It is a human-centred function. Automation absorbs what is already known; whatever it cannot settle moves up to analysts, one tier at a time.
A wall of screens gets watched. A SOC makes decisions. The whole difference lies in what happens after the alert: who reads it, who rules it real, who cuts the access, who puts the machine back into service.
A modern SOC is therefore a human-centred function, organised so that analyst judgement is spent where it counts. Anything already known (the phishing campaign already seen, the file already classified) is handled by the machine in seconds, without waking anyone.
Source: Vectra AI, 2023 State of Threat Detection, Sapio Research survey of 2,000 SOC analysts at organizations with more than 1,000 employees.
What remains is ambiguous by construction. That is the material a SOC arranges into tiers: the higher you go, the fewer the cases, and the more skill and time each one demands.
Each tier receives what the previous one could not close. Volume collapses from one tier to the next; difficulty rises.
The SOC, tier by tier
Machine
Detection rules, SOAR playbooks, automated responses. Anything resembling an already handled case is settled in seconds, with no human involved.
A phishing email identical to an already blocked template is pulled from every affected mailbox before it is opened.
Whatever is not settled here moves up one tier.
Tier 1
Triage analysts absorb the volume. They qualify fast, discard false positives, close known incidents and pass on whatever resists.
A sign-in from an unusual country: if a trip is planned, the alert is closed; if not, it moves up one tier.
Whatever is not settled here moves up one tier.
Tier 2
Analysis of multi-stage attacks: rebuilding the timeline, measuring the compromised perimeter, coordinating remediation with business teams.
This is the end of the escalation chain: an incident that arrives here is driven to closure.
Hunting receives no escalations. It starts from what nobody reported.
Tier 3
Hunting does not process alerts. It forms hypotheses about what may have gone unnoticed, verifies them against the data, and turns every finding into a detection rule.
What it writes flows back down to the automation tier: that is how a SOC learns.
Both figures in this article are market figures, not DMC DEFENSE measurements.
Sources accessed on 29 September 2026.
DefinitionArticle · 4 min
Security Information and Event Management: how to centralize, analyze and correlate security events to detect threats in real-time.
Read the articleDefinitionArticle · 5 min
Security Orchestration, Automation and Response: the automation that runs in seconds the response an analyst would take far longer to carry out by hand.
Read the articleDMC DEFENSE runs a SOC built on the Microsoft security stack, with analysts on duty and your data staying in your own Microsoft tenant. It is a standalone offering, sized to your estate.
