Security operations

Every provider says they have a SOC. Here is what that should mean.

A security operations centre is people watching your systems around the clock, with the authority to act when something is wrong. Here is what one actually does, how MDR, MSSP and in-house compare, what it should be watching, the questions that separate a real service from a marketing one, and what it would take to staff your own.

Essential Eight monitoring requirements from ASD. Checked 30 October 2026.

See our MDR service Work out in-house staffing 07 3114 2808

What a SOC does
MDR vs MSSP vs in-house
Staffing calculator

Reviewed by Blake Bath, General Manager, on 30 October 2026.

An IT account manager talks a chief operating officer through a printed monitoring report at a meeting table. — **The test question**What will you do at 3am on Sunday, without calling me first?

The work

What a SOC actually does.

Four kinds of work, every day and night.

Triage

Every alert gets looked at. False alarms are closed, real ones are escalated, within minutes.

Every alert reviewed
Nights and weekends
Context added

In-house SOC staffing calculator

What would it take to run your own 24/7 SOC?

Hours to cover, divided by the hours each analyst is actually on shift. Use your own salary figure.

How many people does it take to watch alerts yourself? Simple arithmetic on hours, using your own figures.

Hours to cover

Analysts on shift at once

Hours per analyst per weekTime actually on shift, %After leave, sick days and training.Cost per analyst per year, A$Example figure. Replace with your own, including super and on-costs.

People needed

12analysts (11.1 full-time)

About A$1,560,000 a year in salaries alone.

336 seat-hours a week, with each analyst on shift about 30 hours a week.

Tools, detection content, training, a manager and turnover come on top. This is why most small and mid-sized businesses buy MDR instead.

See our MDR service

The options

MDR, MSSP or in-house.

	MDR	MSSP	In-house
Platform	Usually included	Often your existing tools	You buy and run it
Analysts	Provider's, 24/7	Provider's	Your staff
Acts on threats	Yes, pre-approved	Often alerts you to act	Yes
Fits	Most small and mid-sized businesses	Businesses with their own security tools	Large organisations

Coverage

What a SOC should be watching.

DevicesLaptops, desktops and servers, through EDR.
Sign-insImpossible travel, risky sign-ins, new MFA methods and admin role changes.
EmailPhishing, new forwarding rules and mailbox access from odd places.
Cloud appsMicrosoft 365 and other SaaS where your data lives.
Network edgeFirewall and VPN logs, where you have them.

Before you sign

Eight questions to ask a SOC or MDR provider.

Who looks at an alert at 3am on Sunday?Named analysts on shift, not an on-call engineer with a phone.
What can you do without calling us?Isolate devices, disable accounts, end sessions. In writing.
What do you watch?Devices only, or sign-ins, email and cloud apps too?
How fast do you respond?Time to look at an alert, and time to contain, by severity.
How do you tell us?Who gets called, in what order, and how often you report.
Where is our data kept?Where logs are stored, for how long, and who can see them.
What is not included?Full incident response, forensics and recovery are often extra.
Can we see a real example?A sanitised incident report showing what happened, minute by minute.

What we run

How our MDR works.

Guardz runs our managed detection and response, with SentinelOne on devices and a follow-the-sun team of analysts in North America, Europe and Asia-Pacific watching around the clock. Identity threats on Microsoft 365 accounts are watched too, not just laptops.

Containment actions are agreed with each client up front, so a compromised device or account can be dealt with at night without waiting for someone to answer the phone.

Getting started

Setting up 24/7 monitoring in five steps.

Step 1Inventory
Devices, accounts, email and cloud apps to watch.
Step 2Connect
Agents on devices, Microsoft 365 and other logs connected.
Step 3Agree actions
What can be done without asking, and who gets called.
Step 4Tune
A few weeks to cut false alarms.
Step 5Report
Regular summaries and a review of real incidents.

Related guides

Monitoring is one part. These are the controls it watches.

Endpoints, identity and incident response around a SOC.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about SOCs.

What is a SOC in simple terms?

A security operations centre is the people, processes and tools that watch your systems for attacks and respond when something is found. It is not the room with the screens. For most small and mid-sized businesses, it is delivered as a managed detection and response service.

What is the difference between MDR and an MSSP?

Managed detection and response usually brings its own platform and analysts and will contain a threat, such as isolating a device or disabling an account. A managed security service provider often monitors tools you already have and forwards alerts for you to act on. Ask any provider exactly what they will do at 3am without calling you.

Can we run our own SOC?

Covering every hour of the week with two analysts on shift takes around eleven or twelve people once leave and training are counted, before tools and management. Use the calculator above with your own figures. Most small and mid-sized businesses buy the service instead.

Does the Essential Eight require monitoring?

At Maturity Level Two, ASD expects security events to be logged centrally, analysed in a timely manner, and the incident response plan enacted when something is found. Prevention alone is not enough.

What should a SOC watch?

At minimum, your devices and your sign-ins. Email and cloud apps matter too, because many attacks start with a phishing email or a stolen session rather than malware on a laptop.

Next step