Why it matters
Security monitoring is one of the biggest line items in most security budgets — and one of the hardest to judge. Dashboards look busy, monthly reports show thousands of alerts, and still no one can say with confidence whether a real attack would be caught in time.
A SOC assessment answers that question. We look at your people, processes, technology, and detections the way an experienced SOC manager would, measure them against recognized maturity models and real attacker techniques, and tell you plainly what's working and what isn't.
Is this right for you?
This service is a good fit if:
- You pay for an MSSP or MDR service and aren't sure what you're getting
- You run an in-house SOC and want an outside view of its maturity
- You're deciding whether to build a SOC, outsource it, or use a hybrid model
- Your team is overwhelmed by alerts and false positives
- An auditor, insurer, or customer is asking about your monitoring and response capabilities
What's included
Maturity assessment
A structured evaluation of business alignment, people, process, technology, and services using the SOC-CMM model and NIST CSF 2.0 Detect and Respond functions.
Detection coverage mapping
Map your current detections and log sources to MITRE ATT&CK to show which attacker techniques you can see — and which you can't.
Log source and tooling review
Review SIEM, SOAR, EDR, and network visibility for gaps, misconfigurations, and unused capabilities you're already paying for.
Process and playbook review
Evaluate triage, escalation, incident response playbooks, shift handoffs, and quality assurance.
Metrics and service-level review
Assess how you measure detection and response — including time to detect and respond — and whether the metrics mean anything.
MSSP / MDR provider evaluation
Compare what your contract promises against what is actually delivered, and prepare questions for your next renewal or vendor selection.
Frameworks we work with
- SOC-CMM
- MITRE ATT&CK
- NIST CSF 2.0
- NIST SP 800-61r3
- CIS Controls
What you receive
- SOC maturity scorecard with current and target levels
- MITRE ATT&CK detection coverage heat map
- Prioritized findings with practical recommendations
- 12-month SOC maturity roadmap
- Executive read-out for leadership
How it works
- 1
Review
Interviews with analysts, engineers, and leadership; review of tools, documentation, and sample alerts.
- 2
Evaluate
Score maturity, map detection coverage, and test how alerts flow from detection to response.
- 3
Report
Deliver the scorecard, coverage map, and prioritized findings.
- 4
Enhance
Build a realistic roadmap and, if you'd like, help carry it out.
Common questions
Can you assess a managed provider we don't control?
Yes. We review what the provider delivers to you — reports, escalations, response times, and contract terms — and help you hold them to their commitments. Provider cooperation helps but isn't required.
Do you run attack simulations?
We can include targeted detection tests using safe, industry-standard techniques to validate key detections, with your written approval and coordination with your team. Full red team exercises are outside our scope, and we can help you scope one.
We're small — do we need a SOC?
Maybe not. Many small organizations are better served by a well-chosen MDR service. We'll help you decide what level of monitoring fits your risk and budget.