Should You Build an Elite SOC Team or Hire One?

Let’s say your business is booming. A new product launch is going well, the company is expanding into new markets and a major customer win means increased hiring ahead. Morale is high across the organization and there are rumors of an exciting acquisition that will spur another round of rapid growth.

But with growth comes increased responsibilities – especially for the security team. Expanding threat and attack surfaces put pressure on the team to provide continuous, always-on protection, anywhere you do business. How do you accomplish this?  

Many organizations look to a SOC (security operations center) to centralize security monitoring, increase the speed and effectiveness of incident response, and maintain compliance, among other benefits. However, this desire leads to a key question: should you build a SOC or buy a SOC in the form of a security service like MDR (managed detection and response)?

As part of the decision process, it's important to look at the challenges of building a fully operational, 24x7 SOC team that responds quickly and intelligently to a cybersecurity threat as it attempts to disrupt your critical systems. 

Challenges of Building a SOC Team 

If you talk to a peer who stood up an internal SOC at any point in their career, they’ll likely tell you that staffing and maintaining a 24 hour a day SOC is daunting, resource intensive and expensive. However, it can be done. Here are some important things to consider about the process.  

SOC Standup: Assembling an Experienced Team 

One of the biggest challenges in building a SOC team is assembling a group with diverse expertise and significant threat experience to effectively achieve your goals. Today’s threat actors are increasingly adept at concealing their activities and bypassing legacy security measures, so analyst expertise plays a crucial role. It’s also important to find people with investigative experience —particularly in defense, academia or law enforcement. These analysts need to be able to go beyond simple detection and use investigative and reporting skills to provide recommendations based on careful, detailed analysis. 

Building Beyond the Analysts 

Finding your qualified group of analysts is not the end of your SOC staffing journey, it’s really the beginning. Once you build a solid base of analysts, you’ll then need to add specialized expertise —such as incident responders, detection engineers, and threat hunters. These SOC personnel fill many of the gaps that remain, including vulnerability assessment and remediation, threat investigation and proactive maintenance. As your organization grows and your threat surfaces expand, it’s important to add these specialized roles. 

Staffing and Paying for 24x7x365 SOC Coverage 

Most of us in cybersecurity know all too well about the major cybersecurity skills gap that makes it difficult to find qualified and affordable team members, and this becomes very apparent as you go about building, maintaining and operating a round the clock SOC team.  

One of the key challenges is the fact that staffing a SOC isn’t as simple as creating three eight-hour shifts for complete coverage. Labor laws limit work weeks to 40 hours and guarantee additional time off. The bare minimum for 24-hour coverage is five analysts — and even a five-person team would be stretched to cover PTO and serve as critical backup. Operating with this type of lean staffing creates the need for a significant overtime budget to make it all work. 

To build a reliable full time 24x7x365 SOC ideally requires at least 10 personnel (including 5 analysts, as mentioned previously) to account for shifts, PTO, and backup. Costs escalate quickly. For example, if you pay a salary plus benefits package of $150,000 per year, you’re looking at $1.5 million in staffing costs alone. This number does not include software licensing, training and industry certifications, networking equipment, office space, travel and other expenses tied to the security department. 

Planning for Turnover 

The continuous grind of staffing your SOC around the clock and chasing down false positives can hurt morale as your team might feel like they face an endless cycle of chasing threats that turn out to be non-existent. In the long-term, this can lead to burnout and departures, so you’ll want to plan for SOC team turnover.  
 
Unfortunately, the impact of employees leaving extends well beyond hiring someone new. It’s estimated that it takes up to 12 months to go through the entire on-boarding process —  where new hires fully integrate into company culture, processes and procedures. Going through that long, laborious effort every time you have turnover or decide to scale operations is unsustainable for most organizations. 

The Need for Standardized Procedures 

Establishing standardized processes and procedures to govern your SOC is both crucial and difficult — particularly if you are doing it for the first time. You’re already busy with security, IT projects and enabling the systems to power your core business. It’s important to examine what kind of resources and expertise you can realistically reallocate from your current operations while scaling to meet company growth. 

It’s also important that you carefully implement best practices based on established cybersecurity frameworks such as MITRE ATT&CK or NIST 2.0. These tried-and-true standards are an effective way to make sure your bases are covered in the most efficient manner possible, and you can scale your SOC as the business grows. It’s also important that you align these standards to your unique business objectives, ensuring real business risk is being addressed through security operations. 

This is just the beginning of things to consider as you plan to build an in-house 24x7x365 security operations center. However, it can be done if you have the patience, budget, and time to allocate from your current employees. 

[Complimentary Ebook:  Everything You Need to Know to Calculate the ROI of an MDR] 

SOC Alternative: Buy Instead of Build 

Many organizations find that partnering with a managed detection and response (MDR) service provider is a more cost effective and rapid way to improve their security posture. Highly experienced MDR experts from a variety of backgrounds augment your security team, and the level of support is scalable so you can maintain 24x7x365 protection regardless of your organization’s size. Outsourcing this critical security function allows you to focus on IT and security projects and helps you securely enable your business with confidence.  

Tapping Into MDR Knowledge 

One thing we hear is that MDR customers are pleasantly surprised at how quickly MDR reduced their risk and simplified their processes. Your MDR provider will already be operating under practices and procedures honed over years of working with a diverse set of organizations. They’ve spent millions of dollars developing and pairing the best tools with best practices and they’ve built solid relationships with cybersecurity vendors and advocacy groups that they can leverage if anything abnormal comes up. And your organization benefits from this experience around the clock. 

Simplifying the Complex 

Security is often a complex and siloed practice with multiple monitoring tools feeding their data into a Security Information and Event Management (SIEM) solution. Keeping up with the influx of security data flowing across these tools can be overwhelming, allowing legitimate attacks to hide amongst the noise as they spread laterally across the network.  

Your MDR team collects and consolidates data from your existing security tools into a centralized system, correlating information to better identify and respond to suspicious or malicious behavior and only alerting you to things that are truly worthy of investigation. This approach enhances decision making, streamlines reporting, improves measurement, and ultimately leads to more effective security outcomes. 

SOC Decision: Build It or Buy It? 

Should your organization build an in-house SOC or buy it? Building and maintaining a SOC from scratch is a journey fraught with roadblocks and challenges — from retaining top talent to scaling to meet business growth. However, it can be done effectively if you take the right approach and are willing to manage the ongoing operations. 

Working with an MDR service provider is a far simpler and more cost-effective approach. It allows you to tap into extensive and refined SOC experience at a fraction of the cost of building your own. For more information, explore full details of Bitdefender MDR or see the interactive view of how Bitdefender MDR works.