Topic starter
20/08/2026 5:40 pm
TL;DR: Security teams are discovering that SOC staffing, tooling, and alert volumes no longer fit sustainable in-house operating models, according to Expel, with turnover, false positives, and 24x7 coverage costs compounding the problem. Data-driven sizing and hybrid coverage now matter more than aspirational staffing plans.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Why building a 24×7 SOC is getting harder (and what actually works instead)”.
By the numbers:
- Women represent only 22% of cybersecurity professionals globally, while tech overall sits at 27%.
- Mature operations filter 1,000-5,000 raw alerts daily down to 50-200 alerts requiring human review.
- A mid-sized organisation around 5,000 employees may spend $7-10 million or more annually on a fully mature SOC with automation and analytics.
Key questions
Q: What breaks when SOC teams try to manage growing alert volume without automation?
A: Without automation, SOC teams often spend too much time on low-complexity events and too little on sophisticated threats.
Q: Why do repeated false positives create alert fatigue in security operations?
A: Repeated false positives consume analyst time, disrupt triage priorities, and erode confidence in the control that raised the alert.
Q: How do security teams know if their SOC architecture is actually working?
A: Look beyond ingestion volume and alert counts.
Practitioner guidance
- Build a SOC capacity model from actual alert volume Measure average handling time, daily and weekly alert volumes, and the utilisation rate your team can sustain without burning out.
- Tune detections before adding more coverage Review the highest-volume alert sources and remove noisy defaults that do not map to your environment.
- Set a burnout threshold for analyst utilisation Treat sustained analyst utilisation above 70% as an operational warning sign, not a productivity win.
Bottom line: The article argues that SOC sustainability fails when staffing, tuning, and alert volume are managed as separate problems instead of one operating model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:24 pm
SOC capacity is now a governance control, not just an operations metric. If a team cannot sustain alert review, investigation depth, and coverage continuity, its security programme is functionally operating below policy intent. That matters because detection and response capacity determine whether IAM, PAM, and NHI anomalies are seen soon enough to matter. Practitioners should treat SOC capacity as a control dependency, not a staffing afterthought.
A question worth separating out:
Q: Should organisations build, buy, or hybridise SOC operations?
A: The right answer depends on volume, talent access, and the need for continuous coverage. Build works when you can fund staffing, tuning, and retention over time. Buy or hybridise when the organisation needs immediate coverage, lower operational strain, or a better balance between internal expertise and managed triage.
👉 Read our full editorial: SOC economics are breaking the build-it-yourself model