The Burglar Alarm Problem – Why a SOC Alone Isn’t Good Enough

Imagine you fit the best monitored alarm money can buy with sensors on every window, cameras front and back, and a guaranteed police response in under eight minutes (on that last point: I appreciate the reality differs, but "imagine" is the key word here 😉).

But then you forget to lock the door. Or you left the key in the plants outside the house, and the burglar walks straight in.

Yes, your alarm goes off. But the burglar also manages to spend six minutes in your house and leaves before the police arrives.

See where the problem is?

While the alarm did exactly what it promised, it doesn’t save you from wondering what they touched, what they took, what they photographed, and whether they'll be back. So as an actual fact, the response time didn’t protect you but just shortened the burglary.

So, here's the question I keep coming back to in conversations with prospective clients: if you wouldn't accept that standard for your home, why do so many businesses accept it for their entire operation?

The Problem: a SOC Cannot Fully Prevent Damage

A Security Operations Centre is a serious investment and means someone is watching, 24/7 eyes on your estate, alerts triaged, incidents escalated, threats contained. A good SOC is valuable, and I'd never advise anyone to go without one – not least one of the reasons why we’ve teamed up with Huntress to deliver that capability to our customers.

But if you take a closer look, you’ll notice a shortcoming. Yes, while your systems are monitored proactively, a SOC detects that something bad is already happening and works to stop it getting worse. That's it. Every metric it's judged on — mean time to detect, mean time to respond — only starts counting after an attacker is already inside your business.

The Clock Starts When You're Already Losing

CrowdStrike's 2026 Global Threat Report found that average eCrime “breakout time” — the gap between an attacker's initial foothold and their first lateral move across your network — has fallen to 29 minutes, with the fastest observed a mere 27 seconds. What’s worse: in one case the data theft began in just four minutes after initial access.

Mandiant's M-Trends 2026 report tells a similar story from the other end: the median time between an attacker gaining access and handing that access off to a second criminal group is now 22 seconds, down from over eight hours in 2022.

Now set that against reality. Mandiant puts global median dwell time — how long attackers sit undetected in an environment — at 14 days. That's up from 11 the previous year, and 10 the year before that. Detection is getting slower while attacks get faster. And roughly half of organisations still don't find the intrusion themselves (not even the FBI, as it turns out); someone else tells them.

So, let me get this straight: The adversary needs 29 minutes while a typical business needs a fortnight. Even a genuinely excellent SOC, hitting response times most organisations only dream about, is entering a race that started without them.

Containment Is Not Restoration

Compared to at least the chance of the police recovering your television in the house burglary analogy, there’s no such equivalent in a cyber incident.

Once your customer database has been copied out to infrastructure you don't control, it is gone. And by that I mean permanently, irreversibly, and beyond any remedy your provider can offer. “Contained” means the bleeding stopped, but it cannot undo the theft.

You'll still make the ICO notification, write to your customers and answer your biggest client's security questionnaire. Then you’ll also have to explain it to your insurer, and carry it through every renewal conversation for years. IBM's most recent research puts the average UK data breach at £3.29 million.

And when a client asks “how did this happen?” - let me tell you they won’t rest assured by you telling them you’ve spotted it quickly.

The Decisions That Determine Your Breach Were Made Months Earlier

This is the heart of it.

For the sixth consecutive year, Mandiant found that exploitation of vulnerabilities is the single most common way attackers get in: 32% of intrusions where an entry point could be established. Voice phishing was second. CrowdStrike, meanwhile, reports that 82% of detections in 2025 involved no malware at all. Cybersecurity provider Huntress meanwhile reports 85.7% of organisations don’t even have system-preferred multi-factor authentication turned on. Meaning attackers don't even need to break in. Instead they're logging in, with credentials that work.

Read those three findings together and something becomes obvious: the dominant routes into your business are an unpatched system, a working password, and a lack of basic security settings turned on.

