What Is a 24/7 SOC, and Does Your Business Need One?

A Security Operations Centre is a team whose job is to watch the alerts your security systems produce, investigate the ones that look real, and start the response when something is confirmed. The tools (Defender, Entra ID, your firewall, your backup) generate signals around the clock. The SOC supplies judgement, continuity and urgency. Without one, an alert at 11pm on Saturday is read at 9am on Monday, which in a ransomware incident is the difference between one laptop and the whole business.

Large organisations run their own. Small businesses cannot, which is why SOC services exist: a shared team watching many businesses' tenants, with procedures agreed in advance for each.

1. Monitoring. Alerts from your Microsoft 365 tenant (Defender for Business or Endpoint, Defender for Office 365, Entra ID sign-in and identity protection) and, where included, other systems flow to the SOC platform continuously. For our clients the sources are the Microsoft 365 tenant's own security signals: Defender for Business or Defender for Endpoint on the devices, Defender for Office 365 for email, and Entra ID sign-in and identity protection. Business Premium produces them; the Defender Suite adds richer data and longer history.
2. Triage. Most alerts are noise: a director logging in from a hotel, a known admin tool, a false positive. An analyst confirms and closes these without waking anyone. The value of a good SOC is as much in what it does not escalate as in what it does.
3. Investigation. For anything that looks real, the analyst builds the picture: which account, which device, what happened before and after, is it spreading.
4. Escalation and response. Confirmed incidents go to your nominated contacts and our engineers under an agreed procedure. Some containment actions are pre-authorised so they happen immediately; others wait for your decision. On our 24/7 tier, Barracuda's SOC contains endpoint threats through the endpoint agent and can suspend a compromised account where the tenant is connected; everything else arrives as remediation guidance, which our engineers act on under the procedure agreed with you. Barracuda's published service levels: high-risk incidents are escalated by phone call and ticket within 20 minutes, working down your contact list until someone answers; medium-risk by email or ticket within 1 hour; low-risk within 8 hours; 24 hours a day, 365 days a year.
5. Recovery and lessons. Engineers restore, close the gap that let it in, and write up what happened.

This scenario is illustrative, not a customer story.

02:10, Wednesday. A member of staff's password, reused from a breached shopping site, is tried against Microsoft 365 by an automated attacker. MFA blocks the sign-in, but the attacker sends a burst of push notifications hoping the user approves one half-asleep. Entra ID raises a risky sign-in alert.

02:14. The SOC sees the alert: sign-in attempts from an unfamiliar country, multiple MFA denials, then one approval. That last detail changes everything: the attacker is in.

02:20. Under the pre-agreed procedure, the analyst revokes the account's sessions and forces a password reset, cutting the attacker's access. A check of the mailbox finds a newly created rule forwarding invoices to an external address, created at 02:16. It is removed and the address noted.

02:35. The incident is escalated to the on-call engineer and the client's nominated contact by the agreed channel, with what happened and what was done.

08:30. The user re-registers MFA with a phishing-resistant method. The engineer reviews sign-in logs, confirms nothing else was touched, checks whether any invoices were sent during the window, and adds the attacker's infrastructure to block lists. A short write-up goes to the client.

The point is not that the attack was stopped. It is that the forwarding rule was found at 02:20 rather than when a customer rang three weeks later to ask why their payment had not arrived.

• It does not prevent attacks. Prevention is configuration: MFA, patching, email protection, device management. The SOC catches what gets past them.
• It does not replace backups. If ransomware runs, restoration is a backup job. The SOC's role is to make the blast radius one device rather than all of them.
• It does not see what it is not connected to. A SOC watching Microsoft 365 does not see an on-premises server or a SaaS app unless those are fed in.
• It does not guarantee anything. Any provider promising no breach is selling something else. What a SOC changes is time to detection and time to response.
• It is not a substitute for people knowing what to do. Staff still need to know how to report a suspicious email and what happens next.

Signs that point to yes:

• You hold client, financial or personal data that would hurt to lose or leak.
• Staff work outside office hours or across time zones, so attacks have cover.
• An insurer or customer asks about detection and response, or your renewal price depends on it.
• You have already had an account compromise, a near miss or an invoice fraud attempt.
• You have Business Premium or the Defender Suite and nobody reads what they report.

Signs that you can wait: a very small team, no sensitive data, and a provider who reviews alerts every working day. Even then, the gap between Friday evening and Monday morning is the risk to weigh.

Cost depends on the number of users and devices and what is monitored. It is a monthly per-user or per-device fee on top of managed support. Our Defender Monitoring as a Service is £16 per user per month excluding VAT; the Barracuda SOC tier for 24/7 cover is priced per user per month on request. Compare it with the cost of a single business-hours-only incident that ran for a weekend.

Our SOC service monitors clients' Microsoft 365 tenants around the clock, triages and investigates alerts, and escalates confirmed incidents under a procedure agreed with each client at onboarding. It is included in our managed security offering and can be added to an existing managed service. Eligibility and prerequisites: Business Premium or the Defender Suite on every user and device in scope. Included response: triage, investigation and escalation to your nominated contacts, plus the containment actions agreed at onboarding, such as isolating a device or disabling an account. Barracuda's SOC provides the overnight and weekend layer to its published service levels: phone call and ticket within 20 minutes for high-risk incidents, email or ticket within 1 hour for medium and 8 hours for low.

For the prevention side, see Is your Microsoft 365 actually secure? and the Microsoft 365 licensing and security guide, which explains the licence that gives the SOC something to watch.