Security Operations Centre

A 24/7 SOC function, delivered as a service.

QuantM provides the SOC function for small and midsize businesses: round-the-clock monitoring, triage, investigation, escalation, and response coordination, delivered as a service.

Book a 15-minute M365 posture review Back to all services

What is included

The SOC function, delivered as a service.

QuantM provides 24/7 managed monitoring for the systems included in scope. Sources, contacts, and approval boundaries are confirmed before service begins.

  1. 01Monitoring

    Watch the sources agreed in scope for signs of attack.

  2. 02Triage and investigation

    Analysts decide whether an alert is real and what it affects.

  3. 03Escalation

    Named contacts hear about confirmed incidents in plain language.

  4. 04Response coordination

    Pre-approved containment actions, with your approval for anything more disruptive.

  5. 05Tuning

    Detections are adjusted to your environment as the service runs.

  6. 06Reporting and evidence

    Written incident reports and regular reporting for reviews.

Definition

What is a security operations centre (SOC)?

A security operations centre (SOC) is the function that watches an organization's systems for threats, investigates alerts, escalates real incidents, and coordinates the response. In the US the same function is spelled security operations center. It combines people, tools, and written procedures.

Large companies run a SOC as a facility with a dedicated team. A small or midsize business without an in-house security team usually cannot justify that. What it needs is the function: someone who reviews alerts at any hour, decides what is real, and tells the right person. That is what SOC as a service, also called an outsourced SOC, provides.

QuantM delivers the SOC function as a service. This page explains what the function does and what you receive. For how the managed detection and response service itself works, see the MDR page.

What a SOC does

The five jobs of a security operations centre.

Every SOC, in-house or outsourced, does the same core work.

  • Monitoring: Watching identity, email, endpoint, cloud, and log signals for the sources in scope.
  • Triage: Sorting alerts quickly into noise and signals that need a closer look. QuantM's median MDR triage time is under 5 minutes.
  • Investigation: Checking the surrounding activity to decide whether an alert is a real threat and what it touched.
  • Escalation: Telling the right named person, in plain language, what happened and what is needed.
  • Response coordination: Taking the actions you pre-approved, handing off the rest, and keeping a record of what was done.

Build vs buy

Build a SOC or buy one: what changes.

A business without a security team can build a SOC in theory. In practice the requirements often outgrow the team. This table shows where.

Coverage
Build in-houseNeeds people for every hour of the week, including nights, holidays, and leave
Outsourced SOCCoverage is part of the service for the sources in scope
People
Build in-houseHiring, training, and keeping analysts who can investigate
Outsourced SOCAnalysts are provided as part of the service
Tooling
Build in-houseYou buy, integrate, and maintain the monitoring platforms
Outsourced SOCTooling is operated for you as part of the service
Detection tuning
Build in-houseYour team writes and adjusts detections as the environment changes
Outsourced SOCTuning is part of the ongoing service
Procedures
Build in-houseYou write and test escalation and response playbooks
Outsourced SOCPlaybooks and approval boundaries are agreed during setup
Evidence
Build in-houseYou assemble reports for insurers and clients
Outsourced SOCReporting and evidence are part of the service
Best fit
Build in-houseOrganizations with a mature, staffed security team
Outsourced SOCBusinesses without a security team that still need coverage

How alerts are handled

How an alert is handled and escalated.

An illustrative path, not a client record. Real timing depends on the threat, the sources connected, and the response actions you have approved.

  1. Detect

    Step 1: A monitored source raises an alert, or several signals combine to match a known attack pattern.

  2. Triage

    Step 2: Automated enrichment filters noise, and an analyst takes the first look at what remains.

  3. Investigate

    Step 3: The analyst reviews surrounding activity on the account, device, or system to confirm whether the threat is real.

  4. Escalate

    Step 4: Your named contact receives a plain-language message covering what happened, what was done, and what is needed next.

  5. Contain

    Step 5: Under your pre-approved playbook, the analyst takes actions such as isolating an endpoint, revoking sessions, or disabling an account.

  6. Hand off

    Step 6: Anything more disruptive goes to your contact first. Your team or MSP owns recovery, with QuantM providing the timeline and evidence.

What you receive

What the buyer receives from a SOC service.

Monitoring
What it containsCoverage of the sources agreed in scope, written down before service starts
Who uses itIT lead and leadership
Escalation notices
What it containsA plain-language account of what happened, what was done, and what is needed
Who uses itNamed contacts
Containment actions
What it containsPre-approved actions taken during confirmed incidents, with a record of each
Who uses itIT lead or MSP
Incident report
What it containsTimeline, root cause, containment, and recommended next steps after confirmed incidents
Who uses itLeadership, insurers, clients
Regular reporting
What it containsActivity, trends, and open decisions on an agreed cadence
Who uses itOwner, COO, or CFO

Reporting and evidence

Evidence your SOC should be able to produce.

Insurers and clients ask for proof of monitoring and response, not only tool names. The records below are what that proof usually draws on.

Scope of monitored sources
Why it mattersShows exactly what is and is not watched
Response authority
Why it mattersShows what the provider may do and what needs your approval
Escalation contacts
Why it mattersShows who is told, in what order
Incident timeline
Why it mattersShows when something was detected, who acted, and what changed
Service reviews
Why it mattersShows ongoing oversight and tuning decisions

Scope

What a SOC service covers, and what stays with you.

A SOC watches, investigates, and coordinates. It does not replace the people who administer your systems.

