A vendor pitched us a managed SOC, what does that actually mean and is it overkill for us?

The very first question you need to ask the vendor is: 'During an incident, do you have direct authorization to block ports or isolate hosts, or do you merely fire off a notification within the SLA?' If they're just going to open a ticket and call you, there's zero point in paying that money. You don't spend thousands a month just to get notified.

In a 15-person dev shop, there are things to lock down way before looking at a SOC: Enforcing MFA on every account, IP whitelisting on cloud access, regular server patching, and centralized identity management. Without those, a SOC team will just be watching an intruder's footprints after they break in, totally unable to stop them in time.

Get a decent MDR (Managed Detection and Response) license instead of a Managed SOC. You pay per user and per server. For 15 people and a couple of servers, your monthly cost will hover around 300-500 dollars tops instead of 3,500 dollars, and it gets the exact same job done.

This is the favorite sales play of security firms. The second they hear 'healthcare' or 'fintech', they slap their most expensive enterprise tier on the table. Selling a dedicated 24/7 operations center to a 15-person company is textbook over-selling.

we signed a deal like that back in the day too and they kept sending 50 false alarm emails a week. eventually the devs just sent the emails straight to spam. it was totally useless waste of money.

We're a 25-person fintech team; instead of a SOC, we use our cloud provider's native security tools along with an external MDR service. Our total annual security spend doesn't exceed 8,000 dollars and we passed our SOC 2 audits without any issues.

In terms of HIPAA compliance, please verify whether the company you are contracting with signs a BAA (Business Associate Agreement). If there is any risk of patient data appearing in monitoring logs, it is a legal requirement for the provider to assume this liability as well.

let me share what happened to me; it might be useful. i mean if 2FA is on a stolen password alone is useless.

Same here.

The discussion got scattered, let me summarize. Most time waste accumulates in tasks waiting for approval.

Payment information changes are never verified through the channel they came from. Hope this helps.

Noted, thanks.

I have a question. If you scold false alarms, nobody will report again.

If you scold false alarms, nobody will report again. If you post the result here, it will help others too.

I was thinking the same thing. Payment information changes are never verified through the channel they came from.

I feel the same way. I mean hasty decisions become decisions you have to fix six months later.

Im also curious if anyone does it differently.

Absolutely. If I were to add anything: Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Start with a small trial; don't commit to everything at once. I'm also curious if anyone does it differently.

I went through the same thing.

Let me summarize what's been said so far. Having backups accessible on the same network and with the same identity makes them part of the target.

I'm writing this so you don't make the same mistake. Mistakes made on the what is managed soc side are usually reversible but expensive.