1 Management Summary

The KuppingerCole Market Compass provides an overview of a market segment and the vendors in that segment. It covers the trends that are influencing that market segment, how it is divided, and the essential capabilities required of solutions. It also provides ratings of how well these solutions meet our expectations.

This Market Compass covers solutions that provide, as a cloud-based service, all the benefits of a Security Operations Center (SOC), such as the support of a team of information security experts that monitors and analyzes security systems to provide proactive and reactive cyber defense capabilities.

This means even small and mid-size organizations can tap into all the benefits of having a SOC, which is common in large organizations, but without the expense of running such an operation on premises and without all the challenges of finding and retaining people with the necessary skills.

SOC-as-a-Service (SOCaaS) solutions, also known as outsourced or co-managed SOCs, are a type of managed security service (MSS) that is cloud-based, built on a multi-tenant Software-as-a-Service (SaaS) platform, and goes beyond the offerings of traditional Managed Security Service Providers (MSSPs). MSSPs typically monitor and manage intrusion detection systems (IDS), firewalls, Network Detection & Response (NDR) systems, email and web security gateways, virtual private networks (VPNs), endpoint protection (EPP), and endpoint detection & response (EDR). SOCaaS, however, typically includes all of that plus a team of analysts to resolve every alert, identify and analyze indicators of compromise (IoCs), and analyze and respond to attacks to minimize the impact of security incidents, while at the same time optimizing an organization's protection, detection, and response capabilities through continual assessment and reporting, including guidance on security strategies and policies. SOCaaS, therefore, also includes all the services that typically make up managed detection and response (MDR) solutions, and can be considered as an evolution of both MSS and MDR.

Like an on-premises SOC, SOCaaS includes round-the-clock monitoring and analysis of internet traffic, corporate networks, desktops, servers, endpoint devices, databases, applications, cloud infrastructure, firewalls, threat intelligence, intrusion prevention, and security information and event management (SIEM) systems for signs of malicious activity.

Where there is little or no in-house security capability, SOCaaS helps organizations outsource at a fixed, predictable cost the entire security operation, including the analysis of SIEM alerts and security-related management of networks, endpoints, applications, websites, and databases.

Where there is some in-house security capability, SOCaaS can be used to supplement this wherever necessary to ensure that an organization has at its disposal all the cyber security skills and capabilities required. This is relevant even for very large organizations because the breadth of requirements on SOCs and the skills gap make it challenging and expensive to staff an on-prem SOC.

SOCaaS includes the services of a dedicated team of information security experts that are responsible for analyzing and monitoring an organization's security posture 24x7, not only to detect, contain and remediate threats, but also to recommend ways of improving security capabilities.

In the face of an increasingly challenging and rapidly changing business, IT and cyber threat environment, there is a growing demand for SOCaaS as most organizations see the value of the benefits on offer, which include:

• Uninterrupted and comprehensive centralized monitoring and analysis of enterprise systems for suspicious activity at a fixed and predictable monthly/annual cost.
• Improved incident response times and practices.
• Faster detection of security events and containment of threats.
• Resolution of all alerts to get maximum value out of existing systems.
• Reduced cost and impact on business of security incidents.

Highlights:

• This report covers the Security Operations Center-as-a-Service (SOCaaS) market that continues to develop in response to demand for security monitoring and analysis.
• SOCaaS is a type of managed security service that is cloud-based, built on a multi-tenant Software-as-a-Service platform, and goes beyond traditional Managed Security Services.
• SOCaaS includes a team of analysts to resolve every alert, analyze indicators of compromise, and analyze and respond to attacks, while helping to continually improve security.
• Main use cases are as a SOC replacement and to perform as an extension of internal security teams and SOC teams.
• SOCaaS market driven by need to deal with overload of security alerts, the desire to get more value out of existing investments, and the objective of continual improvement.
• Growth drivers include increased threats, regulatory requirements for 24x7 monitoring, increasing focus on threat response, the cost of on-prem SOCs, and skill shortages.
• Increased attack surface due to the increase in remote working and digital transformation is another driver of growth for the SOCaaS market.
• The SOCaaS market is expected to continue to grow and mature as firms seek to bolster their cybersecurity, keep hiring costs low, and get value from existing security investments.
• Automation supported by ML and other forms of AI is likely to grow and strengthen, but a human analyst team will remain a key element of SOCaaS offerings.
• Providing tailored actionable insights, and risk analysis and management are other key areas SOCaaS providers are likely to invest as potential differentiators.