Security Operations Center (SOC)

Attack at 3 AM - Company Lost €1.2 Million

A manufacturing company was attacked by ransomware on Saturday at 3:17 AM. Malware spread for 14 hours before anyone noticed on Monday morning. 80% of production systems were encrypted. Downtime cost: €1.2 million.

Without 24/7 SOC:

• Attacks remain undetected for hours or days (average 197 days)
• No response in the critical first minutes of an attack
• You don’t meet NIS2 monitoring requirements
• Downtime costs thousands to tens of thousands of euros per hour

SOC Ready to Go - Without Building a Team

Don’t wait 18 months to build your own SOC for hundreds of thousands of euros a year. Our security analysts team monitors your infrastructure 24/7/365 from the day you sign the contract.

What you get:

• SIEM monitoring with IBM QRadar, Splunk, or Microsoft Sentinel
• Threat detection with AI/ML and global threat intelligence
• Tier 1, 2, and 3 analyst team available non-stop
• Guaranteed incident response time per the SLA agreed in your contract
• Proactive threat hunting every week
• Monthly reports with metrics for management
• Support for NIS2 compliance reporting

How Does Incident Handling Work at nFlo SOC?

The diagram below shows the standard security alert handling process by our SOC team - from detection to incident closure.

flowchart TD
    subgraph DETECTION["🔍 DETECTION"]
        A[Alert from SIEM/EDR/NDR] --> B{Tier 1: Initial Analysis}
        B -->|False Positive| C[Close + Rule Tuning]
        B -->|True Positive| D[Escalate to Tier 2]
    end

    subgraph ANALYSIS["🔬 ANALYSIS"]
        D --> E[Tier 2: Deep Analysis]
        E --> F{Severity Assessment}
        F -->|Low/Medium| G[Remediation Recommendations]
        F -->|High/Critical| H[Escalate to Tier 3 + Client]
    end

    subgraph RESPONSE["⚡ RESPONSE"]
        H --> I[Tier 3: Incident Response]
        I --> J[Containment - Isolate Threat]
        J --> K[Eradication - Remove]
        K --> L[Recovery - Restore]
    end

    subgraph CLOSURE["📋 CLOSURE"]
        G --> M[Report + Recommendations]
        L --> M
        M --> N[Lessons Learned]
        N --> O[Update Playbooks]
    end

    style DETECTION fill:#1e1b4b,stroke:#6366f1
    style ANALYSIS fill:#1e1b4b,stroke:#6366f1
    style RESPONSE fill:#1e1b4b,stroke:#6366f1
    style CLOSURE fill:#1e1b4b,stroke:#6366f1

Key Process Metrics

Stage	nFlo SLA	Industry Benchmark
Response Time	per contractual SLA	4-24 hours
Time to Escalation	< 30 min	1-4 hours
Critical Containment	< 1 hour	4-8 hours
Post-Incident Report	24-48 hours	1-2 weeks

Escalation, containment and reporting times are our standard process commitments. Incident response time is agreed individually in the contract — the agreed SLA level affects the price of the service.

Who Is It For?

This service is for you if:

• You’re subject to NIS2 and need continuous security monitoring
• You don’t have a budget of about €470,000 or more a year for your own SOC
• Your IT team lacks security operations competencies
• You need fast incident response times (SLA)
• You want predictable costs instead of recruiting and training

SOC as a Service — What It Covers, How It Is Priced and Who It Is For

SOC as a service means that security monitoring, alert analysis and incident response are run by the nFlo team, so your company does not have to build its own security operations center. It is one of the models described in NIST SP 800-61r3 (April 2025): the people who handle incidents can work in-house, work on contract — NIST’s own example is an MSSP (an external provider of managed security services) running the SOC — or be called in when needed. Many organizations combine these approaches, for example handling basic incidents themselves and bringing in outside help for some of them.

What SOC as a service from nFlo covers:

• 24/7/365 SIEM monitoring (IBM QRadar, Splunk or Microsoft Sentinel), event correlation from EDR and NDR, and threat intelligence;
• alert analysis across three support tiers — from dismissing false positives in Tier 1 to incident response and forensic analysis in Tier 3;
• weekly threat hunting and monthly reports for management;
• support with the obligations of the NIS2 Directive: incident handling is one of the minimum risk-management measures under Article 21(2)(b), and Article 23(4) requires essential and important entities to send an early warning no later than 24 hours after they learn of a significant incident, an incident notification within 72 hours, and the closing report at most a month after the notification.

How the SOC service is priced. You pay a monthly subscription instead of keeping a team of analysts, tools and an on-call rota. Prices start from about €1,900 net per month and depend on the number of monitored log sources and the SLA level you need — see the full ranges in the answer to “How much does SOC as a Service cost?” in the FAQ below. The incident response time is written into the contract.

What to settle in the contract. NIST describes working with a provider as a shared responsibility model: the company hands part of its duties to the provider, so the contract should spell out how they are split — information flows, coordination, the provider’s authority to act on the client’s behalf and its limits (for example, whether the provider may shut down a service on its own to contain an incident). A SOC provider has privileged access to systems and data, so that risk has to be addressed as well, for example through a non-disclosure agreement and contract clauses.

Who SOC as a service is for. It is a model for organizations that have no security analysts of their own and no budget for a team working three shifts. Mid-sized companies wondering what still stays on their side once the service is in place can read our article SOC as a service for mid-sized companies. You can discuss the scope for your organization with us through the contact form.

SOC vs SIEM — How Do They Differ and Work Together?

SIEM and SOC often appear in the same sentence, but they mean different things. SIEM is a technology: it collects logs and events from servers, networks, endpoints and cloud services, correlates them and generates alerts — we cover it in more depth in the article what is SIEM. A SOC is the team and the processes that put those alerts to use. In its guide to setting up CSIRT and SOC teams, ENISA describes a SOC as a team that detects incidents by watching technical events across networks and systems, and that may also be responsible for handling them. According to ENISA, such teams usually grow out of IT security departments that automate monitoring with SIEM and orchestration tools.

The SIEM platform is therefore the analyst’s workbench, while the quality of the service depends on the team’s work. ENISA lists typical SOC indicators: detection speed and breadth, coverage of the environment, the false-positive rate, and the number of incidents handled and escalations. One example of a SIEM platform operated within the nFlo SOC service is Microsoft Sentinel — a SIEM built natively for the cloud, which we use mainly in Azure and Microsoft 365 environments. In other deployments the analysts work on IBM QRadar or Splunk; we choose the platform to fit the client’s environment.

SOC Support Levels

Tier 1 - Alert Monitoring

Our Tier 1 team works 24/7 and:

• Monitors all SIEM alerts
• Conducts initial analysis and classification
• Escalates serious incidents to Tier 2
• Closes false positives

Tier 2 - Incident Analysis

Tier 2 analysts handle:

• In-depth security incident analysis
• Threat hunting - proactive threat searching
• Creating remediation recommendations
• Adjusting detection rules

Tier 3 - Expert Response

Tier 3 experts engage in:

• Most complex incidents
• Forensic analysis (digital forensics)
• Malware reverse engineering
• Support in audit preparation

Related Glossary Terms

Learn more about key concepts related to this service:

• Cloud
• EDR
• ICS
• Incident Response
• NDR (Network Detection and Response)
• NIS2
• Security Operations Center (SOC)
• SOC