Anyone who follows spaceflight knows the sight: a dim room, rows of consoles, and a team that reacts to telemetry around the clock. Security teams built a nearly identical room for their own world, and the work that keeps it dependable is what this article calls SOC Ops. Below is a state-of-the-field reading, written the way an orbit analyst would read a trend line: what the data says, where it is uncertain and what is still unsettled.
What SOC Ops actually covers
The idea is to run a security operations centre as a dependable service. Alerts come in, people decide what each one means, and every decision is written down. The tiers, playbooks, shift handovers, tooling and metrics all exist to make that loop repeatable. The Ops Atlas entry on SOC Ops frames it this way and is candid about naming: the function is well established, while the label “SOC Ops” is the Atlas’s own informal coinage. A national standards glossary, it notes, lists SOC only as an acronym.
That naming looseness is old. MITRE catalogues seven different names for the same family of teams, including CSIRT, CERT and CSOC, and concludes that no single term is universally agreed. Security operations centres began to appear in the 1990s, and the European agency ENISA calls CERT the oldest label. For readers coming from astronomy, think of how many catalogue designations a single star can carry.
A short timeline of the guidance
Published guidance has accumulated in steps, and the pace has picked up. According to the Atlas, the sequence runs like this:
- 2014: MITRE publishes a set of ten strategies for building a SOC, later expanded to eleven in 2022.
- 2016: the SOC-CMM maturity model appears, born from a master’s thesis and now an open self-assessment.
- 2017: FIRST releases the first version of its CSIRT Services Framework.
- 2020: ENISA publishes a guide to setting up CSIRT and SOC capabilities.
- 2022: the UK’s NCSC releases its own guidance on building a SOC.
- 2024: NIST CSF 2.0 arrives, including a subcategory about declaring an incident once adverse events meet written criteria.
- 2025: NIST SP 800-61 Revision 3 and joint ASD and CISA guidance on SIEM and SOAR platforms.
Read as a series, the trend is toward the operational middle. Early documents argued about why a SOC should exist. Recent ones argue about how its daily queue should behave, which is a more mature conversation.
What the dwell-time numbers suggest
Trend lines need data. The Atlas cites Mandiant’s M-Trends 2026 report, which puts the global median dwell time, the gap between intruder arrival and discovery, at 14 days. That is up from 11 the year before. At the same time, the share of intrusions discovered internally rose from 43 percent to 52 percent, meaning more organisations now find problems themselves rather than being told by outsiders.
Two readings are possible, and the honest answer is that the figures alone cannot separate them. Longer dwell could reflect stealthier intruders, or it could reflect organisations finding older compromises they previously never saw. Better internal detection is consistent with the second explanation. Think of a telescope upgrade: the catalogue suddenly lists more faint objects, and it would be wrong to conclude the sky itself changed.
Where the daily work is heading
The sharpest recent shift is in how performance gets measured. The Atlas recommends reporting the median and the 90th-percentile time-to-triage per shift and per severity instead of a single average. MITRE’s own illustration is memorable: one email that sat untouched for two days can wreck a mean response figure. In one lab example the Atlas describes, the overall median triage time was seven minutes, yet the after-hours median reached 512 minutes. An average would have buried that night gap completely.
Mission control teams learned this long ago. A launch-day console is staffed for the worst hour, not the average one. The security equivalent is a queue model: arrival rate, handling time and staffing together determine how long an alert waits. MITRE’s rule of thumb is that one seat covered around the clock needs about five full-time people, and that at least two analysts should be on shift at all times.
Two quiet trends worth watching
First, the disposition vocabulary is getting stricter. Rather than closing alerts as “false positive” by reflex, mature teams record one of four outcomes: true positive, benign positive, false positive or undetermined. Research the Atlas cites, covering 21 practitioners across seven SOCs, found that most so-called false positives were in fact benign triggers, legitimate activity that simply needed context. That reframes tuning work. The fix is often better context for the analyst, not a rewrite of the detection.
Second, automation is being asked to earn its place. The ASD and CISA guidance warns that SOAR is usually not suitable for immature environments, so the order of adoption is SIEM first. The Atlas adds guardrails: automatic containment only for proven rules on ordinary user devices with a rate limit, while critical assets stay under human decision. Any suppression needs a named owner and an expiry date. A rule that quietly mutes alerts forever is the security version of a sensor you stopped reading.
Separating signal from headline
A neat headline would say SOC Ops is simply “maturing.” The defensible claim is narrower. The guidance corpus has grown, the metrics advice has become more statistical, and the vocabulary for closing an alert has become more precise. Whether dwell times are really lengthening is still debatable. And nothing in the sources suggests the human triage layer is disappearing; MITRE’s wording is that automation shrank the pool without eliminating it.
If this subject is new to you, our earlier piece on how a satellite settles into a fixed orbit above the equator shows the same habit of mind: understand the mechanism first, then read the numbers. For a gentler companion read about another orbital regime, see the beginner-friendly tour of the nearest orbital band. Both reward the same discipline that security operations does, which is to keep records, check assumptions and distrust a single tidy figure.
Looking ahead, the questions worth tracking are plain ones. Do organisations publish median and percentile triage times? Do they separate benign positives from detection faults? Do night shifts get the same attention as day shifts? Teams that can answer yes to all three are running something closer to a service than a pile of dashboards, and that is the quiet story of SOC Ops in 2026.