Managed SOC: your outsourced security department
Startups and companies without in-house security capacity hand us their security operations center. We monitor around the clock, respond to incidents within one hour and fix the finding ourselves within 24 hours, down to the code. One dedicated team works as your security department.
What the Managed SOC includes
The Managed SOC covers everything in the Business plan and adds continuous operation. Agents we built ourselves watch your systems. Human specialists check every finding before it reaches you.
- Monitoring around the clock, 24/7.
- Incident response within 1 hour.
- Fix within 24 hours, down to the code.
- One dedicated team as your security department.
- Custom surfaces for MSP and multi-tenant setups.
- White-label delivery and agreed SLAs.
- Compliance automation for your auditor (see the Compliance Automation page).
Who it is for
The offer fits startups that sell to larger customers and receive security questionnaires. It fits growing companies that have no security team yet, and enterprises that want an additional team on call. Managed service providers can run it with their own surfaces and their own branding.
The name Managed SOC describes a service. It has no connection to the SOC 2 audit standard, which the Compliance Automation page explains.
How a SOC engagement starts
Every engagement begins with a look at your public attack surface, so scope and price rest on facts. The Domain Security Test is that first look. Prices depend on scope and are offered in writing.
Evidence from audited software
The public ledger lists 387+ audited apps and 262+ critical findings. These full reports show how we document what we find:
- SAP: A Chinese push SDK in a field-service app, and Firebase keys hardcoded across five apps.
- Nike: Development and production push credentials hardcoded in the shipped build.
- Strava: A hardcoded key and a security configuration that protects nothing.
- Revolut: The largest third-party SDK in the series and what it sends to a US company.
Every other investigation is in the full evidence ledger.
Start with the Domain Security Test
The Domain Security Test examines one domain from the outside: read-only, from a European IP address, with no login and no payloads. A researcher reviews your request and replies within one business day.
To request a Managed SOC, use the Managed SOC card on the Access page.
Plans and prices are on Access, the agents behind every review on The Squad and the frameworks we measure against on Standards.
Put your domain to the test. Submit it for an initial external security assessment of your publicly accessible attack surface.
No login, no payloads and no changes to your systems.
A researcher reviews your request before testing begins and responds within one business day. You'll receive a short written report covering our findings, likely attack scenarios, potential financial impact and recommended next steps, alongside an exportable security intelligence graph connecting the findings.
Questions about the Managed SOC
What does the Managed SOC cost?
The price depends on scope and is offered in writing.
Who fixes the findings?
We do. The fix comes within 24 hours and reaches down to the code.
Does the Managed SOC replace our own security team?
It can serve as your security department, or work next to a team you already have.
Is the Managed SOC the same as SOC 2?
The two are different things. The Managed SOC is a service we run for you. SOC 2 is an audit standard.
Related pages
More on the pages App Security Audit, GDPR App Audit, NIS2 for Software Vendors, Tracker & SDK Check, AI App Privacy Audit, Compliance Automation, Domain Security Test, Penetration Testing, API Security Testing, Cloud Security Assessment and Secure Code Review.
