Security operations centre
Also called SOC, security operations center, SOC team
The team that watches an organisation's systems for attacks, investigates the alerts and responds when one is real.
A security operations centre, or SOC, is the part of an organisation that looks for attacks in progress and deals with them. Preventing attacks is the first aim of security, and it doesn't always work. The SOC is there to limit the damage from the attacks that get past the preventive controls.
The work runs on alerts. Tools raise them, analysts sort them, and the ones that look real are investigated and either closed or escalated. SOCs vary widely in scope: some are a room staffed around the clock, some are 2 people and an outside provider.
AI has entered this work as a reader and a drafter. In one SOC's records, analysts used a model to make sense of what they were looking at and to build context, and kept the high-stakes decisions for themselves.
For example
An alert says an admin account signed in from a new country. A SOC analyst opens the sign-in record, decides whether it's the admin, and acts.
Put it to use
Where you'll meet security operations centre in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.