Blogs

Choosing between a co-managed Security Operations Centre (SOC) and an outsourced Managed Detection and Response (MDR) service comes down to three things: the capabilities your organisation already has, the gaps you need to fill and the level of operational control you want to retain.

For some organisations, the best approach is to keep an internal security team and extend its coverage overnight and at weekends. For others, outsourcing more of the detection and response function provides access to specialist expertise without the cost of building that capability internally.

Neither model is automatically better. The right choice depends on your existing resources, security requirements and budget. It is about finding the most sustainable path to operational calm.

What is the difference between a co-managed SOC and outsourced MDR?

A co-managed SOC, sometimes called a hybrid SOC, combines an organisation’s internal security capability with support from an external provider. The internal team remains actively involved in security operations, while the provider takes responsibility for agreed activities that the organisation cannot or does not want to manage itself.

For example, an internal team might manage security during working hours, with an external provider extending monitoring and response overnight, at weekends and on bank holidays. Responsibilities can also be divided by technology, investigation or incident response. When an external provider supplements an internal team in this way, particularly to cover out of hours, it is often called SOC augmentation.

Outsourced MDR places more of the agreed detection and response activities with an external provider. This typically combines security technology, specialist analysts and established processes to identify, investigate and respond to potential threats.

Outsourcing does not remove the organisation's responsibility for its wider security risk. Internal stakeholders still need to provide environmental context, agree response permissions and make business decisions when incidents require them.

The key distinction is how security responsibilities are divided, and how much operational capability your organisation needs to provide itself.

Co-managed SOC vs outsourced MDR at a glance

Comparing the cost of a co-managed SOC and outsourced MDR

The monthly contract price is only part of the picture. A fair comparison considers the total cost of delivering the security capability your organisation needs.

The cost of a co-managed SOC

A co-managed SOC can make financial sense when you already have security analysts, suitable technology and the ability to manage some security operations internally.

However, your existing team still represents a cost, even if its salaries are already included in the IT budget. You should also account for time spent coordinating investigations, managing the provider relationship and maintaining internal processes.

Additional recruitment, training or specialist tools may be needed if your team lacks the capacity to fulfil its responsibilities. A model that relies on a handful of people being constantly available can also create pressure and leave gaps during holidays or staff absences.

Co-managed security works best when it builds on genuine internal capability rather than adding more responsibility to an already stretched team.

The cost of outsourced MDR

Outsourced MDR can reduce the need to recruit, train and manage a dedicated team for continuous security monitoring and response.

Building a 24/7 operation internally involves more than employing analysts. Covering a single analyst seat around the clock realistically takes a minimum of six full-time staff once holidays, sickness and training are accounted for. Management, specialist expertise and technology then add to the cost. An MDR provider can deliver agreed capabilities without requiring your organisation to build the entire operation itself.

There will still be internal responsibilities, including onboarding, providing context about your environment and handling escalations that require business input. Existing technology and licensing costs may also remain, depending on the service.

The important question is whether the provider’s fees, combined with the internal resources still required, offer better value than the cost of building and maintaining an in-house SOC.

Compare total cost, not just the contract price

When comparing the options, consider:

• Internal salaries, recruitment, training and absence cover
• Security technology, licensing and maintenance
• Time spent investigating alerts, coordinating incidents and managing suppliers
• The operational risks associated with gaps in coverage or delayed responses

That last point is easy to underestimate. According to the UK government’s Cyber Security Breaches Survey 2025/2026, 65% of medium businesses and 69% of large businesses reported experiencing a cyber breach or attack in the last 12 months.

Co-managed security tends to suit organisations with an established team. Outsourced MDR often offers better value where significant extra staffing would otherwise be needed.

How each model affects staffing and expertise

With a co-managed SOC, your organisation retains an active operational role. This can be valuable when internal staff understand the business, its systems and its priorities, and they can continue developing their expertise while external support fills specific gaps.

However, this only works if your team has the time to play its part. If it is already stretched, a co-managed model risks adding to the noise rather than quietening it.

Outsourced MDR provides access to specialist analysts and established detection and response processes without requiring your organisation to recruit for every role. This can be particularly useful for smaller IT teams or organisations that struggle to recruit specialist security staff.

However, external support does not eliminate the need for internal ownership. Someone must still understand which systems are critical, authorise significant business decisions and coordinate the wider response to an incident.

The objective is to ensure that the combined capability is sufficient to identify threats, investigate them and respond appropriately.

How much control do you need to retain?

A co-managed model generally gives an internal team greater direct involvement in security operations. Your staff may continue investigating incidents, managing selected technologies or refining detection processes.

Outsourced MDR delegates more of the agreed detection and response work to the provider, potentially freeing internal staff to focus on security strategy, risk management and other priorities.

Neither model removes the need for clear responsibilities.

Before choosing a service, establish:

• Who investigates alerts
• Who can isolate a device or disable an account
• When your team must be contacted
• Which actions require approval

These arrangements should be agreed in advance. A co-managed service with unclear ownership can create delays just as easily as an outsourced service with poorly defined escalation procedures.

Which model is right for your organisation?

The best fit depends on the maturity of your security function, the resources available and the responsibilities you want to retain.

A co-managed SOC may suit you if…

• You have an established security team with knowledge of your environment.
• Your team can manage some security operations but cannot sustain overnight and weekend coverage.
• You want to retain direct involvement in investigations and operational decisions.
• You have the capacity to coordinate with an external provider.

A co-managed model can extend your existing capability without replacing it. A SOC Light arrangement may be worth exploring if you want external support alongside an internal function rather than outsourcing the entire operation.

When comparing services like this, check exactly what is included, particularly monitoring, investigation, response and escalation responsibilities.

Outsourced MDR may suit you if…

• Your internal IT or security team is too small to sustain dedicated security operations.
• You need continuous detection and response without recruiting and managing every role internally.
• You lack specialist skills or the capacity to maintain detection and investigation processes.
• You want internal staff to concentrate on wider security priorities.

Outsourced MDR gives you continuous detection and response without having to build a complete SOC. The important consideration is whether the service's coverage, response arrangements and reporting meet your requirements.

What if your organisation sits somewhere between the two?

Many organisations do not fit neatly into either category. You might have experienced security staff but limited out-of-hours capacity, or a capable IT team that needs specialist detection and response support.

Start by identifying which activities your team can deliver reliably, where its capacity is stretched and which capabilities are missing. Then compare the practical and financial implications of filling those gaps internally against using an external provider.

For a broader explanation of continuous security operations and the available approaches, read our guide to 24/7 security operations centres and continuous security monitoring.

Choosing a model that works in practice

Co-managed SOC and outsourced MDR services can both strengthen an organisation's security operations. The difference lies in how responsibilities are divided and whether that arrangement is realistic for your team.

Before deciding, look beyond the headline price. Consider the people, technology and processes required to deliver reliable coverage, and be clear about the responsibilities your organisation will retain.

The aim is not to choose the most comprehensive model on paper. It is to choose one your organisation can sustain, so threats are investigated and dealt with at any hour, and your team can work from a position of operational calm rather than constant firefighting.

If you are weighing up the options, Socura can help you identify where your team’s coverage gaps are and which model would close them.

Achieving robust cyber resilience shouldn't come with operational chaos. For financial and security leaders, balancing a budget is about establishing long-term predictability. While building a 24/7/365 Security Operations Centre (SOC) offers direct architectural control, achieving true operational maturity requires a complex balance of multi-shift headcount logic, continuous recruitment governance, and evolving tooling investments.

A realistic evaluation of these internal expenses must look beyond initial software licenses to incorporate the fully loaded costs of 24/7 staffing rotations, engineering tier escalations, advanced telemetry ingestion, and the constant recruitment overheads driven by the cybersecurity talent shortage.

Because these massive structural overheads can overwhelm internal teams, global research from Microsoft on SOC operational costs highlights that running a multi-console, un-unified internal operation creates massive resource strain. By contrast, leveraging a shared infrastructure model typically delivers equivalent or superior 24/7 coverage at a 60% to 80% total cost of ownership (TCO) reduction compared to a custom internal build.

Use our interactive in-house SOC cost calculator below to clearly benchmark the baseline annual investment required to build, staff, and run a security function internally.

Cyber security cost calculator

What could it cost to build your own SOC?

Estimate the annual cost of staffing, equipping and maintaining an in-house security operations capability, and explore where coverage gaps may remain.

Tell us about your security operation

Choose the options that best reflect your organisation and the SOC capability you need. The results are illustrative planning estimates, not a quotation.

Intended internal analyst headcount 1 analyst 2 analysts 3 analysts 4 analysts 5 analysts 6 analysts 8 analysts 10 analysts 12 analysts 16 analysts Used to assess staffing capacity against the selected coverage model.

Required monitoring coverage 24/7/365 coverage 8x5 business-hours coverage Continuous coverage requires shift rotation and resilience for leave, sickness and weekends.

Security technology stack Standard - SIEM and EDR Advanced - SIEM, EDR/XDR, NDR and threat intelligence Enterprise - advanced stack with SOAR and expanded telemetry Complex - extensive integrations and automation Reflects the breadth and complexity of the security tools your team must operate.

Organisation size Under 250 users 250-1,000 users 1,001-5,000 users 5,001+ users User numbers provide a broad indication of the size of the environment being protected.

Daily security data volume (GB) Estimate the volume of security data ingested across monitored sources each day.

