed?
It depends on estate size and how much log and endpoint coverage already exists. Onboarding starts with asset discovery, and the honest answer for a given environment comes out of that rather than from a standard figure.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
