Summary
- A security operations centre (SOC) is the team that spots attackers inside your systems and stops them before real damage is done.
- M&S and Co-op were both attacked in April 2025. Together, they show why spotting attackers early and acting fast matters so much.
- Firewalls, antivirus and MFA are essential, but they can miss an attacker who logs in with real credentials. A SOC is built to catch exactly that.
- You do not need to build your own SOC to get this protection, but not every managed SOC works the same way. Knowing what to look for is what matters.
A security operations centre (SOC) is the team that watches your systems around the clock and steps in when an attacker gets past your defences. Its job is to find intruders quickly and contain them before reaching anything critical.
Few businesses have their own in-house SOC. Most get the same 24/7 cover from a managed SOC, run by a specialist provider. Either way, what happens in the first few hours of an attack determines how much damage is done.
What Does SOC Stand For in Cyber Security?
In cyber security, SOC stands for security operations centre, the team and tools that watch an organisation’s systems for attacks. SOC 2 is something different: a security audit that service providers go through to show they handle customer data safely.
What Is a Security Operations Centre (SOC)?
A security operations centre (SOC) is the team, tools and processes that monitor an organisation’s systems around the clock, investigate anything suspicious and respond when an attack is confirmed. As the NCSC puts it: “The role of a SOC is to limit the damage to an organisation by detecting and responding to cyber attacks.”
A SOC can be a room full of screens or a team working remotely. Either way, its analysts need to see what is happening across your systems and have the authority to act. Tools like firewalls and antivirus are designed to keep attackers out, but no defence is perfect. A SOC is there to catch the attackers who still get in.
What The 2025 Retail M&S and Co-op Attacks Show About SOC Response
In April 2025, two major UK retailers were hit by cyber attacks within days of each other. The first was Marks & Spencer, which was attacked over the Easter weekend. According to Computer Weekly, the attackers phoned a third-party service desk, pretended to be an M&S employee, and asked for a password to be reset. With a working password, the attackers could log in as a trusted employee, move through M&S’s systems without raising alarms and later launch ransomware across its servers. M&S paused online orders for weeks and expected the attack to cost around £300 million in operating profit at that time.
Days later, it was Co-op’s turn. Its defences detected unusual behaviour within a few hours, which allowed the company to act quickly. According to the BBC, it disconnected its networks from the internet just in time to stop the hackers from deploying ransomware. Even so, the data of all 6.5 million members was stolen.
Both cases show how much depends on spotting attackers early and acting quickly once they are inside. That’s the work that a SOC does and it follows a clear sequence.
What Does a SOC Do?
A SOC’s job is to find attackers who have already got in and contain them as quickly as possible, to limit the damage they can cause. Its work follows the incident response stages set out by NIST, the US standards body:
- Detect: spot and analyse activity that does not fit, such as an account reaching into systems it never normally touches, and work out quickly whether it is a real attack.
- Respond: contain the threat before it spreads. That might mean locking an account, isolating a laptop or, as Co-op did, cutting systems off from the internet.
- Recover: restore affected systems and get the business running normally again.
- Improve: find out how the attack happened and fix the weakness so it cannot happen again. At Co-op the hackers left a trail they could not delete, so even after removing them, the company could see exactly what they had done and share it with the authorities.
The sooner a SOC spots an attack, the smaller the response needs to be. Locking a single account is far easier than taking whole systems offline.
Do You Need a SOC If You Already Have Antivirus and a Firewall?
Yes. Many attacks today start with a login, using real passwords stolen through phishing or a compromised supplier (a risk we looked at after the recent ASOS attack). Once they are in, many security tools see what looks like a normal user.
The table below shows what each tool does well, and what happens when an attacker logs in with real credentials.
| Tool | What It Does | Where It Can Fall Short |
|---|---|---|
| Firewall | Blocks suspicious traffic from reaching your network | May let the attacker in, because a login with real credentials can look like a normal employee working remotely |
| Antivirus | Detects and removes known malicious software | May have nothing to detect if the attacker uses everyday tools like email and file sharing instead of malware |
| Multi-factor authentication (MFA) | Stops someone logging in with a stolen password, because they also need a code from your device | Cannot help if someone is tricked into approving the login, or if the password is reset for the attacker, as happened at M&S |
Each of these still matters, but none of these tools check whether a logged-in account is behaving normally. A SOC does, by watching what happens after someone logs in and steps in when an account starts doing something unusual, such as downloading large amounts of data or accessing systems it never normally uses. As one security adviser told Computer Weekly, “If you are only watching the ‘break-in’, you are missing the breach.”