Additional specialist capabilities Analysts only Analysts and SOC engineering Analysts and threat hunting Analysts, engineering and threat hunting Accounts for specialist expertise beyond day-to-day alert monitoring and investigation.

Compliance and assurance requirements Standard corporate governance Enhanced assurance and audit Highly regulated environment Models additional costs associated with governance, assurance and audit activity.

Your in-house SOC cost estimate

Adjust the inputs to explore how your estimated annual operating costs change.

Live estimate

Your estimated in-house TCO

Estimated annual total cost of ownership, including staffing, security software, training, overhead and recruitment churn.

£0 Estimated annual cost

Staffing share of total cost 0%

The proportion of estimated TCO allocated to staffing and benefits.

Non-staffing share of total cost 0%

The proportion allocated to tools, training, overhead and recruitment churn.

Operational coverage risk

A simplified estimate of the weekly monitoring hours your planned analyst capacity may not cover.

0 uncovered hours per week

Lower exposure Higher exposure

Adjust your inputs to estimate your coverage position.

View detailed annual cost breakdown +

Exploring alternatives to running your own SOC?

Talk to Socura

About these estimates. This calculator provides illustrative planning estimates, not a quotation or a representation of Socura pricing. It uses a £65,000 annual analyst salary baseline, a 1.3 multiplier for fully loaded staffing costs, a 20% annual turnover assumption, £10,000 per replacement hire, £3,000 per analyst for annual training and certification, and a £40,000 baseline for tooling in a small environment. Adjustments for data volume, technology complexity and compliance are model assumptions and should be validated against your organisation's actual costs. Coverage calculations are simplified and do not account for shift design, handovers, skill overlap, incident demand or other operational factors.

Bringing clarity and control to your security strategy

As your calculation demonstrates, the investment required to build, maintain, and mature a round-the-clock internal security operation involves significant long-term commitments. A sustainable security strategy isn't just about managing baseline figures - it is about finding the most efficient, frictionless path to operational peace of mind.

When evaluating your results, consider how a managed partnership with Socura simplifies your security architecture:

• Eliminated Staffing Complexity: Avoid the administrative burden of managing a 5.5 Minimum Full-Time Equivalent (FTE) shift rotation. A shared-infrastructure model completely absorbs the operational pressure of 24/7 cover, specialised training, and analyst retention.
• Predictable Fiscal Planning: Shield your budget from unexpected scaling fees, tool licensing spikes, or volatile data ingestion costs with a transparent, fixed annual subscription model.
• Immediate Operational Maturity: Eliminate the multi-month friction of recruiting, onboarding, and tool tuning. Your business gains immediate access to an established, highly calibrated security posture from day one.

Experience the power of calm with Socura

Security is at its best when it is seamless, professional, and entirely under control. At Socura, we focus on bringing the power of calm to your organisation. We believe that true cyber resilience comes from clear visibility, steady governance, and absolute predictability.

As a trusted UK-based Managed Detection and Response (MDR) provider, we eliminate the steep financial barriers and operational overhead of an internal build. We act as a reliable, reassuring extension of your existing team - delivering 24/7 UK-operated expert monitoring and precise threat management for a predictable fraction of the cost.

Ready to see a precise, tailored breakdown for your business?

Now that you have benchmarked the baseline costs of an internal build, let’s explore how a managed partnership can streamline your budget.

To see how a co-managed SOC compares with outsourced MDR on cost and capability, read our guide to co-managed SOC vs outsourced MDR.

Get in touch with our team today to discuss your 24/7 monitoring requirements, compliance needs, and specific environment scope.

Cyber threats do not follow office hours.

For organisations that need continuous protection, genuine 24/7 security coverage means more than keeping a security dashboard open overnight. It requires the right combination of people, processes, technology and response capability, whether that is delivered in-house, through a co-managed model or by an external managed detection and response (MDR) provider.

For many organisations, the question is not simply whether security monitoring matters. It is how much coverage is appropriate, what that coverage needs to achieve and how it can be delivered sustainably.

A 24/7 SOC is not automatically the right answer for every organisation, and outsourcing is not necessarily the right answer either. The appropriate model depends on your threat profile, the systems and data you need to protect, your existing security capability, your available resources and the level of risk your organisation is prepared to accept.

This guide looks at what genuine 24/7 security operations involve, the different ways organisations can provide them, and the practical questions IT and security leaders should consider before deciding how to proceed.

Short on time?

Download our complete 24/7 SOC Guide to read later.

Download the guide

Why 24/7 security coverage matters

Your organisation may operate from 9 to 5. Your security risk does not.

Cloud services continue running overnight. Employees continue accessing systems remotely. Automated processes continue exchanging data. Internet-facing systems remain exposed. Security controls continue generating telemetry whether anyone is looking at it or not.

A security incident that begins at 2am does not become less serious because the security team is due back at 9am.

That does not mean every organisation needs a staffed SOC operating around the clock. The NCSC's guidance on building a SOC takes a risk-based approach, recognising that organisations have different threat profiles, assets and resources.

The important question is whether your operating model provides an appropriate level of monitoring and response for the risks you face.

Out-of-hours activity can present a particular challenge. Cyber security authorities have documented ransomware activity taking place during weekends and public holidays, when organisations may have fewer defenders and IT personnel available. NCSC guidance also notes that attackers may carry out actions outside normal office hours to reduce the likelihood of intervention.

For organisations with critical systems, valuable data or limited internal security resources, continuous monitoring can therefore form an important part of the wider security strategy.

What does 24/7 SOC coverage actually mean?

The phrase "24/7 monitoring" can sound more comprehensive than it really is.

Having security tools running continuously is not the same as having continuous security operations. When an alert is generated, someone needs to be able to assess it, investigate it, determine whether it represents a genuine threat and take appropriate action.

A useful way to think about the process is:

Detect → Triage → Investigate → Respond → Learn

Detection identifies potentially suspicious activity.

Triage determines whether an alert warrants further investigation.

Investigation adds context and establishes whether the activity represents a genuine threat.

Response contains or disrupts the threat where appropriate.

The final stage is understanding what happened and using that knowledge to improve the organisation's defences.

This is why technology alone does not create a 24/7 security operation. The tools need to be supported by people and processes capable of turning security data into meaningful action.

The three ways to provide 24/7 security operations

There are three broad approaches organisations can take.

Build and operate an in-house SOC

Building a SOC internally gives an organisation a high degree of control over its people, processes, technology and priorities.

An established security team can develop detailed knowledge of the environment and tailor detection capability around the organisation's systems and risks. For larger organisations with sufficient resources, an internal SOC can provide a high level of control and organisational knowledge.

The challenge is sustaining genuine 24/7 coverage.

A team that provides security monitoring during normal working hours is very different from one operating continuously. Staff need to work across shifts or participate in an out-of-hours rota, while recruitment, training, management and absence cover all need to be considered.

There is also the technology and engineering capability required to support the operation, including security monitoring, endpoint protection, detection engineering, threat intelligence and incident response.

A SOC is not something that can simply be built and left unchanged. Threats, technologies and business requirements evolve, so detections, processes and skills need to evolve with them.

Use a co-managed or hybrid SOC

A co-managed model combines internal security capability with external support

An organisation might retain responsibility for its own security team and key decisions while an external provider extends monitoring outside normal working hours, supports alert triage or provides specialist expertise.

This can be useful where an internal team already has strong knowledge of the organisation but does not have the resources to maintain complete 24/7 coverage.

The responsibilities need to be clear from the outset. That includes who investigates alerts, who can take containment action, who needs to be contacted when an incident is confirmed and what happens when the internal team is unavailable.

Use a managed detection and response service

A third option is to use an MDR provider to deliver detection and response externally.

MDR combines security technology with specialist analysts and established monitoring, investigation and response processes. It can give organisations access to continuous security operations without requiring them to recruit and maintain every role internally.

This can be particularly relevant to organisations with smaller IT or security teams that still need continuous detection and response.

MDR does not mean handing security over and walking away. A provider needs to understand the organisation, its systems, priorities and risk. Responsibilities, escalation procedures and response actions should be agreed in advance and reviewed as the environment changes.

What does a 24/7 SOC actually need?

Whatever operating model is chosen, several components need to work together.

Does compliance require 24/7 security monitoring?

There is no blanket UK rule stating that every organisation must operate a 24/7 SOC.

Cyber Essentials provides a baseline set of technical controls, but it does not require organisations to operate a round-the-clock SOC.

ISO/IEC 27001 establishes requirements for an information security management system, including monitoring and evaluation of information security performance. It does not prescribe a specific SOC operating model or universally require 24/7 monitoring.

The UK's NIS Regulations apply to organisations within their scope and require appropriate and proportionate measures to manage security risks and minimise the impact of incidents. They do not amount to a blanket requirement for every organisation to operate a 24/7 SOC.

NIS2 should also be treated carefully in a UK context. It is an EU directive rather than UK domestic law, so organisations need to understand which UK legislation and sector-specific requirements actually apply to them.

There may also be contractual, insurance, customer or sector-specific requirements that make continuous monitoring appropriate or expected.

Compliance can therefore form part of the decision, but it should be considered alongside the organisation's actual risk and security requirements.

How do you know whether your organisation needs 24/7 coverage?

Determining your round-the-clock readiness isn't a matter of ticking an administrative compliance box. It requires a cold, practical look at how your business functions when your core IT staff are offline, out of office, or asleep.

Before committing capital to an internal build or an outsourced partnership, use our interactive self-audit matrix below to evaluate your current defense tracks and isolate your actual visibility windows.

