Procurement insights for SOC services
Every provider can show you a dashboard. Far fewer can tell you who picks up the phone at 3am, what they are allowed to switch off, and what the second year costs. This page sets out what CYBORIUM tests before an Australian organisation signs a security operations contract.
Most proposals describe the first clock in detail and leave the other four to the implementation call. The gap between them is where cost, risk and disappointment live.
Signal reaches the platform.
Ask: exactly which log sources are inside the quoted price, and what happens to that price when volume grows.
A person decides it matters.
Ask: is triage staffed in Australian hours, offshore overnight, or automated with a human only on exception.
Your phone actually rings.
Ask: who is called, on which channel, and what the provider does when the first two contacts do not answer.
The attacker loses access to something.
Ask: may the provider isolate a host or disable an account without waiting for you, and who carries that decision.
The record survives the incident.
Ask: which artefacts are retained, for how long, and whether you can take them with you when the contract ends.
A response time in a service level table means nothing until you know which of these five clocks it is measuring.
These are the patterns CYBORIUM keeps finding when a security operations agreement is opened up and read against what the organisation believed it bought.
Data charges are often quoted per gigabyte per day using an estimate the decision owner supplied. Cloud audit logs and identity telemetry are the two sources that most often break the estimate in year one.
Endpoint agents are the easiest part to deploy and the easiest part to sell. Identity, email, software as a service and cloud control planes are where intrusions are increasingly visible first.
A proposal can promise response and deliver a well written recommendation at 2am. If nobody at the provider is contractually able to act, the containment clock is still yours.
Detection quality decays. If rule tuning, false positive reduction and use case development are not funded as ongoing work, alert fatigue arrives on schedule.
Custom detection logic, enrichment and playbooks built during the term are frequently the provider's property. That single clause decides how expensive it is to change your mind.
Volume of alerts closed is a measure of the provider being busy. It is not a measure of your exposure falling, and a board reading it will ask the wrong questions.
Decision owners ask for a SOC. Providers answer with whichever of these they sell. The categories are not interchangeable, and comparing them side by side without normalising the scope is how a market process produces a false result.
Monitoring, triage, escalation and reporting delivered end to end by the provider on their platform.
Test the market when you have no internal analyst capability and no appetite to build one.
Your team owns business hours and the provider carries nights, weekends and surge. Split responsibility is the hardest thing to document well.
Test the market when you already employ security analysts but cannot sustain a roster.
Detection plus a contractual right to take containment action. The word response is doing significant work in this category and must be defined.
Test the market when your risk appetite requires action overnight rather than notification.
The lightest form. Alerts are watched and forwarded. Useful, cheaper, and frequently mistaken for the category above it.
Test the market when the driver is a contractual or insurance requirement rather than a threat model.
You license the detection platform directly and buy engineering time to run it. Licensing and labour stay separable, which protects the exit.
Test the market when you intend to keep the data and the detections in your own tenancy.
Scheduled proactive search for activity that existing detections did not raise. Sold by the hour or by the campaign.
Test the market when monitoring is mature and you need to prove the absence of something.
Pre agreed rates, guaranteed availability and an agreed scope of work for the day it goes wrong. Often priced as a drawdown.
Test the market when the current arrangement is an informal relationship with no service level.
Detection focused on directory, single sign on and privilege abuse rather than on hosts. Increasingly the first place an intrusion is visible.
Test the market when your workforce is cloud first and endpoint coverage is already sound.
Control plane, workload and container telemetry. A different skill set and a different data volume profile to endpoint monitoring.
Test the market when production has moved to public cloud but monitoring has not followed it.
Passive monitoring of industrial and building control networks, where an agent is usually not permitted and availability outranks confidentiality.
Test the market when physical operations sit behind the same corporate network as email.
No provider is named on this page. Names belong inside an evaluation, next to the evidence that earned them a place on the shortlist.
The CYBORIUM position
These are not preferences. They are the tests that decide whether a proposal survives to the shortlist.
Scope is the price. Write down every source, its daily volume and its retention requirement, then let providers quote against one identical list.
