Designing an Effective SOC: From Strategy to Target Operating Model

Greg Morton (Principal Cloud Security Consultant at Bridewell) starts from the position that a SOC only works if its remit is tied to business priorities rather than copied from a template.

The session covers the operating model trade-offs between running it in-house, outsourcing it, or a hybrid, then the people, process, technology and governance that need to sit behind it. There's a section on defining who owns detection, investigation and response, and on the metrics that actually show whether it's working.

It closes on building a roadmap from current capability to target state. This is planning and strategy rather than tooling, so it suits anyone weighing up a managed SOC or trying to justify one.