Choosing the right 24/7 security model

There is no single operating model that suits every organisation.

An established internal SOC can provide deep organisational knowledge and control. A co-managed approach can extend an existing team without replacing it. An MDR service can provide access to specialist expertise and continuous monitoring without requiring an organisation to build every component of a SOC itself.

The decision should come back to the same fundamentals:

• What risks are you trying to manage?
• What capability do you already have?
• Where are the gaps?
• What would it take to close those gaps internally?
• Which responsibilities do you want to retain?
• What level of continuous coverage does your organisation actually require?

The right model is one that provides the necessary capability and can be sustained as the organisation, its technology and its risks change.

How Socura approaches 24/7 MDR

Socura provides Managed Detection and Response for organisations that need continuous detection and response capabilities without necessarily building the entire operation internally.

Our MDR service combines UK-based security analysts with security technology, threat intelligence, ongoing detection engineering and proactive threat hunting.

The service continuously monitors the customer's digital estate, investigates alerts and responds to genuine threats. Where appropriate, automated actions can help contain and disrupt attacks, while incidents requiring customer attention are communicated through our Incident Management Portal.

We work as an extension of the customer's existing team rather than treating MDR as a black box. That starts with understanding the environment during onboarding and continues through configuration, tuning, service reviews and ongoing improvement.

The result should not simply be more alerts.

It should be greater visibility, faster response, and a clearer understanding of your security environment - keeping your organisation calm, secure, and completely focused on the work that matters most, around the clock.

24/7 security should bring clarity, not complexity

The decision to provide round-the-clock security coverage can initially feel complicated. There are people to consider, technologies to evaluate, processes to define and costs to understand.

But the underlying question is simple.

When something important happens outside normal working hours, what happens next?

If you have a clear, tested and sustainable answer, you have the foundations of an effective security operation.

For some organisations, that will mean strengthening an internal SOC. For others, a co-managed model may extend existing capability. An MDR service can provide another route to continuous detection and response without requiring the organisation to build every element internally.

The objective is not to build a SOC simply because 24/7 sounds impressive.

It is to make sure your organisation has the right capability in place when it matters.

That is what genuine 24/7 SOC readiness looks like.

Cyber security is a critical function essential to keeping the UK and businesses secure. However, the high-stakes nature of the profession can place a heavy strain on the individuals responsible for ensuring our ongoing defence against threats.   

To understand the extent of these pressures and their impact on individuals' wellbeing and performance, Socura surveyed more than 500 security leaders. Sleepless in security lays bare the findings, highlighting the physical and mental health issues executives experience and the critical challenges keeping them awake at night.

8 in 10 security leaders say job has harmed their health

Undoubtedly, the most alarming revelation of the survey is that nearly 80% of security leaders report that working in cyber security has taken a toll on their physical or mental health. Nearly half of all respondents (48%) have experienced both physical and mental issues stemming from their roles.

Among the most prevalent symptoms of this stress are burnout or exhaustion (28%), chronic lack of sleep or insomnia (24%), and social withdrawal (23%). 13% said that their work has directly contributed to depression.

Overstretched, exhausted and in fear of their job

The survey highlights the extent to which security leaders struggle to switch off and go above and beyond in their roles. The average leader works an extra 38 days of overtime a year, with 81% feeling a very large or large obligation to monitor communications or alerts outside of their contracted hours. With work constantly on their minds, half of leaders say they experience a nightmare or stressful dream about work at least once a month (51%).

A key contributing factor to this ‘always-on’ mentality is almost certainly the immense responsibility executives shoulder. 86% are worried that they could be fired in the event of a serious cyber incident.

The effect of stress on performance and risk

Sleepless in security also shines a light on the effect stress has on the ability of security leaders to perform to their best, raising questions about the knock-on effects for an organisation’s operational risk. Over 40% of security leaders admit that when they feel overworked, stressed, or burnt out, it significantly impairs their performance.

The findings also cast serious doubt on the long-term sustainability of the profession: A quarter of security leaders have already left a previous position due to workplace stress (26%), and a similar number are currently seriously contemplating resigning (27%).

Leading causes of stress

Also explored by the survey is the underlying causes of stress, with keeping pace with new threats and navigating technical complexity cited as two of the greatest challenges of being a cyber security professional.

When asked to identify their top strategic challenges, ‘keeping pace with the evolving threat landscape’ (25%) and ‘governing the use of AI and emerging technologies’ came out on top (25%).

The most common operational challenges cited by security leaders were ‘analysing and applying threat intelligence’, and ‘monitoring security posture 24/7’.

Read the report for full insights

Sleepless in security highlights a leadership community driven by a profound sense of duty. Yet, this very dedication is actively eroding practitioners' physical and mental wellbeing, making long-term retention increasingly unsustainable. Ultimately, these findings underscore an urgent need for change in the expectations surrounding the role of a security leader - no single individual should be expected to carry the burden of maintaining a 24/7 defence alone.

Read the full report for a detailed look at the survey results and for industry analysis from Andrew Kays (CEO, Socura), Nasser Arif (Cyber Security Manager, NHS), and Rebecca McKeown (Principal Psychologist at Mind Science).

Also explored

• High stakes vs. high anxiety: Leaders’ views on how they view the role
• Help or threat: Is AI easing the load or a long-term risk to job security?
• Job satisfaction: The single biggest factor leaders say would improve their work life.
• Inspiring the next generation: Do stressed-out leaders still recommend the industry?

‍

Read the report

Earlier this year, Socura was named as one of the UK’s Best Workplaces by Great Place to Work, a global authority on workplace culture. Following this recognition, we’re now delighted to have also been included in two additional lists celebrating excellence in areas of employee experience: the UK’s Best Workplaces for Wellbeing and the Best Workplaces for Development.

The UK's Best Workplaces for Wellbeing 2026 list features companies that focus on employees’ holistic experiences of wellbeing at work, including their work-life balance, sense of fulfilment, social support, job satisfaction, and financial security.

The UK's Best Workplaces for Development 2026 list features companies that make employee development a key part of company culture. This includes workplaces that offer employees the chance to better themselves, learn new skills, and advance their careers.

Socura's inclusion in both of these lists follows our certification by Great Place to Work, which was achieved after an independent survey of our workforce. In it, 97% of our team said that Socura is a great place to work—43 percentage points higher than a typical UK company.

Highlights of the GPTW survey include:

• 100% of our team agree that people at Socura care about each other
• 97% believe everyone has an opportunity to gain special recognition
• 100% say they are treated fairly regardless of their sexual orientation, race, gender, or age

‍

Commenting on Socura’s position on the Best Workplaces for Wellbeing 2026 list, Benedict Gautrey, Managing Director of Great Place to Work UK, said:

"Creating a culture of wellbeing requires deliberate leadership, strong values and consistent action that puts people first. The UK’s Best Workplaces for Wellbeing List recognises organisations that take a genuinely holistic approach to supporting their people, across mental, physical and financial health, as well as fostering a strong sense of belonging.

To be recognised on this list is a clear signal that wellbeing is not treated as a peripheral initiative, but as a fundamental part of organisational culture. Congratulations to Socura on this achievement and for setting a leading example for workplaces across the UK."

Interested in joining our team?

Visit our careers section to learn more about Socura and our mission to deliver the power of calm in cyber security. Discover the values that make Socura officially a Great Place to Work, read about the experiences of members of our team, and explore open job roles.

Artificial intelligence is transforming cyber security operations, empowering defenders to scale their capabilities and match the speed of modern threats. However, as AI adoption grows, so does the need for trust, transparency, accountability, and professional oversight.

Recognising the vital importance of safe and responsible AI use across our own operations and the wider cyber security profession, Socura is proud to be a founding signatory of the CREST AI Charter - one of 60 CREST members globally.

By signing this voluntary charter, Socura agrees to uphold the highest standards in AI adoption, in line with the core CREST AI Principles. These principles cover nine core areas, including accountability and governance, transparency of use, data sovereignty, and security and confidentiality.

‍

What our commitment means for customers

As we advance the use of AI across our MDR service, aligning with the CREST AI Charter ensures Socura will continue to operate at the absolute forefront of responsible AI adoption.

This includes a commitment to:

• Maintaining strict AI governance in line with UK government’s codes of practice
• Upholding UK data sovereignty principles
• Guaranteeing that no data is used to train public AI models
• Enforcing strict data isolation and security to ensure privacy

About CREST

With over 500 members worldwide, CREST is an international not-for-profit membership body representing the global cyber security industry. Socura has been a CREST member since 2021 and holds accreditation for our security operations centre - validating that our MDR service delivery meets rigorous standards in operational effectiveness, staff competence, threat intelligence integration, and incident response.

Verify our CREST status

Our CREST AI Charter commitment is listed on our CREST Marketplace profile, alongside our CREST SOC accreditation and other certifications. You can view it on the CREST Marketplace at any time.

To see all of our accreditations, certifications and pledges in one place, visit the Socura compliance hub.

Digital transformation is fundamentally redefining how the UK public sector operates and delivers essential services. On June 9 & 10, Socura is looking forward to joining leaders from across UK councils at the Socitm President’s Conference 2026 to learn about the latest projects and the real-world impact they are having. This year’s conference is particularly special as Socitm celebrates its 40th anniversary.

Since cyber security and digital transformation go hand-in-hand, the Socura team will be exhibiting at the event, sharing the work we are doing to strengthen the resilience of services across the sector.

