Glossary
Security operations center (SOC)
Also known as: Cyber defence center, CDC
A security operations center (SOC) is a team, with supporting processes and technology, that continuously monitors an organisation's systems to detect, analyse and respond to cybersecurity incidents.
By Thomas HeukerLast updated:
A SOC combines people (analysts, threat hunters, incident responders), processes (triage, escalation, playbooks) and technology (sensors, SIEM, case management). It can be run in-house, outsourced to a managed security service provider, or a hybrid of both.
A SOC whose scope includes industrial control systems is often called an OT SOC or SOC for OT. See What is a SOC for OT? and IT SOC vs OT SOC.