They're all posture problems and all created weeks or months before any alert fired, by a missed patch, an over-privileged account, a legacy authentication protocol nobody switched off, a forgotten test environment left exposed to the internet, or a helpdesk with no identity verification procedure.

A SOC cannot fix any of that because it isn't designed to. It will faithfully tell you when someone walks through the door you left open, but it was never its job to close the door.

Get the Foundations Right

This is where working with an MSP or CSP that owns your security posture - rather than just your alerting - changes the equation. Because the work itself is unglamorous and mostly invisible, it often gets underfunded:

• Knowing what you expose, what's reachable from the internet today, including what you deployed a long time ago. Continuous external attack surface discovery.
• Risk-based vulnerability management. Patching prioritised by what's being actively exploited in the wild.
• Identity hardening. Phishing-resistant MFA, conditional access, legacy authentication disabled, standing admin rights removed, privileged access properly managed. If 82% of intrusions are credential-driven, this is where the fight is.
• Configuration baselines and drift detection. Secure benchmarks applied across Microsoft 365, Entra, Azure, AWS — and monitored because configurations decay.
• Segmentation and least privilege. So one compromised laptop stays at one compromised laptop
• Tested backup and recovery. Immutable, segregated, restore-tested. Assume your backups are a target because they are.
• People and process. Phishing and vishing (voice phishing) simulation, and hard verification procedures at the help desk. Several of the UK's most damaging recent incidents began with a convincing phone call and a credential reset.
• Supply chain and third-party risk. Your security is your suppliers' security.
• Genuine testing. Penetration testing, purple teaming, and tabletop exercises to know that your plan works before an incident will test it.

Why the Combination Beats Either Half

A smaller attack surface makes the SOC dramatically better. Alert fatigue is the leading cause of missed detections. Every unnecessary exposure, over-privileged account and unmanaged device generates noise. Reduce the estate you're defending, and the signal-to-noise ratio improves: the same analysts, watching less, catch more.

Hardening buys back the minutes the attacker took. Proper segmentation, tight identity controls and constrained privilege prevent and slow down intrusions. Every barrier between initial access and your crown jewels is time credited back to your responders. That's how you compete with a 29-minute breakout window.

Detection quality depends on knowing the environment. You can only detect if your infrastructure is inventoried, hence asset discovery is necessary for good monitoring.

The intelligence flows both ways. Every incident, near-miss and blocked attempt your SOC sees is evidence of a control gap. In a joined-up model, this evidence becomes a hardening action whereas in a fragmented one, it becomes a closed ticket — and the same incident again next quarter.

And critically, it closes the accountability gap. A SOC raises a ticket. But somebody still has to patch that server, revoke that token, rebuild that endpoint, close that firewall rule. When one accountable partner owns both the detection and the remediation, findings turn into fixes.

The Questions Worth Asking

Next time you review your security arrangements, try these:

• When did we last reduce our attack surface — and can we evidence it?
• Who is accountable for fixing what the SOC finds, and what's their SLA?
• How many of last year's alerts traced back to a preventable weakness?
• If we detected and contained an intrusion in 20 minutes, could we explain to our largest customer why it was possible at all?
• Have we tested a full restore this year, assuming the backups were targeted first?

Hint: If those questions are difficult to answer, the problem isn’t your monitoring.

Don't Mistake Having a SOC for Safety

Of course I wouldn't advise you to rip out the alarm, why would I? You'll still have the monitoring, the response times, and the people watching at 1am because it makes sense, and it provides ease of mind - but only to a certain extent.

It doesn't mean you're safe.

Safety is all locked doors, the deadbolt, the reinforced frame, the bolted side gate, the spare key that isn't under the mat, and the valuables that aren't sitting on the kitchen table. It's everything that makes the alarm a last line of defence - not the only one.

You wouldn't feel safe knowing someone had been inside your home, no matter how quickly they were removed.

So why would you feel safe knowing someone had been inside your business.

Interested in how we can help you secure your digital estate? Book a meeting with us by clicking on the banner below.