The CymruSOC journey

On Day One at 14:15, Nigel Howarth (our Head of Partnerships and Alliances) will be in conversation with Ryan James (CISO at Merthyr Tydfil County Borough Council). Together, they will discuss key learnings from CymruSOC, the UK’s first national security operations centre.

For councils interested in improving their collective defence against threats, this session provides a great opportunity to learn about:

• The benefits of a 'defend-as-one' approach
• Strategies to overcome resource challenges
• Building a business case for an outsourced SOC

See the full agenda here.

Meet the Socura team

Nigel and other members of the Socura team will be available at Stand 9. We are also looking forward to attending the President’s Dinner - always a fantastic opportunity to celebrate the sector's successes.

If you’re planning to attend Socitm President’s Conference 2026, we’d love to meet you and learn about your security challenges.

Congratulations to Andrew Kays (CEO) and Jamie Brummell (CTO and Founder) of Socura for being named as joint finalists in the EY Entrepreneur Of The Year 2026 UK programme.

The EY Entrepreneur Of The Year 2026 programme recognises individuals who are playing a leading role in shaping the UK economy by exhibiting entrepreneurial ambition and innovation. This year’s list features 110 individuals across five regions: London, South, Midlands, North, and Scotland.

Andrew and Jamie’s recognition in the South follows an exceptional period of growth for Socura since its inception in 2019, and highlights their leadership in challenging the status quo to address modern cyber security threats. Notably, Socura was one of the earliest Managed Detection and Response (MDR) providers to be fully cloud-native, operating via a remote security operations centre to attract the best talent from across the UK.

‍

One of the top MDR providers globally

The duo’s approach has also seen Socura become recognised as one of the top 100 managed service providers globally, secure the contract to deliver Wales’ National Security Operations Centre, and partner with industry leaders, including Google Cloud and Palo Alto Networks, to augment human expertise in security operations with AI and automation.

“This year’s regional finalists demonstrate bold leadership, long-term vision, and a clear commitment to building businesses that create value — not only for their customers, but for communities and the wider UK economy. They are truly exceptional leaders and exemplify the strength of the UK’s entrepreneurial talent.” Ally Scott, Entrepreneur Of The Year UK, Co-Partner Lead, EY

All EY Entrepreneur Of The Year 2026 regional finalists will be assessed by a panel of independent judges, with 10 entrepreneurs selected to progress to the UK final. The overall winner will be announced at a Celebration Dinner in November, before going on to represent the UK at EY World Entrepreneur Of The Year in 2027.

See the full list of regional finalists.

At Socura, providing exceptional customer service is central to keeping our customers secure. We’re proud that our commitment has been recognised with a shortlisting at the SC Awards Europe 2026.

Why were we shortlisted

For over 25 years, the SC Awards Europe have honoured the leaders in cyber security across Europe. This year, as part of a competitive entry process, an independent panel of industry experts hand-selected finalists across more than 25 categories.

Being shortlisted for Best Customer Service is a testament to the tireless efforts of the Socura team in supporting our customers, and reflects the feedback we regularly receive regarding the quality of care they deliver. Following our most recent satisfaction survey, Socura Managed Detection and Response (MDR) achieved a Net Promoter Score of 83—distinguishing the service as ‘world-class’.

What sets Socura apart

Socura MDR operates as a seamless extension of our clients' security teams to identify and shut down threats 24/7. In addition to technical expertise, customers value our high-touch approach and the enduring quality of support they receive from onboarding and beyond.

Explore our latest case studies to learn more about why businesses such as interactive investor, NHS trusts, and other public sector bodies trust Socura as their security partner.

The awards ceremony

Winners of the SC Awards Europe 2026 will be announced at a ceremony in London on 3 June 2026. It’s set to be a great night, celebrating the best technologies, companies, and individuals shaping the future of cyber security in Europe. We can’t wait to be part of it!

This April, the National Cyber Security Show returns to the Birmingham NEC for three days of insights, workshops, and networking. Join the Socura team and thousands of cyber security professionals from across the UK to discover the latest trends and solutions helping strengthen the resilience of organisations globally.

Don't miss our live session

Taking place from 28-30 April 2026, NCSS 2026 is a premier opportunity to improve your understanding of the latest cyber security threats and the strategies to minimise them.

On the first day of the show, Andy Kays (CEO) of Socura will take to the Cyber Solutions Theatre, alongside Einat Segal (Head of Cyber Security) of iProov to present:

Closing the Defender-to-Business Deficit: Scaling Security Operations with MDR

With Socura’s 'A wave in cyber' report highlighting a critical talent deficit - with just one cybersecurity professional for every 68 UK businesses - join us to discover why Managed Detection and Response has become the go-to solution for scaling security operations without the need for an in-house SOC.

Discover the power of calm

If you’re attending NCSS 2026, why not also schedule time to meet the Socura team at Stand 5/N22 and find out how we're helping organisations realise the power of calm?

Book an appointment and learn how Socura MDR:

• Proactively identifies and responds to attacks before they can cause disruption
• Minimises the stress and heavy lifting of monitoring critical systems
• Provides ongoing support to keep pace with the latest threats.

‍

We look forward to seeing you at the show!

This year, CYBERUK, the UK government’s flagship cyber security event, arrives in Glasgow. Join Socura at this year’s conference (21-23 April), which marks the tenth year of the NCSC and explores the theme: The Next Decade: Accelerating Our Cyber Defence.

At Stand F3, we’ll be discussing the latest advancements in security operations and showcasing our partnership with the Welsh Government - demonstrating how a ‘defend-as-one’ approach is enhancing the collective resilience of the public sector across Wales.

About CYBERUK 2026

CYBERUK 2026 will bring together over 2,500 cyber security leaders and professionals for three days of talks and conversations about the latest trends in the industry. Speakers at this year’s event include:

• Bryony C, Deputy Head of Government Cyber Resilience, National Cyber Security Centre
• Paul Foster, Head of the National Cyber Crime Unit, National Crime Agency
• Eloise Hindes, Deputy Chief Information Security Officer, Bank of England
• Clayton Romans, Associate Director, Cybersecurity and Infrastructure Security Agency

View the event programme

Watch our lightning talk

On Wednesday, 22 April at 14.50 pm (BST), Eilidh Scott will present:

A wave in cyber: The ascent of cyber as an essential occupation

In this lightning talk on the Spotlight Stage, Eilidh will share findings from Socura’s recent analysis of employment trends - including the news that cyber is now the fifth fastest-growing occupation in the UK.

Book an appointment with Socura

If you’re attending the conference, set up a time to meet with our team. Learn how Socura Managed Detection and Response can support your organisation’s security goals by seamlessly extending your ability to proactively detect and respond to threats.

We look forward to meeting you and helping shape the discussion about the future of cyber in the UK.

Book an appointment

Following rapid growth in Managed Detection and Response (MDR), we’re delighted to announce that Socura is featured in the 2026 Megabuyte Emerging Stars list.

The Emerging Stars list identifies the UK’s 50 best-performing scale-up technology companies, as determined by the Megabuyte Scorecard—a proprietary methodology that evaluates organisations based on rigorous financial performance. Of the 9,000+ companies tracked by Megabuyte’s research analysts, only a small fraction meet the Scorecard criteria, and even fewer outperform the top quartile across key metrics.

Recognition by Megabuyte follows a period of exceptional performance for Socura, in which our MDR client base more than doubled, our Net Promoter Score (a key indicator of customer satisfaction) was rated as ‘World-class’ (83), and contracted customer retention was 100%.

Best Performing Company | Cyber Services

Building on this achievement, Socura has been shortlisted for the Best Performing Company - Cyber Services category in the 2026 Megabuyte Emerging Stars awards.

Across the top 50 best-performing scale-ups in the UK, these awards acknowledge outstanding achievements within specific peer groups. Evaluation criteria encompass critical factors including size and growth.

Winners of the 2026 Megabuyte Emerging Stars awards will be announced on 19 March 2026 at the Megabuyte100 awards event in London.

View the full 2026 Emerging Stars shortlist

Every day, thousands of people across the UK are tasked with the critical mission of protecting businesses and national infrastructure against cyber threats. To better understand the people behind our defence, we examined Office for National Statistics (ONS) data to uncover key insights into the size and makeup of this rapidly growing workforce.

‘A wave in cyber’, a follow up to a report we published in 2024, charts the industry's growth and examines the diversity and regional footprint of those working in it.

Read the report

Cyber is now the fifth fastest-growing occupation in the UK

Perhaps the most significant takeaway from our new report is that cyber security is no longer a niche field—it’s now the fifth fastest-growing career path in the country. In just four years, the industry has overtaken long-standing professions such as bricklaying, architecture, and farming in terms of headcount (all occupations that were a similar size to cyber in 2021).

There are now close to 84,000 people working in cyber security in the UK, a number that has nearly tripled since 2021 – the date cyber security roles first started being tracked by the ONS in its Annual Population Survey.

Read the report

The narrowing defender-to-business deficit

Due to a surge in headcount, the ratio of cyber security professionals to UK businesses has improved significantly—moving from one expert for every 196 companies in 2021 to one for every 68 in June 2025. While this indicates a positive trend in hiring, there remains a significant way to go before all businesses have specialist cyber security expertise in-house.

This continuing defender-to-business deficit also underscores why managed security service providers are so important in helping organisations access the support they need to strengthen their cyber defence.

