A SOC alone will not make you resilient

Organisations invest heavily in security technology. A SIEM is put in place, log sources are connected, a SOC keeps watch and endpoints get detection and response. That is sensible and it works: without visibility into what happens in your environment, you cannot stop an attack. And yet incidents keep occurring at organisations that look technically well organised.

The explanation is rarely that the technology failed. More often the attack arrived through a route where technology has little say: an employee who presses the right button at the wrong moment. Resilience only emerges when technology and people reinforce each other.

Technology provides the visibility

A SIEM collects and normalises signals from identity, network, endpoint and cloud sources. A SOC assesses those signals, enriches them with threat intelligence and vulnerability information, and escalates when needed. XDR, NDR and SOAR speed that up: signals are combined and routine actions automated, leaving analysts time for the cases that genuinely matter.

That foundation is indispensable, but it has a hard limit. A SOC only sees what it is fed, and mainly recognises what the use cases describe. A missing log source, an unconnected SaaS application or an attack pattern without a detection rule stays invisible. Detection is therefore exactly as good as the questions you thought to ask in advance.

The most used entry point is people

Attackers rarely take the hardest route. Phishing, a convincing phone call to the service desk, an MFA prompt someone approves after the tenth attempt, a shared link configured too broadly: these are not technical vulnerabilities but human ones. They yield a valid account, and from that moment the attacker behaves like an ordinary user.

That is precisely what makes detection difficult. Someone with valid credentials initially triggers no alarm: the actions are technically permitted and fall within the account’s rights. The difference is in behaviour — a different time of day, an unusual location, a folder this user never opens. This is where classic rule-based detection reaches its limits.

Awareness becomes behaviour only when you tie it to real work

An annual e-learning changes little. What does work is practising the situations people actually encounter: have the service desk train on password reset requests, discuss within teams which data may and may not be shared, and let managers experience what it is like to decide under time pressure. Then make reporting the easiest action available, and respond to every report, including the false ones. An employee who raises the alarm too often is a sensor that works well.

Measure the right things while you are at it. The click rate in a phishing test says less than the time between the first click and the first report. That second number determines how much room your SOC has to intervene.

AI makes unwanted patterns visible faster

Where detection rules describe what you already know, machine learning is good at what stands out. Models learn what is normal for a user, device or system — which times, locations, applications and volumes are usual — and flag deviations. Behavioural analytics (UEBA) can spot that an account which normally works nine to five from one location is suddenly accessing large volumes of documents at night.

The gain lies in speed and in connecting weak signals. A failed login, a new device and a slightly unusual data volume mean little individually; together they form a pattern an analyst rarely assembles in time by hand. AI also helps with triage: suppressing known noise and merging separate alerts into a single incident saves hours a day and shortens time to detection.

Two caveats belong here. AI does not replace analysts but strengthens them: a model flags a deviation, while judgement about context and consequences remains human work — and that judgement must be explainable, certainly towards regulators. And the reverse is true too: attackers use AI to phish more convincingly, in flawless language and with knowledge of your organisation. That makes deception harder to spot and a good reporting culture more important.

Where technology and people reinforce each other

The strongest organisations close the loop between the two. An employee who reports a suspicious email produces an indicator that ends up as a detection rule in the SIEM. A pattern the SOC observes — a striking number of MFA requests in one department, say — leads to targeted guidance for exactly that team, instead of a generic email to the whole organisation. Awareness is fed by detection, and detection is fed by people.

Five steps that make the difference

• Map your blind spots — which systems, applications and cloud environments deliver no logs? Start there, not with another tool.
• Tie use cases to scenarios — for each realistic attack scenario, determine which detection you need and test whether it actually fires.
• Make reporting the easiest route — one button, no blame, visible feedback. The speed of reporting often determines the damage.
• Apply AI to noise and behaviour — start with triage and behavioural analytics around identities: that is where the gain is largest and the data cleanest.
• Practise together — have the SOC, service desk, communications and management run the same scenario once a year, so technology and people learn from the same experience.

Resilience is a habit, not a purchase

A SIEM and a SOC give you visibility and the ability to respond. AI increases the speed at which you spot deviations. Alert employees make sure attacks are noticed where technology sees nothing yet. Only when those three reinforce each other — and keep learning from incidents and exercises — does resilience become something you can demonstrate.

Continuous Connect helps organisations with that interplay — from security operations and detection to awareness, exercises and the responsible use of AI. Want to know where you stand? Get in touch; we are happy to advise and to shape a solution that fits your organisation.

Further reading

• ENISA — Threats and trends
• NCSC — Netherlands National Cyber Security Centre

← Back to all blogs