Most companies choose to outsource at least part of their Security Operations Center (SOC), with a significant number adopting SOC-as-a-Service (SOCaaS), according to global research by Kaspersky. This strategic move enables organisations to benefit from round-the-clock protection, ensure compliance with regulatory standards and leverage advanced cybersecurity solutions and qualified expertise that are often beyond their internal capabilities.
As cyberthreats become increasingly sophisticated, organisations are rethinking how they build and operate their Security Operations Centers. With this in mind, Kaspersky carried out a comprehensive global survey to identify the main motivations, strategic goals, and potential challenges associated with its planning and implementation¹. The findings of this research revealed that 64% of companies plan to outsource part of their SOC, combining internal capabilities with external expertise. Meanwhile, over a quarter of respondents (26%) are ready to fully implement an SOC-as-a-Service (SOCaaS) model. By contrast, only 9% plan to build their SOC entirely in-house, highlighting the growing challenges of maintaining round-the-clock monitoring and attracting qualified specialists.
SOC outsourcing enables organisations to delegate selected SOC functions or even the entire operational cycle to a trusted external provider. This approach can include a variety of services:
- Design and architecture of the SOC.
- Deployment and maintenance of SOC technologies.
- Monitoring and analysis by external security analysts.
- Consulting and training services.
- Full SOCaaS delivery, where the provider handles detection, investigation and response around the clock.
Most companies prefer maintaining strategic tasks internally, whilst leveraging external teams and advanced technologies for operational and highly technical workloads. Among organisations planning to outsource SOC functions, the most commonly delegated tasks to third-party providers included solution installation and deployment (55%), solution development and provisioning (53%), and SOC design (47%).
When engaging external SOC specialists, companies also showed a clear preference for augmenting specific roles, with first-line analysts (61%) and second-line analysts (52%) being the most in-demand among external specialists. These figures illustrate that companies focus more on frontline and intermediate security tasks, such as monitoring and responding to threats.
Why do organisations choose SOC outsourcing?
The leading motivator for SOC outsourcing is the need for 24/7 protection (55%) – an operational requirement many internal teams cannot sustain alone. Another highly cited benefit is reducing workload on internal IT security specialists (47%), enabling teams to focus on strategic tasks.
Additionally, access to advanced solutions and technologies (42%) and external support to ensure compliance with regulatory requirements and standards (41%) further drive the decision to outsource, highlighting the value of specialised expertise and cutting-edge tools such as XDR, MDR, MXDR and others.
Budget optimisation is important for only 37% of companies – indicating that the primary value of outsourcing lies in improved protection, not just cost savings.
“The trend towards outsourcing SOC functions, whether fully or partially, is primarily driven by the necessity for enhanced operational focus and strategic agility. By shifting routine and technical tasks externally, organisations are able to concentrate on high-value activities such as strategic decision-making and orchestrating responses to sophisticated threats. Moreover, this approach often results in considerable cost efficiencies, allowing for optimised resource allocation. Ultimately, this model transforms the SOC into a critical strategic capability, directly contributing to business continuity,” comments Sergey Soldatov, Head of Security Operations Center at Kaspersky.
For companies planning to build a SOC, Kaspersky recommends the following:
- Engage with Kaspersky SOC Consulting during the initial setup or when enhancing your existing security operations. Our comprehensive consulting services are designed to help companies build a robust SOC and streamline its processes.
- Boost your security performance with Kaspersky SIEM, powered by advanced AI capabilities. This solution aggregates, analyses and stores log data across your entire IT infrastructure, providing contextual enrichment and actionable threat intelligence insights.
- Protect your company against a wide range of threats with solutions from the Kaspersky Next product line that provide real-time protection, threat visibility, investigation and response capabilities of EDR and XDR for organisations of any size and industry.
- Equip your cybersecurity team with in-depth visibility into cyber threats targeting your organisation. The latest Kaspersky Threat Intelligence delivers rich, contextual insights throughout the entire incident management cycle, enabling timely identification of cyber risks.
To explore more of Kaspersky’s solutions and services for building and enhancing your SOC, please follow this link.
