Building a Small Security Operations Center: Three Pillars and a 90-Day Plan

It is 3 a.m. An administrator account logs into your file server from another country. Who notices first, and when? In most mid-size organizations, the honest answer is nobody, at least until a ransom note arrives. A security operations center exists to change that answer, and contrary to popular belief, a useful one does not require dozens of analysts or a bank-sized budget.

The problem is visibility, not tooling

In the organizations I review, the firewall keeps logs, the antivirus raises alerts and Active Directory records events. Yet each one lives alone in its own console, and nobody connects the pieces. IBM's Cost of a Data Breach 2025 report puts the average time to identify and contain a breach at 241 days, roughly eight months of free movement for an attacker. The goal of a small SOC is to shrink that window from months to hours.

Three pillars that must work together

• A SIEM with few but valuable sources: start with domain controllers, the perimeter firewall and VPN, endpoint alerts and critical servers. About twenty precise correlation rules cover most common scenarios; ingesting every log on day one mostly produces noise.
• EDR/XDR with automated response: when nobody is at the console overnight, a rule that instantly isolates a device showing mass-encryption behavior acts as the night shift.
• Continuous vulnerability management: when two alerts fire at once, knowing which server is actually exploitable tells you which one to investigate first.

People and process, the forgotten part

Tools without process are just a colorful dashboard. The minimum is two or three people with clear roles, five one-page playbooks (compromised account, phishing, endpoint malware, ransomware, data leak), an on-call number for critical alerts, and a weekly half-hour meeting to review false positives and tune rules.

The roadmap I recommend has three 30-day phases: first the asset inventory, vulnerability scanning and endpoint response; then the SIEM and the integrations that feed it; finally the playbooks and a tabletop exercise that measures time to detect and contain. That number becomes your progress indicator for the months ahead.

The full guide, with the log-source priorities and the 90-day plan, is here: https://symantecland.com/small-soc-mid-size-organization-90-day-plan/?utm_source=medium&utm_medium=article&utm_campaign=sx_syndication

— Kazem Mortazavi, independent network-security consultant