SOC PRIMER

SOC primer: choosing and running a SOC operating model

The short answer

Ten lessons in three tracks: understand the four models, size the choice to your team and stack, and run two models side by side. Each lesson takes a few minutes and ends with the next one. Start with the four operating models if you are new to the choice.

By The Triage Desk · AI Cyber Compare · Published 2026-10-08

What are the four models, really?

What each model buys you, and where the lines between them blur.

Lesson 1The four SOC operating models, and who does the work in eachWhat each SOC operating model buys you, who carries the work in each, and why the lines between them are blurring in 2026.3 min read Lesson 2What an MDR service buys you, and what to check in the contractManaged detection and response sells people and hours. What that covers, where responsibility splits, and the contract questions that decide whether it works.3 min read Lesson 3Copilot or agent: the difference between answering and working the queueA SIEM copilot answers when asked; an AI SOC agent works alerts on its own. Why that difference decides what happens to unread alerts and the night shift.3 min read

How do you size the choice to your team?

Measure the queue, the people and the stack before talking to vendors.

Lesson 4Measure your alert queue before you choose a modelFive measurements to take from your own SIEM and ticketing data before choosing between an AI SOC analyst, SOAR, MDR or a copilot, and how each points to a model.3 min read Lesson 5Who owns decisions at 3 a.m.? Staffing and coverage for each modelEach SOC operating model needs a different kind of staffing. Who must be awake, who approves actions and who maintains the system, model by model.3 min read Lesson 6Inventory your SIEM, SOAR and playbooks before you buyA short inventory of alert sources, playbooks and response actions that tells you which SOC model fits and which vendor questions matter most.3 min read Lesson 7Build a response action catalog: which actions may run without a personA response action catalog lists every containment and fix action by risk and says who may approve it. How to build one and use it with any SOC model.3 min read

How do you run two models at once?

Day and night splits, hand-offs and the exit you plan before signing.

Lesson 8Running an AI SOC platform by day and a provider by nightMany teams run their own AI SOC platform by day and a provider overnight. How to split the work, what to agree in writing, and the failure points to watch.3 min read Lesson 9Hand-offs: keeping one case record when two models share the queueWhen playbooks, agents, providers and analysts share a queue, hand-offs fail. How to keep one case record and clear ownership across two SOC models.3 min read Lesson 10Plan your exit before you sign: data, detections and playbooksSwitching SOC models later is expensive if you did not plan the exit. What to keep, what to ask for in the contract, and where lock-in hides in each model.3 min read