Thinking about building a security operations center or hiring someone to run one for you? Before you look at a single price quote, here are the plain questions worth sitting down with first.
There’s a question that comes up a lot in our field, and it sounds a lot simpler than it really is. Should we build our own security operations center, or should we pay someone else to run one for us? The honest answer is that it depends, and I know that’s not a very satisfying thing to hear. So instead of leaving it there, I want to talk through what it actually depends on, because those are the conversations that save organizations a lot of money and a lot of heartache down the road.
The first thing I’d ask anyone is what they actually need the SOC to do. A SOC is not a room full of big screens. It’s people, process, and tools working together so that when something goes wrong, somebody notices and does something about it quickly enough to matter. Before you look at a single price quote, write down in plain words what good looks like for you. What hours do you need covered? Which systems matter most? Who gets the call at two in the morning, and what are they allowed to do once they answer it? If you can’t answer those questions yet, you’re not ready to build or buy. You’re ready to have a meeting with the business, and that meeting is worth having first.
The second thing is to be honest about people, because people are the hard part. You can buy tools. You can sign a contract for a platform in an afternoon. What you can’t do in an afternoon is hire, train, and keep a team that knows your environment well enough to tell the difference between normal and trouble. Building in house means recruiting, scheduling around the clock, covering vacations and sick days, and giving folks a reason to stay once they’ve learned your business. Overnight shifts wear people down over time, and good analysts get offers. If you can’t staff it and keep it staffed, the most beautiful SOC design on paper turns into empty chairs. I’d rather see a leader admit that up front than find it out the hard way a year later.
Buying has real advantages. A good managed provider can give you coverage much faster than you could build it, and the right partner brings people who’ve seen a lot of different situations. But there’s one thing you can never hand off, and that’s accountability. The provider can watch your environment, but your organization still owns the risk and still owns the decisions. So when you talk to a potential partner, ask the plain questions. What will you actually do for us, and what will you only tell us about? How do you escalate, and to whom? Who do I call when something goes sideways on a holiday weekend? How will you learn how our business works? And if we part ways someday, what do we get to keep, such as our data, our detection rules, and our documentation? A partner who answers those questions clearly is worth a lot. A partner who gets vague is telling you something too.
A lot of organizations end up somewhere in between, and there’s nothing wrong with that. You might keep the knowledge of the business and the big decisions inside your own walls, and let a partner carry the overnight watch or some of the specialized work. That can be a very sensible arrangement. The thing to watch in a blended model is the seams. Things fall through the cracks at the handoffs, between your team and theirs, between one shift and the next. Talk through those handoffs before you need them, and then practice them. A tabletop exercise on a quiet afternoon is a lot cheaper than learning where the gaps are during a real incident.
Whichever way you go, think carefully about how you’ll know it’s working. It’s easy to count alerts, tickets, and hours. Those numbers have their place, but they don’t tell you much on their own. The better questions are whether the right people found out about the right things quickly, whether the team acted, and whether leadership got reporting that helped them make a decision. Good reporting should help the organization get a little safer every month, and own it when it didn’t.
The last piece of advice is to start smaller than your ambition. It’s far better to watch a handful of truly important things well than to watch everything poorly. Get the basics working, build trust with the business, and grow from there. A SOC that earns its keep on a few critical systems will have a much easier time making the case for the next step.
There’s no single right answer to build or buy. The right answer is the one that fits your risk, your budget, and your people, and that you can live with at two in the morning when the phone rings. I spent a good deal of time on these same questions when I wrote Cybersecurity Operations and Fusion Centers: A Comprehensive Guide to SOC and TIC Strategy. It walks through choosing between building and buying, picking a partner, building the team, and running the day to day operations and reporting. If you’re wrestling with this decision right now, it may save you a few headaches. You can find it on Amazon.