In scope

  • Monitoring of the sources agreed in scope
  • Alert triage and investigation by analysts
  • Escalation to named contacts with plain-language context
  • Containment actions you have pre-approved
  • Written incident reports and regular reporting
  • Service reviews against the agreed scope

Not included

  • Day-to-day IT support and device administration (available separately under Managed IT)
  • Systems and data sources that are not connected or not listed in scope
  • Applying every remediation change unless it is in the agreed scope
  • Legal advice and decisions about notifying customers or regulators
  • Any promise that incidents will never occur

Who this helps

Value for the people who act when the SOC raises an alert.

The service starts from the decision each stakeholder needs to make, not from a fixed list of tools.

Owner, COO, or CFO

When this matters

The business is asked who is watching its systems, for example by an insurer or a client, and the honest answer is that no one is on at night.

What changes

A named provider reviews alerts around the clock, and escalations reach a person with authority to decide.

Internal IT lead

When this matters

Alerts land in an inbox that is read between support tickets, and an overnight signal can wait until the next workday.

What changes

QuantM takes the monitoring, triage, and investigation workload, so your team handles the findings and fixes that need business context.

MSP or IT provider

When this matters

The provider does not staff a SOC and does not want alert review to stay an informal add-on.

What changes

QuantM provides the SOC function beside the provider, with access, escalation, and client communication agreed in advance.

Delivery model

Who covers which hours, and who decides.

QuantM can take full responsibility for managed IT, cybersecurity, and AI operations, co-manage them with your team, or own a defined specialist scope beside another provider. The engagement documents who owns each function, decision, and escalation.

Fully managed by QuantM

QuantM operates the agreed IT, cybersecurity, and AI services as your managed provider, including the day-to-day responsibilities defined in scope.

Co-managed with your team

QuantM and your internal team divide operational responsibilities based on your people, capabilities, and priorities.

Specialist scope

QuantM owns a defined service beside your MSP or other providers, with explicit handoffs and escalation paths.

Expected outcomes

Someone watching, and a path to act.

The service is designed to improve visibility, investigation speed, and decision ownership. It does not promise that incidents will never happen.

  • Someone is reviewing alerts when your team is offline
  • Confirmed incidents reach a named contact with context
  • Containment actions and approvals are agreed in advance
  • Evidence is available for insurers, clients, and leadership

How it works

From scope to a monitored environment.

  1. Step 01

    Scope

    Agree which sources are monitored, who the named contacts are, and what response actions are pre-approved.

  2. Step 02

    Connect

    Connect the agreed sources and confirm the escalation path before monitoring begins.

  3. Step 03

    Operate

    Analysts monitor, triage, investigate, and escalate for the sources in scope.

  4. Step 04

    Review

    Review activity, tuning changes, and open decisions on an agreed cadence.

Related services

Services that connect to the SOC function.

Managed detection and response (MDR) servicesManaged security services (MSSP) for Canadian SMBsFree 15-minute Microsoft 365 posture reviewMicrosoft 365 security servicesManaged email securityManaged vulnerability managementManaged cybersecurity in TorontoManaged cybersecurity in BramptonManaged cybersecurity in Oakville

SOC and monitoring guides

Read more on monitoring, triage and escalation.

24/7 threat monitoring for SMBs: what to expectAlert fatigue: how triage separates signal from noiseFrom alert to recovery: an incident scenarioManaged service SLA checklist for contracts
FAQ

Common questions, answered.

Questions about scope, ownership, onboarding, and what happens next.

Discuss your situation

A security operations centre (SOC) is the function that watches an organization's systems for threats, investigates alerts, escalates real incidents, and coordinates the response. It is a team, a set of tools, and a set of procedures, not a single product.

SOC as a service, also called an outsourced SOC, means a provider runs the monitoring, triage, investigation, and escalation work for you under a monthly agreement. You get the function of a SOC without hiring analysts, buying the tooling, or staffing every shift.

Many find it hard to. Round-the-clock coverage needs people for nights, weekends, holidays, and leave, plus tooling, detection tuning, and procedures. For a business this size, that cost and effort rarely fits next to the rest of the IT and security workload.

They overlap. A SOC is the function; managed detection and response (MDR) is a service that delivers it, with investigation and response actions agreed up front. QuantM's MDR page covers that service in detail, and this page explains what the SOC function does and what you receive.

No. Security operations center is the US spelling and security operations centre is the Canadian spelling. They describe the same function.

The sources agreed in scope, which can include identity, email and collaboration, endpoints and servers, and cloud and SaaS. The exact list is confirmed in writing before service starts, so you know what is and is not covered.

Alerts are triaged, and those that look real are investigated by an analyst. If the alert is confirmed, QuantM takes the containment actions you pre-approved and notifies your named contact in plain language. Anything more disruptive goes to your contact first.

Only what you pre-approve. Typical pre-approved actions are isolating an endpoint, revoking sessions, and disabling a compromised account. Broader changes need your approval, and you own recovery decisions.

You receive plain-language notifications during an incident, a written report after confirmed incidents, and regular reporting on activity and trends. These can support cyber insurance renewals and client security questionnaires.

Book the free 15-minute Microsoft 365 posture review. It looks at identity, email, sharing, app permissions, and who owns monitoring today, and it shows what a SOC service would need to cover in your environment.

Next step

See what a SOC service would cover in your environment.

Book the free 15-minute Microsoft 365 posture review. It covers identity, email, sharing, app permissions, and who owns monitoring today.

Book a 15-minute M365 posture review