The human front line in the age of AI

‍‍Artificial Intelligence is reshaping almost every sector, and cyber security is no exception.  While it is too early to assess the impact of AI in the latest ONS figures, many commentators - including Dr Yulia Cherdantseva, Reader, School of Computer Science & Informatics Education at Cardiff University - are optimistic. Leading security teams, including Socura, are using AI to augment rather than replace human roles; it is also expected that AI will create new specialisms within the sector.

The Cyber Security and Resilience Bill is also expected to drive demand for cyber security talent by mandating stricter standards for organisations —particularly those that provide essential services and form part of critical national supply chains.

Read the report

Key areas for improvement

In 2021, 23% of the cyber security workforce was female. Today, despite a 163% increase in the number of women entering the field, that proportion has slipped to 21%—a stark reminder that the industry must do more to increase female representation. Stark geographical divides in the location of workers also continue to present a challenge for businesses accessing talent. Currently, 29% of the UK’s cyber workforce is in London and the South-East.

 Dr Clare Johnson, Founder of Women in Cyber Unlimited, believes that initiatives such as the CyberFirst Girls Competition and the increasing number of cyber networks are essential for addressing this imbalance and providing a platform for new talent.

Read the report for full insights

‘A wave in cyber’ charts the emergence of cyber security as a mainstream profession within the UK, demonstrating the rising importance of cyber in protecting organisations against threats.

Read the full report for a deeper look into current employment shifts, alongside expert commentary from Socura CEO Andrew Kays and other industry experts on these evolving trends.

Every year, MSSP Alert releases its annual list of the top 250 MSSPs, MDRs, and MSPs globally. Following the publication of the list for 2025, we are proud that Socura has broken into the top 100 for the first time, climbing to #78.

This marks the fourth consecutive year we have been recognised by MSSP Alert as a top security service provider and represents a significant milestone in our growth, having risen 152 places since 2022.

Socura is just one of 15 UK-headquartered businesses to make the list, which is determined by strict criteria including business growth rate and third-party industry honours.

The recognition follows an exceptional year, during which our MDR client base more than doubled, our Net Promoter Score (a key indicator of customer satisfaction) was rated as ‘World-class’ (83), and contracted customer retention was 100%.

Further demonstrating the quality of service we deliver, 96% of incidents were resolved without requiring customer escalation —significantly reducing the workload for security teams.

"Breaking into the world’s top 100 managed security service providers just six years after we were founded is an achievement we’re incredibly proud of. It validates our approach to growth and delivering MDR without ever compromising the service quality that sets us apart.

Ultimately, though, this recognition belongs to our team and our customers. It is a testament to the trust they place in us, which is the most important measure of our success."

Andrew Kays, CEO, Socura

Find out more about the MSSP Alert Top 205 MSSP list: https://www.msspalert.com/top-250-2025

At Socura, our people are at the heart of everything we do. That is why we have always prioritised creating a culture that empowers everyone to be themselves, feel valued, and perform at their best.

Being certified by Great Place to Work® following an anonymous survey of our team is another positive step toward fostering the best environment for our employees. We’re proud that 97% said that Socura is a great place to work - 43 percentage points higher than a typical UK company.

Fostering strong values

As a service provider in cyber security, an industry known for high pressure and burnout, we have always viewed maintaining a healthy, supportive environment as fundamental to who we are. In areas such as trust, pride, and camaraderie—key attributes measured by the Great Place to Work survey—it’s fantastic to see that Socura scores highly.

Highlights of the survey include:

• 100% agree that people at Socura care about each other
• 100% believe they can be themselves
• 100% know how their work contributes to the company's success
• 97% believe everyone has an opportunity to gain special recognition
• 100% believe they are treated fairly regardless of their sexual orientation, race, gender, or age
• 97% are confident that customers would rate the service they deliver as ‘excellent’

Elevating employee experience

While Great Place to Work certification is a significant achievement, our commitment to improving the employee experience remains as strong as ever. Our goal is to attract and retain the best talent, ensuring we continue to deliver an MDR service to our customers built on technical expertise, care and genuine partnership.

Following a successful year in which the Socura team has increased in size by over 50%, we will be on the lookout for even more passionate individuals to join us in 2026.

Driving world-class service

In closing, I’d like to personally thank everyone on our team for sharing their open and honest feedback. I’m determined to ensure that the values you demonstrate daily and the pride you feel working here continue to set Socura apart, driving the excellence we deliver to our customers.

‍

View Socura’s certified company profile at Great Place to Work here: www.greatplacetowork.co.uk/certified-company/1575304

As a trusted cyber security partner to the National Health Service, Socura is committed to helping the Health and Social Care sector strengthen its resilience. Signing the NHS Cyber Security Charter is a public affirmation of our support for keeping vital public services - and the wider public - safe.

Securing the supply chain

The NHS Cyber Security Charter is a voluntary commitment for technology suppliers to Health and Social Care to follow good information security practices and foster a ‘defend as one’ culture across Health and Social Care.

High-profile cyber incidents affecting Health and Social Care have brought the importance of supply chain security into sharp focus, highlighting the need to do even more to protect critical systems and patient data against ransomware and other threats.

Launched following an open letter by Mike Fell (Director of Cyber Operations, NHS England), Vin Diwakar (National Director of Transformation, NHS England), and Phil Huggins (National CISO, DHSC), the Charter reinforces the need for collective defence. This approach is integral to the Cyber Security Strategy for Health and Social Care: 2023 to 2030.

Our commitment 

By signing the NHS Cyber Security Charter, Socura pledges to abide by robust security practices to protect the NHS and its supply chains. These practices include continuous patching of core systems, multi-factor authentication, 24/7 network logging and monitoring, and incident response planning.

Socura’s commitment to the Charter builds upon our compliance with the NHS Data Security and Protection Toolkit (DSPT), for which we hold a ‘Standards Exceeded’ rating.

"As a Managed Detection and Response partner to NHS trusts, we know how important it is to continuously strengthen the resilience of the health and social care sector against attacks. This is why we welcome the introduction of the Cyber Security Charter, are committed to upholding it, and stand ready to help the NHS and its suppliers strengthen their resilience, both individually and collectively.”

Andrew Kays, CEO, Socura

See all of our accreditations, certifications and pledges in the Socura compliance hub.

‍

Jisc Security Conference 2025 brings the education and research community together to strengthen resilience, drive sustainable progress, and shape a secure digital future.

Join Socura at this year’s event, taking place from 25th to 26th November in Manchester. We’ll be exhibiting at the conference, contributing to the discussion around this year’s four key themes: Secure strategy, Empowered people, Resilient operations, and Future focused

Click here to see the full agenda and speakers, and to register.

‍

Connect with our team at the conference

If you’re planning to attend Jisc Cyber Security Conference 2025, make sure you visit the exhibition area and chat to the Socura team about your security challenges.

Learn how Socura Managed Detection and Response brings calm to your security operations by detecting and responding to threats 24/7.

The choice of leading organisations in the education sector, our MDR service helps you:

• Minimise the time it takes to shut down threats
• Maximise the effectiveness of your tech stack
• Alleviate the strain of daily security operations

‍

We look forward to meeting you!

In Wales's flourishing fintech scene, cyber security plays a crucial role in enabling innovation and establishing trust. To deepen our understanding of the challenges organisations in this sector are facing and to collaborate on solutions, Socura is delighted to announce that we have joined FinTech Wales.

As the leading advocate for fintech in Wales, FinTech Wales's mission is to create a fully inclusive and supportive ecosystem that empowers fintechs to flourish on both a global and local stage. This diverse community includes over 100 companies representing Fintech, Cyber, Data and AI, Investment Services, Banking, Insurance, and more.

“The team we have at Socura has extensive experience helping UK financial firms detect and respond to threats. As a Cardiff-headquartered business, we’re eager to share this expertise with the fintech community in Wales and discuss how security and innovation can drive each other forward.” Andrew Kays, CEO, Socura

In Wales, Socura is the delivery partner of the country's National Security Operations Centre, and also delivers Managed Detection and Response to organisations across the rest of the UK.

The risks of cybercriminals ‘logging in’ rather than ‘hacking in’ are highlighted by a new report published by Socura. Produced in partnership with Flare, 'FTSE 100 for sale' is the result of an analysis of cybercrime communities across the clear and dark web. It uncovers over 460,000 instances of stolen credentials linked to employees of FTSE 100 companies.

The scale of the problem

The findings paint a stark picture of the threat facing UK businesses, driven by a rise in infostealer malware and the continued use of weak passwords.

Our research found:

• One FTSE 100 company had over 45,000 instances of stolen credentials available online
• 28,000 corporate credentials were leaked via infostealer logs
• 59% of FTSE 100 companies have at least one employee using 'password' as a password
• A potential death threat made against a FTSE 100 CEO

Download report

Evidence of credentials being actively sold on dark web forums is also disclosed in the report. Buyers, often technically skilled criminals, then use them to infiltrate systems and deploy ransomware. As Anne Heim, our Threat Intelligence Lead, notes:

"Most [cybercriminals]won't waste precious time hacking for credentials when they can easily find or buy them online.”

Get the full report for actionable insights

If the UK's biggest companies are exposed to the threat of credential theft, what does your organisation's exposure look like? Download 'FTSE 100 for sale' to see all the key findings and actionable recommendations to strengthen your organisation's security posture.

You'll also discover:

• Examples of C-suite leaders are being targeted
• Most common passwords used by FTSE 100 employees
• The risks of corporate email addresses being used for personal services

Download report

On 27th November, the Socura team will be at Cyber Security in Financial Services Summit 2025.

