What operational trend is indicated by the shift from 'Threat Research' to 'Pen-testing' as a top outsourced function?

Organizations are prioritizing active validation of their defenses (red teaming) over passive intelligence gathering, likely due to the need to prove security posture.

How does the increase in 'Purple-team' activities reflect SOC maturity?

It suggests a move towards collaborative testing where defenders learn directly from attackers, improving detection logic faster than traditional red teaming.

What implies the 'Integration' challenge in the survey results?

The high number of respondents using multiple, disparate tools without a central orchestration layer, leading to inefficiency.

What is the significance of the 'Digital Forensics' outsourcing percentage?

It indicates that while detection is often internal, the specialized, high-liability skill of deep forensics is still frequently handled by external experts.

How does the data support the 'Skills Gap' narrative?

The continued reliance on outsourcing for specialized roles (Red Team, Forensics) underscores the difficulty in hiring and retaining these skills in-house.

What trend is visible regarding 'Security Monitoring'?

A slight shift towards hybrid models, suggesting that while 24/7 eyes-on-glass is commoditized, organizations want to keep the analytical context internal.

What does the rise in 'eDiscovery' outsourcing suggest about the SOC's role?

That SOCs are increasingly involved in legal and HR investigations, necessitating a formal interface with legal counsel.

How does the survey reflect the adoption of 'Threat Hunting'?

It shows hunting moving from a niche activity to a core SOC function, though often constrained by resource availability.

What is the operational impact of the 'Respondent Size' doubling?

It suggests a broader awareness and formalization of SOC structures across more organizations, not just large enterprises.

What does the data say about 'Budget' allocation trends?

There is a shift towards spending on services (people/skills) rather than just hardware/software, reflecting the realization that tools alone don't stop breaches.

2017 2018 SOC Survey Comparisons

2017-2018 SOC Survey comparisons.pptx

Comparison of SOC survey data between 2017 and 2018.

This page contains AI generated content. Errors or omissions may be present. Use human level critical thinking.

Q: What operational trend is indicated by the shift from 'Threat Research' to 'Pen-testing' as a top outsourced function?

A: Organizations are prioritizing active validation of their defenses (red teaming) over passive intelligence gathering, likely due to the need to prove security posture.
Q: How does the increase in 'Purple-team' activities reflect SOC maturity?

A: It suggests a move towards collaborative testing where defenders learn directly from attackers, improving detection logic faster than traditional red teaming.
Q: What implies the 'Integration' challenge in the survey results?

A: The high number of respondents using multiple, disparate tools without a central orchestration layer, leading to inefficiency.
Q: What is the significance of the 'Digital Forensics' outsourcing percentage?

A: It indicates that while detection is often internal, the specialized, high-liability skill of deep forensics is still frequently handled by external experts.
Q: How does the data support the 'Skills Gap' narrative?

A: The continued reliance on outsourcing for specialized roles (Red Team, Forensics) underscores the difficulty in hiring and retaining these skills in-house.
Q: What trend is visible regarding 'Security Monitoring'?

A: A slight shift towards hybrid models, suggesting that while 24/7 eyes-on-glass is commoditized, organizations want to keep the analytical context internal.
Q: What does the rise in 'eDiscovery' outsourcing suggest about the SOC's role?

A: That SOCs are increasingly involved in legal and HR investigations, necessitating a formal interface with legal counsel.
Q: How does the survey reflect the adoption of 'Threat Hunting'?

A: It shows hunting moving from a niche activity to a core SOC function, though often constrained by resource availability.
Q: What is the operational impact of the 'Respondent Size' doubling?

A: It suggests a broader awareness and formalization of SOC structures across more organizations, not just large enterprises.
Q: What does the data say about 'Budget' allocation trends?

A: There is a shift towards spending on services (people/skills) rather than just hardware/software, reflecting the realization that tools alone don't stop breaches.

Ask a question

Have a doubt or need clarification?

  I’m here to help. Share your question, and I’ll get back to you with the guidance you need regarding the course.

Ask a question

Thank you!