1 Introduction

Security Operations Center-as-a-Service (SOCaaS) offerings have become increasingly popular as organizations of every size seek more effective ways to secure the modern, extended enterprise by getting more value out of existing security investments and identifying ways to improve defenses.

The drive towards digital transformation and cloud-services to improve efficiencies, increase agility, and cut costs, has rapidly and vastly expanded the attack surface of most organizations.

Cyber attackers have been quick to take advantage of these trends as workforces become increasingly mobile and remote, accessing applications, systems, services, and data both on-prem and in the cloud from outside the corporate network. The rapid increase in the number of employees working from home in the post-Covid era has accelerated this trend and compounded the risk.

In an effort to secure sensitive data to comply with a growing raft of data protection regulations around the world, and to protect intellectual property and other commercially sensitive information, most organizations have invested heavily in security monitoring tools on-prem and in the cloud.

However, for many organizations this has resulted in a large number of security alerts being generated on a daily basis. For most of these organizations, especially for small and medium-sized businesses, it is difficult or impossible to investigate and analyze all these alerts.

The emergence of SOCaaS offering has been driven by a combination of:

• The inability of most organizations to deal with security alert overload.
• The desire to get more value out of existing security investments.
• The need to expand security monitoring to include cloud, operational technology (OT), and internet of things (IoT) devices.
• The desire to achieve continual improvement by measuring the effectiveness of current security investments.

In addition, SOCaaS solutions provide the means of demonstrating to auditors a concerted effort to cover all cybersecurity risks and enable a comprehensive and standardized threat detection and response capability.

Another key driver has been the shortage of cybersecurity skills affecting organizations of all sizes. SOCaaS provides a way of tapping into the benefits of a SOC or additional SOC resources without the challenge of finding and retaining people with the necessary skills. SOCaaS also provides a way of scaling up capacity quickly and at a much lower cost than maintaining additional capacity in-house.

Essentially, a SOCaaS solution is a type of managed security service (MSS) that is cloud-based, built on a multi-tenant Software-as-a-Service (SaaS) platform, and goes beyond the offerings of traditional Managed Security Service Providers (MSSPs). The fact that SOCaaS is cloud-based means:

• No software to license, install, deploy, or manage.
• No hardware to purchase, manage, or maintain.
• Improved resiliency with fewer disruptions.
• Regular feature updates without interruption.
• Virtually unlimited scalability.
• Remote login and co-management from anywhere.

SOCaaS solutions typically include all the monitoring and management capabilities offered by MSSPs for intrusion detection systems (IDS), firewalls, anti-malware, virtual private networks (VPNs), endpoint protection (EPP) and endpoint detection & response (EPDR), but add the services of a team of analysts. These services include alert resolution, analysis of all indicators of compromise (IoCs), analysis and response to attacks, and guidance for optimizing an organization's cybersecurity protection, detection, and response capabilities. Thus, SOCaaS also includes services that typically make up managed detection and response (MDR) solutions and can therefore be considered as an evolution of both MSS and MDR.

While MSSPs provide a wide range of services, they tend to generate too many alerts that need to be investigated. They also tend to lack advanced threat detection and remediation skills, require fixed and long-term contracts, and require a specific technology stack. MDR providers on the other hand, can provide round the clock monitoring and address the skills gap, but a narrow reliance on endpoint telemetry results in a high rate of false positives. MDR providers also typically require a specific technology stack, provide limited visibility, and do not include remediation.

For many organizations, especially small to medium-sized enterprises, SOCaaS is the only way to:

• Consolidate all security threats, tools, and systems into a single point of control to address and resolve all alerts.
• Monitor and respond to all indicators of potential compromise by analyzing all security data.
• Evaluate the effectiveness of existing controls to identify how this can be improved.
• Get additional value from existing security investments.

Taken together, these four factors are what distinguish the SOCaaS market from standard MSP or MSSP offerings, which typically:

• Do not all cover cloud environments.
• Are not all built on cloud-based SaaS platforms.
• Do not provide any analysis or guidance on developing a more effective security posture.

For organizations of all sizes, even larger enterprises with established security teams and mature cyber defense strategies, SOCaaS solutions not only provide the opportunity to ensure comprehensive monitoring of the IT estate and get more out of cybersecurity investments through integration of existing security systems with the SOCaaS platform, but also the opportunity to continually improve cyber defenses, and provide additional support for internal security teams and analysts where they exist, as well as the ability to scale up capacity as and when required.