Bringing together senior cyber leaders from the financial services industry, the event explores the next frontiers in cyber governance and how measuring, disclosing and managing cyber risk adds business value.

Jamie Brummell of Socura and Darren Swift of Google Cloud Security are among a great lineup of speakers, which also includes Luke Vile of the Financial Conduct Authority.

The agenda will explore key challenges such as keeping pace with regulatory expectations, balancing AI's potential with its security, and safeguarding assets in a decentralised ecosystem.

Click here to see the full agenda and speakers, and to register.

Let's connect at the event

If you’re planning to attend Cyber Security in Financial Services Summit 2025, make sure you visit the exhibition area and chat to the Socura team about your security challenges.

Discover how Socura Managed Detection and Response brings the power of calm to your security by:

• Minimising the time it takes to detect and respond to threats
• Alleviating the load of daily security operations
• Enabling a proactive approach to security

‍

We look forward to meeting you!

We’ve always strongly believed in the importance of people and relationships in cyber security. It’s why we have focused on building a culture at Socura that fully reflects the best human values in delivering outcomes for our clients.

Our new brand is a celebration of the human-first culture we have built. It also marks the next phase in establishing Socura as the UK’s most trusted name in Managed Detection and Response.

The power of calm

Over the last six years, Socura has become an MDR provider to leading businesses and critical national infrastructure. Our new value proposition, ‘The Power of Calm,’ is a symbol of the assurance we bring to our clients. It represents the feeling that comes from having a partner that brings the clarity, control, and confidence needed to succeed in today's ever-changing landscape.

While the changes you’ll see today showcase a fresh new look, they also remain true to Socura’s heritage. You’ll recognise this in everything from our new logo to our use of imagery and colours, which inspire positivity in a world often depicted as dark and scary.

Fundamentally, we believe that cyber security isn’t about fear, but about having the confidence to face risks through vigilance, collaboration, and a proactive approach.

New look. Same world-class service

Despite a new look, our team's commitment to delivering a world-class service remains steadfast. The reasons organisations choose us for MDR, and why they recommend us, are the foundation of our business—and that foundation is stronger than ever.

Importantly, while we’re embracing the latest technology to innovate and improve and scale the outcomes we deliver, our human-centric approach will always remain central to our ethos.

Grateful for your support

In celebrating this important milestone, we’d like to thank our clients, partners, and everyone else who has played such an important part in our growth. We are genuinely grateful for your support and look forward to your partnership for many more years to come.  

Socura is delighted to be supporting Wales Tech Week 2025. Taking place from 24th to 26th November 2025 at the ICC Wales, the event will bring together companies from across Wales to showcase Welsh technology on a global stage.

As a company headquartered in Cardiff and service delivery partner to Wales' National Security Operations Centre, we’re looking forward to meeting attendees and showcasing how we’re helping organisations continuously detect and respond to cyber threats.

“Now is an exciting time to be part of Wales's burgeoning technology scene," says Andy Kays, CEO at Socura. "It's brilliant, then, that companies across the country can come together at Wales Tech Week to both showcase and celebrate their innovation."

"Cyber security impacts all organisations, and Wales is leading the way in new approaches to tackling this critical issue. Being part of the event means I'm looking forward to discussing the latest challenges we’re facing and why Wales is developing some of the best talent and solutions to address them."

If you’re attending the event, come and meet us in the Cyber Zone.

‍

Is your organisation preparing to meet the enhanced security requirements of the NCSC's Cyber Assessment Framework?

In an upcoming webinar hosted by Socitm, join John Lodge and Anne Heim of Socura to learn about the new CAF requirements and discover ways to develop a more proactive approach to security operations.

Register and discover

• Considerations for achieving a next-generation SOC
• How to prepare for CAF 4.0
• Differences between an in-house SOC and outsourcing to a provider

Register to attend

The webinar is taking place on 26th September 2025 at 13.00GMT and will last for one hour. The session is free to attend and open to members and non-members of Socitm.

‍Speakers:

John Lodge, Head of Security Opertaions Centre, Socura

Anne Heim, Threat Intelligence Lead, Socura

Host:

Simon Monahan, Head of Marketing, Socura

Delivering a world-class Managed Detection and Response service that provides the power of calm to our clients is what drives us here at Socura.

Industry recognition for the service we deliver is always an honour. That’s why we’re so delighted to have been shortlisted for two Computing Security Awards 2025:

• Security Services Provider of the Year
• Cyber Security Customer Service

Your Vote Counts

The Computing Security Awards recognise companies, products, and services that protect the critical digital infrastructure of organisations around the world.

Award winners are chosen by public vote. If you’re a fan of our team and the work we do, please consider voting for us. It only takes a moment, and voting closes on 1st October 2025.

Vote for Socura

We truly appreciate your support!

CYBERUK is the UK government’s flagship cyber security event. Join Socura at this year’s event (6th – 8th May), which explores the themes of ‘Transforming Resilience. Countering Threats.‘

Visit stand E6 to discover how our Managed Detection and Response service is enabling organisations across the public and private sectors to streamline threat detection and stop attacks more swiftly and effectively. We’ll also be showcasing our work with the Welsh Government in establishing Wales’ National Security Operations Centre.

Book an appointment with Socura

Taking place in Manchester, CYBERUK 2025 is a great opportunity to collaborate with over 2,000 cyber security leaders and professionals. Speakers include Richard Horne, Chief Executive Officer of the National Cyber Security Centre (NCSC) and John Edwards, UK Information Commissioner.

Get in touch below to set up a time to meet with the Socura team at CYBERUK 2025 and discuss your security challenges. Learn how Socura MDR:

• Enhances threat visibility across your environments, on-premises and the cloud
• Strengthens the protection of key systems, research data and intellectual property
• Rapidly identifies and responds to threats, including ransomware and phishing attacks

‍

We look forward to meeting you.

In a digital age where a small business in the UK falls victim to a cyberattack every 19 seconds (Hiscox), the ability to quickly detect and respond to threats is essential for minimising risks.

Join Socura at The National Cyber Security Show 2025 to learn how our Managed Detection and Response service can help ease the load of threat detection and shut down threats earlier and more effectively.

Discover how Socura MDR:

• Enhances threat visibility across your environments, on-premises and the cloud
• Strengthens the protection of key systems, research data and intellectual property
• Rapidly identifies and responds to threats, including ransomware and phishing attacks

‍

Attend our live session

Taking place on 8-10 April 2025 at the NEC in Birmingham, the NCSC 20025 is a great opportunity to improve your understanding of the latest cybersecurity threats, trends, and solutions.  Connect with leading experts, attend informative workshops and seminars, and network with industry peers.

On the first day on the conference at 12.10 PM on the Cyber Solutions Stage, Graeme Barnett of Socura will present:

Maximising success with a Managed Detection and Response provider: strategies for building a strong and effective partnership

Whether you’re new to outsourcing or seeking to enhance your current partnership with an MDR provider, this session will explore key strategies for building a successful and lasting client-provider relationship.

‍Managed Detection and Response you can rely on

Get in touch to set up a time to meet with the Socura team at the conference and discuss your threat detection challenges.

The Pros and Cons of AI

The ever-evolving threat landscape is becoming increasingly complex and sophisticated, posing a significant challenge to organisations seeking to protect their critical assets. In this landscape, artificial intelligence (AI) has emerged as a transformative tool for threat detection and hunting, providing organisations with a proactive approach to cyber security.

In the context of threat detection and hunting, AI can be leveraged in one of two ways. First, AI is baked into the endpoint and network detection tools to discover anomalies and other pattern recognition tasks that would be impossible for a human analyst to detect, given the huge amounts of data to be analysed. Secondly, and more recently, AI can be used to search the internet for the latest threats, vulnerabilities, exploits and techniques, it can then take the results of these searches and propose threat detection rules which it can also translate into various detection languages depending on the toolsets you would like to apply them to. These rules can then be deployed, tested, and ideally, verified by a human analyst before going live.

The Benefits of AI in Threat Detection and Hunting

AI offers a multitude of benefits that empower organisations to combat cyber threats effectively:

• Scalability: AI algorithms can process and analyse vast amounts of data, far exceeding the capabilities of traditional security tools. This enables organisations to detect and respond to threats with greater efficiency, even as the volume and complexity of data continue to grow unabated. This data can be in the context of data being fed into a SIEM tool, or in the context of threat intelligence available on the open internet.
• Automation: AI automation could streamline the threat detection and hunting process, freeing up security analysts to focus on more complex investigations and strategic initiatives. This automation improves response times and optimises the overall cost of security operations. Automation of the creation of detection rules reduces the risk of new emerging threats being left undetected. This work can be carried out by a threat intelligence analyst and detection engineer however the process is time consuming and never ending. AI reduces the time cost and time delay of these activities.

Anomaly detection algorithms exemplify the practical application of AI in threat detection. These algorithms analyse network traffic, system logs, and user behaviour, identifying anomalies that could signal malicious activity. For instance, an anomaly detection algorithm might detect a sudden surge in network traffic from a specific source, indicating a potential compromise attempt.Anomaly detection also leverages AI’s power through machine learning algorithms to analyse threat intelligence data. These algorithms learn from extensive historical data, including known threat signatures, attack patterns, and vulnerability information. Enabling them to identify emerging threats that may not yet be recognised by security analysts. These AI capabilities are baked into the tools used by SOCs, and as AI continues to improve, we can expect to see fewer false positives from these algorithms, as well as fewer false negatives (malicious activity not detected as malicious).