Onboarding discounts, ramped ingestion and waived tuning fees make year one unrepresentative. Model years two and three or the comparison is fiction.
They have different service levels, different liabilities and different staffing. Bundling them hides which one you are actually paying for.
A reference call is marketing. A walkthrough of a genuine out of hours escalation, with timestamps and the artefacts produced, is evidence.
Custom rules, enrichment, playbooks and historical telemetry should be portable by contract. Exit cost is decided at signature, not at termination.
Ask for a genuine sample report with a customer redacted. If it cannot support a risk committee conversation, it will not support yours.
Six charging models dominate this market. Each one is defensible. Each one also has a predictable place where the invoice stops matching the expectation, and that place is worth naming during procurement rather than in month seven.
| Charging unit | Usually suits | Where it escalates |
|---|---|---|
| Per user | Stable office based workforces | Contractors, service accounts and shared devices are counted inconsistently between providers. |
| Per endpoint or device | Device heavy operations | Servers, virtual desktops and ephemeral cloud workloads may each be billed as an endpoint. |
| Per gigabyte ingested | Organisations with measured log volume | Verbose cloud and identity logging can multiply volume without any change to headcount. |
| Per data source connected | Small, well defined estates | Each new application becomes a commercial conversation, which discourages adding visibility. |
| Flat monthly retainer | Budget predictability | Fair use clauses define the ceiling, and they are often written loosely enough to be argued either way. |
| Retainer plus drawdown hours | Incident response and forensics | Unused hours frequently expire, and the hourly rate for exceeding them is rarely capped. |
A market evaluation normalises these into one comparable number. Skip it and the comparison runs between charging units rather than between offers.
Regulated entities cannot delegate accountability to a security provider. These are the public obligations most often engaged when monitoring is outsourced.
Information security. It requires an APRA regulated entity to maintain information security capability commensurate with the threats it faces, and it applies where information assets are managed by a related party or a third party.
Operational risk management. A security operations provider will frequently meet the definition of a material service provider, which brings register, due diligence, monitoring and contractual obligations with it.
Full guidance: CYBORIUM CPS 230 due diligence and apra.gov.au/standards/cps-230
Everything above sharpens the questions. A CYBORIUM evaluation answers them with the market.
A managed SOC describes the function, which is continuous monitoring, triage, escalation and reporting. Managed detection and response describes an outcome, which is that the provider is able to take containment action on your behalf. Many providers use the terms interchangeably, so the only reliable test is to read what the contract permits the provider to do without your approval at 3am.
CPS 234 does not mandate a security operations centre. It requires information security capability commensurate with the size and extent of threats to an entity's information assets, along with the ability to detect and respond to incidents in a timely way and to notify APRA within 72 hours of a material incident. For most regulated entities that combination is difficult to evidence without continuous monitoring in some form, whether internal, co-managed or outsourced.
Normalise before you compare. Fix one set of volume assumptions, apply them to every charging model, extend the calculation to at least three years and add the cost of exiting. A per user price and a per gigabyte price are not comparable numbers until they sit on the same assumptions, and small differences in those assumptions routinely change the ranking.
Not automatically. It is a documented decision with consequences for data residency, contractual access, escalation quality and, in regulated sectors, service provider obligations. The problem is when it is discovered after signature rather than assessed during evaluation. Ask where analysts are located per shift, where telemetry is stored and processed, and how that maps to your own obligations.
At minimum, your historical telemetry in a usable format, the custom detection logic and enrichment built for your environment, the case history and the documented playbooks. Anything the provider retains is something the next provider will rebuild at your cost, so exit terms belong in the evaluation criteria rather than in the legal review at the end.
It depends on the size of the estate and how well the log source inventory is understood at the start. The requirement definition stage is usually the longest, because it is where scope is measured rather than estimated. Providers can respond quickly once they are all answering the same question, which is the point of doing the definition work first.
Security operations proposals are unusually hard to compare and unusually expensive to get wrong. CYBORIUM defines the requirement, runs the market, tests the evidence and builds the record behind a decision you can defend.