When does an organisation need a managed SOC, and when is the IT team enough?

An IT team is measured on things working. The server is up, the user is logged in, the printer prints, the backup ran. Success is availability and continuity, and it is a demanding job in its own right.

A SOC is measured on something else: noticing that something departs from normal, even while everything appears to be working. A successful attacker does not bring servers down — they use a legitimate account, tools that are already installed, and hours that look reasonable. To IT, everything is fine. To monitoring, that is precisely what needs catching.

The gap is not one of talent or effort. It is a gap in what the role is defined to do, and in what somebody looks at in the morning.

First: you have security tools producing alerts, and nobody works through them systematically. If the answer to "who looked at yesterday's alerts?" is "nobody, unless something happened", the tool is installed but not operating.

Second: when something suspicious happens, there is nobody who can investigate it properly without stopping everything else. A real investigation takes uninterrupted hours, and an IT team has a queue that does not pause.

Third: you cannot answer "what happened?" with certainty after an incident. If logs were not retained long enough, or nobody can read them, every incident ends in an estimate rather than a finding.

The understandable temptation is to buy a solution. But security products produce alerts — they do not consume them. Each additional product increases the volume of alerts nobody is working through, and so widens the gap rather than closing it.

Plenty of organisations discover this after they have already bought: they have an excellent EDR, they have logs, they have alerts — and they do not have the hours of somebody experienced enough to tell noise from the beginning of an incident.

The logic is a division of labour, not a replacement. The IT team continues to own infrastructure, users and continuity — they know the environment better than any outside party, and that is an advantage worth keeping.

The SOC adds the layer they do not have: somebody looking at alerts every day, investigating what departs from normal, and passing to IT only what genuinely needs action, with an explanation of what was found and what is recommended.

The sign that it is working is that the IT team receives less noise, not more.