How Do You Know If Your Business Needs a SOC?
Most businesses need SOC-level monitoring even if they never build a SOC of their own, especially as serious attacks become more common. Between September 2024 and August 2025, the NCSC dealt with 204 nationally significant cyber incidents in the UK, more than double the 89 handled the year before. Timing matters too. M&S was hit over Easter, and attackers often strike over weekends and bank holidays, when fewer people are watching.
The graphic below shows four signs that your business needs SOC-level cover.
Not every system needs the same level of cover. The NCSC points out that systems built to be “secure by design”, such as cloud services set up with strong controls from day one, do not always need a “full-fat SOC” watching them. But most businesses also rely on laptops and email accounts staff log into all day, and those are exactly what attackers target. If your business runs on them, someone needs to be watching.
What Is SOC as a Service?
SOC as a service (SOCaaS), often called a managed SOC, is when a specialist provider runs a cyber security operations centre on your behalf, giving you a 24/7 SOC without hiring a team. It exists because building a SOC in-house is out of reach for most businesses. Round-the-clock cover needs a full rota of analysts, and those skills are hard to find: the government’s Cyber Security Skills in the UK Labour Market 2026 report found that 57% of businesses have a basic cyber security skills gap, up from 49% the year before.
Staffing a single seat around the clock means covering 168 hours a week, which takes roughly 4.5 full-time analysts before sickness and annual leave. With the median advertised salary for UK cyber security professionals at £58,050, that is nearly £260,000 a year in salaries alone, for one person watching your systems at any given moment.
The biggest benefit is speed. Attackers often stay hidden inside a network for days before they strike. Mandiant’s M-Trends 2026 report found they go undetected for a median of 14 days. That gives a SOC the chance to find them and shut them out before ransomware is launched.
Can a Security Operations Centre Be Outsourced?
Yes. Outsourcing to a managed security service provider (MSSP) is how most businesses without a large in-house security team get round-the-clock SOC cover. What matters is choosing the right provider. As SC Media points out, some MSSPs triage and escalate alerts but leave the response to you, so the hardest part, acting on the threat, still falls on your own team. A managed SOC that contains threats itself closes that gap, one that only escalates and hands the problem back to you at the worst possible moment.
If you are comparing managed SOC services, look for one that:
- Has analysts who can contain a threat themselves
- Watches laptops, user accounts, email, cloud apps and supplier access as well as your network
- Knows your systems and what normal looks like for your business, so real threats stand out quickly
- Includes incident response in the price, so you never have to decide whether you can afford to investigate
How ThreatSpike Delivers 24/7 SOC Cover
Spotting attackers early takes people who are watching around the clock. ThreatSpike’s managed SOC is part of our platform and runs alongside the IT we manage for you, so businesses of any size get 24/7 monitoring and response built in.
Since the SOC sits inside the same platform that runs your IT, it does not start as a stranger to your systems. It already knows your devices, accounts and how your team normally works, so an account behaving out of character stands out quickly.The platform responds automatically in 2-5 minutes, against an industry standard of 15-60 minutes, and a dedicated analyst then takes ownership of the incident and decides what happens next. . Unlimited incident response is part of the same monthly subscription as your managed IT, so you never pay extra when the SOC has to deal with an attack.
That is what changed for Regency Hotel Management, which manages a portfolio of more than 100 properties. Its team swapped blind reliance on a third party for real-time visibility, with ThreatSpike’s SOC handling threats, quarantine releases and suspicious emails 24/7. As Jim Stark put it: “It’s like having a third person in the office.”
Most businesses only find out how good their security is on the day it is tested. Book a demo to see how ThreatSpike’s SOC would protect your business.