The Limitations of AI in Threat Detection and Hunting

While AI has revolutionised threat detection and hunting, it is not without its challenges and limitations:

• Hallucinations: In its current form AI is susceptible to hallucinations, particularly in the context of Large Language Models (LLMs). A hallucination is when the LLM presents false information as fact, and unfortunately, it does this confidently. LLM’s have not yet learned to say when it does not know the answer. For this reason, while AI can greatly increase the efficiency of a human analyst and carry out much of the leg work, most AI output needs to be verified in some way, usually by a human analyst, or have other safeguards put in place.
• Opacity: The inner workings of AI models are often opaque, making it difficult to understand their decision-making rationale. This opacity hinders troubleshooting and can lead to confusion when interpreting security alerts. This can be engineered by training the AI not only to provide an answer or an output, but also to explain its reasoning. For example, in the context of creating a detection rule, which is usually in the form of code, the usage of code comments will help the analyst understand how the code is achieving the goal which will allow logical mistakes to be picked up easier. In the context of anomaly detection, a clear explanation of why such an anomaly is a risk will reduce the time required for an analyst to determine if the anomaly poses a threat.

In part 2, we delve into getting the most out of AI in threat detection and hunting, providing insights and recommendations on how to maximise the benefits of AI while working alongside human analysts.

Following on from part 1, where we discussed the benefits and limitations of AI in threat detection and hunting, we will now look at how you can maximise the benefits of AI by providing recommendations along the way.

Getting the Most of AI in Threat Detection and Hunting

Despite these challenges, AI remains a powerful tool that can significantly enhance threat detection and hunting capabilities. Organisations that embrace AI, investing in its development and deployment, gain a competitive advantage in the cyber security landscape. A key thing to note about AI is that it is rapidly evolving and improving, so challenges that currently exist that make AI inappropriate for certain tasks may soon no longer be a challenge. For example, in the case of hallucinations, GPT4 hallucinates less than GPT3, and GPT5 is likely to hallucinate much less than GPT4 and hopefully gain the ability to say when it does not know the answer.

To maximise the benefits of AI for threat detection and hunting, organisations should consider the following recommendations:

• Start Small: Begin with a small pilot project to assess the benefits and challenges of AI before implementing it across your entire security infrastructure. Simple low-level tasks that are often repeated by analysts, ideally tasks with minimal impact if they go wrong. Set up validation on these tasks and monitor for a period, fine tuning where necessary until you hit a minimum required level of accuracy.
• Choosing the Right Tools: Carefully evaluate and select AI tools that align with your organisation’s specific needs and budget. Be aware that using third party tools carries a risk that when these tools change, any systems you have integrated them into may also need updating. For example, the OpenAI API changed the size of its context window, if you had built prompts that used the full length of the previous context window, these prompts would now return an error message. Monitoring and validation should be used to detect when errors like this are introduced. In addition, AI tools that have direct access to the live internet are essential when creating detection rules that are designed to protect against the most up to date emerging threats.
• Train Your Analysts: Provide comprehensive, and ongoing, training to your security analysts, ensuring they understand AI limitations and can effectively interpret AI-generated alerts.
• Monitor and Evaluate: Continuously monitor the performance of your AI tools, identifying areas for improvement and making necessary adjustments.
• Verify: In its current state, AI should be viewed as a tool to enhance the capabilities of analysts and remove some of the leg work, however, whenever possible humans should be kept in the loop to use and verify the output of AI rather than human analysts being replaced by AI.

By following these recommendations, organisations can harness the power of AI to strengthen their cyber security posture, proactively detect threats, and effectively protect their critical assets in the face of evolving cyber threats.

At Socura, we take a people-centric approach to all that we do and although AI has made, and will continue to make, great strides in cyber security, it takes human expertise to be the light; deciphering, interpreting, and acting based on that knowledge to make that interaction count. The human element remains essential in making sense of complex threat scenarios and orchestrating an effective response.

In cybersecurity, standing still is the same as moving backwards. As threat actors rapidly evolve their tactics, Security Operations Centres are under constant pressure to protect critical assets with greater speed and precision.

While AI is often hyped as a catch-all solution, its most practical and immediate value is quietly unfolding in the essential area of Security Orchestration, Automation, and Response playbooks.

By automating repetitive tasks and simplifying workflows, AI is moving from a novelty to a core teammate for security analysts. This shifts the focus from managing tools to defending networks, effectively rewriting how modern security operations function.

Streamlining Playbook Creation with AI

Traditionally, building SOAR playbooks has been a manual, time-consuming task. Human analysts have to painstakingly map out workflows, connect integrations, and write logic blocks from scratch.

We are fast approaching a point where this manual engineering overhead disappears. Future large language models will be fine-tuned directly on playbook JSON data alongside natural language descriptions. Instead of building a workflow step-by-step, an analyst can simply describe what they want to achieve and let the AI generate the playbook structure. As new threats emerge at unprecedented speeds, this capability will allow defensive responses to adapt in real time, effectively shrinking deployment windows from days to seconds.

Moving to Automated, Observation-Based Suggestions

Generating a playbook from a prompt is just the first step. The real magic happens when AI transitions into an active observer within the SOC.

By monitoring daily operations, an AI agent can learn to spot the repetitive, manual actions that analysts take to triage specific alerts. Once it identifies these patterns, the system can automatically suggest playbook enhancements or new automation tracks. Crucially, the human stays in control. These optimisations are presented as options that require explicit approval from the user before going live, which eliminates engineering bottlenecks without sacrificing oversight.

Optimising Detection as Code Logic

As modern SOCs shift toward a Detection as Code model, AI’s ability to refine logic in real time will be a massive asset. This is particularly true when dealing with the industry's oldest headache of false positives.

When a SOC team triages an incident and closes it as a false positive, traditional tuning requires an analyst to manually adjust the rule to exclude that specific data point. With intelligent language models, the system can review the underlying detection rule holistically. It can suggest broader, smarter adjustments to prevent similar false positives in the future, while ensuring the logic remains tight enough that genuine, malicious incidents never slip through the cracks.

The Power of Feedback Loops and Chain-of-Thought Reasoning

AI systems are becoming significantly better at self-correction through feedback-driven learning. Instead of relying on a single, linear prompt, modern SOAR platforms allow engineering teams to link prompts together. This creates an internal critique mechanism where the AI evaluates its own output, identifies gaps or inaccuracies, and refines its response before ever presenting it to a human.

This process relies heavily on Chain-of-Thought reasoning, where a model breaks down complex problems into smaller, logical steps and interrogates its own answers along the way. While future models will have this capability baked natively into their architecture, security teams can recreate this today by chaining sequential tasks directly within their SOAR playbooks. The result is a massive leap forward in automation accuracy.

Empowering the Defensive Line

Embracing AI-powered playbooks is not about replacing human talent, but rather about elevating it. By offloading repetitive engineering and tedious alert-triage loops to AI, SOC analysts can shift their focus to deeper investigative work, threat hunting, and strategic defense.

As these technologies mature, the baseline skills of a security analyst will naturally evolve. Masterful prompt engineering and advanced investigation will become the new standard, ultimately helping Tier 1 support teams upskill faster and keeping defenders firmly one step ahead of the adversary.

Our previous blogs have been focussed on looking forward, what will be possible with Artificial Intelligence (AI) in the near future. In this blog, we look at an area where Large Language Models (LLMs) and AI are already adding high value, which is in training, education and knowledge retrieval.

The role of an analyst is becoming increasingly challenging in the rapidly changing world of cyber security. To stay ahead of cyber criminals and continue to protect an organisation’s sensitive data, analysts must continually update their skills and knowledge. This presents a unique opportunity for AI, particularly LLMs, to step in and provide valuable assistance in improving cyber security analyst training.

AI for Knowledge Management

For cyber security teams, knowledge management is essential. Having clearly defined processes and documentation helps in the smooth onboarding of new analysts and ensures a consistent approach to handling security incidents. This is where AI, especially LLMs, is playing a crucial role. Instead of relying solely on human experts to guide new analysts, AI can step in as a virtual mentor. By feeding the AI with well-documented processes and workflows, new analysts can ask questions and receive real-time guidance. While this information is available to the analyst stored within knowledge bases, the use of LLM’s can speed up the retrieval of the information when it is required. When searching through a large amount of data, unless structured in some specific way, keywords would need to be searched in order to find the required information. With LLM’s instead of the correct keyword needing to be used, natural language can be used to ask the question.

AI as a Research Assistant

New threats, exploits, vulnerabilities, and techniques are constantly being released in the world of cyber security and this presents a requirement for analysts to constantly be researching in order to be able to effectively identify and mitigate them. While this information is available online, and while LLM’s currently cannot contain information that is not already available in the public domain, they can act as a powerful start to the workflow. Instead of an analyst using a search engine, wading through adverts and pre-ambles within blog posts, the analyst can instead start the search using the LLM and then pivot to verifying this information using traditional techniques.

AI as a Tutor

The AI-driven tutoring capabilities of LLMs are also of immense value. As cyber security professionals, there’s a constant need to stay updated on the latest threats, techniques, and tools. Learning and mastering new concepts can be challenging, and we often reach points of frustration or confusion. Here’s where AI shines as a private tutor. If you’re struggling to understand a particular concept, you can turn to the LLM and ask it to explain it to you. And it doesn’t stop at one explanation; you can ask it to simplify or provide alternative explanations until you fully grasp the concept. It’s like having a personal tutor on standby, available to guide you through complex topics and making learning cyber security more accessible. One powerful technique is to attempt to explain a concept back to the LLM and ask it to criticise your explanation, not only does this require you to be able to explain a concept in your own words, but it helps identify areas you may have misunderstood. The ability to have a conversation about a subject, or a concept within a subject is a very powerful learning tool which would have been limited previously to those with a private tutor.

All the benefits listed in this blog, as with any resource, require analysts to have a core level of knowledge. Without some foundation in a subject, it is difficult to even know which questions should be asked of an LLM to gain the knowledge you need. Perhaps in the future LLM’s will be fine-tuned to act as tutors within specific domains, and these tutors would suggest questions that you don’t know you should ask in the first place, but currently the learning is user driven.

In conclusion, AI, especially LLMs, is revolutionising cyber security analyst training. It closes the knowledge gap, making cyber security research more accessible and helps retrieve information from large amounts of data quickly. AI serves as a personal tutor, helping cyber security professionals understand complex concepts and continuously improving their skills. As the cyber security landscape evolves, AI will play an increasingly crucial role in preparing analysts for the challenges that lie ahead.

Summary

To summarise this series of blog posts, AI will undoubtedly continue to improve rapidly and as it does so, people within the cyber security industry will find new ways to leverage it, both defensively and offensively. It is very hard to predict what capabilities will emerge and when, and so often it will be a case that cyber security practitioners will need to quickly adapt and implement these capabilities rather than planning for them. One thing that is clear though is that there is a long road ahead from where we are now, to AI systems being able to act as an autonomous security analyst. In the meantime, AI systems should be used to bolster the capabilities of analysts, and where possible automate sub-tasks that could save these analysts valuable time. As AI systems improve, I imagine we will see an increase in the tasks that can be reliably automated with less and less oversight. From 10-20 second tasks that can be automated currently, to multi-task workflows in the future.

New ONS analysis by Socura reveals that cybersecurity is now the fastest growing IT occupation in the UK. However, with just one security professional for every 86 businesses, a large skill gap remains. Women also remain vastly underrepresented across the industry.

UK Employment Trends Since Fatima

‘Their next job was in cyber’ was a UK government campaign to encourage more people to choose a career in cybersecurity. However, the infamous ‘Fatima’ ballerina ad that formed part of the initiative sparked a furore on social media and was heavily criticised.

Four years since the ad first appeared (and promptly disappeared), Socura has conducted an analysis of Office of National Statistics (ONS) Employment data to identify how many people have since decided to pursue a new career in cyber. In particular, we were keen to understand the extent of the current skills gaps in the industry.

‍Cyber Is The Fastest Growing IT Occupation

Our analysis reveals that the number of cybersecurity professionals in the UK more than doubled between Dec 2021 (28,500) and March 2024 (65,000), an increase of 128%. The level of this increase means that cybersecurity is now the fastest growing IT occupation, exceeding roles in software development, networking and IT support.

‍Talent Shortages Remain Widespread

Despite an encouraging increase in the total number of cybersecurity professionals, demand continues to outstrip supply. Worryingly, for every 86 companies, there is just one security pro – a situation that desperately needs to be addressed if the UK is to be considered one of the safest places to live and do business. For context, there are nearly 10 times more software programmers in the UK today than cybersecurity pros.

Unfortunately, there is also an increasing gender divide. While there are 4,600 more females in cybersecurity roles today compared to December 2021, the percentage of women compared to men has decreased in this same period, from 24% to 17%.

Download The Report For More Insights

Download the full copy of our ‘Their Next Job Was in Cyber’ report. Understand where the hot spots are for cybersecurity professionals in the UK and learn why partnering with a Managed Detection and Response provider is an excellent option for organisations struggling to recruit and retain talent.

‍

This month marks Socura’s 5th birthday. We wanted to mark this special milestone by reflecting on our journey so far, while giving thanks to the customers and partners who have supported us along the way.

Overcoming Early Challenges

All businesses experience unique challenges in their early days. However, back in September 2019, when Socura was founded, little did we know what was around the corner - something that could have derailed our plans before we had even begun!

Strongly motivated by our vision to deliver the next generation of Managed Detection and Response (MDR), it was an exciting time. But the start of the COVID-19 pandemic had the potential to change everything. It was far from ideal to start a new business. We could not meet up together as a team or with prospective customers.

Fortunately, as difficult as it was to start a business during COVID, the pandemic presented a major opportunity. Businesses were scrambling to better secure their remote workers and cloud services. Meanwhile, almost overnight, it became impossible for Managed Services Providers to operate traditional physical security operations centres.

Being a 100% remote business built on the latest cloud architectures, Socura had no such problems. Where other providers struggled to adapt to changing customer requirements, Socura was set up to address them from the start. Our flexibility meant that we could rapidly deploy our MDR service and start providing proactive threat detection to customers in weeks rather than months.

We quickly realised that organisations loved our open and honest approach. Security teams told us that they were fed up with service providers who failed to live up to their promises and included hidden extras. They wanted a security partner that was transparent and actually delivered. For example, many other providers would fall short on incident response - a vital component of MDR.

The Present Day

Five years later we can reflect on the pandemic as a challenging time, as well as an important learning curve. It taught us that we can never stand still and must always be ready for what’s around the corner.

Today, Socura has grown to provide Managed Detection and Response to a wide range of private and public sector organisations across the UK - and we continue to go from strength to strength. Being selected as the delivery partner of CymruSOC, Wales’s national cyber security operations centre, is just one of many recent highlights.

Most importantly, customers tell us that our service keeps getting better and better. We are detecting threats more swiftly than ever and automating more response actions to stop threats early. 96% of the incidents we detect are now handled without the need for us to notify customers.

Socura’s Net Promoter Score (78) is ‘Excellent’, and we’re also immensely proud of our 100% customer retention rate.

Here are a few recent quotes from customers that make us very happy:

‍“You have a talented and dedicated team who genuinely care about the customer, which is rare to see these days.”

“More tuning done in one meeting than 5 years of the previous provider.”

“The Socura team are knowledgeable and easy to work with. They take the time to understand our processes and systems and provide recommendations that make us a far stronger organisation.”

“The service is excellent. Nothing is too much trouble.”

Looking Ahead

We look ahead to the next five years and beyond with great optimism. Continuing to improve all aspects of our MDR service to defend our customers against the latest threats is a challenge that drives us. By closely understanding our customers’ needs and working in collaboration with our partners, we will continue to push boundaries.

Improving our proprietary Detection Rule Automation Engine (UK patent application pending) to further streamline detection rule management is just one of our top priorities for the next 12 months. We will also continue to invest in our team to ensure that we attract the UK’s best security talent.

Your Support Means Everything

On behalf of the whole team at Socura, thank you to everyone who has supported us during our first five years.  We hugely value the trust you place in us as your security partner and look forward to supporting your detection and response requirements for many more years to come.

Now time to blow out the candles and enjoy a slice of birthday cake!

Delivering a Managed Detection and Response (MDR) service that consistently achieves results for our customers is at the heart of everything we do at Socura.  

That’s why we were honoured to be recognised as Technical Partner of the Year 2024 for our innovative use of Palo Alto Networks’ technology at Exclusive Networks’ recent Sweet 16 Partner Xchange event.  

As a Palo Alto Networks partner since our founding in 2019, this award is a credit to the expertise and dedication of our team, which enables our customers to get the most out of their security controls and quickly detect and respond to threats.

“Their (Socura’s) technical expertise and innovative use of Palo Alto Networks’ solutions have been pivotal in driving exceptional managed security services.  
Beyond their technical prowess, they have demonstrated a strong collaborative spirit, seamlessly integrating with our team and becoming a true partner in every sense of the word. ‍

Exclusive Networks

In cybersecurity, it pays to plan for the worst by ensuring that controls and processes are in place and tested frequently to prove their reliability and effectiveness when times are critical.

To support our clients in increasing their cyber preparedness, Socura is delighted to announce a partnership with Thomas Murray, a recognised expert in Incident Response (IR).

The partnership gives Socura clients access to Thomas Murray’s range of Incident Response Retainer (IRR) and consultation services. In return, Socura will offer Managed Detection and Response (MDR) to clients Thomas Murray is supporting to recover from cyber incidents.

About Thomas Murray’s Services

Thomas Murray is a global risk intelligence company that helps businesses understand and manage the risks they face in today’s interconnected world. The company’s Cyber Risk Practice possess years of experience responding to complex cyber incidents.

Among the services now available to Socura clients include:

• Incident Response Retainer

Includes 24/7 incident support, digital forensics, response planning, legal and regulatory support and dark web monitoring.

• Pen Testing

Tests the security of systems and applications from the perspective of an ethical hacker.

• Red Teaming

An objective-based assessment designed to test detection controls and IR processes.

• Cyber Awareness Training

Increase employees’ awareness of the latest cyber risks and how to minimise risks.

How MDR and IRR Complement Each Other

The risk of follow-up attacks is a significant risk for any organisation that has suffered a breach. By working with Socura, Thomas Murray will now offer clients that it is helping to recover from incidents the ability to quickly scale their threat detection capabilities with MDR.

Socura MDR includes an experienced team of Security Operations Centre professionals, responsible for proactively detecting and responding to threats. The service will manage and optimise any endpoint detection tooling installed as part of the IR process and automate response actions - minimising the time it takes to shut down future attacks.

‍

“Proactive threat detection and response is vital to minimising cyber risk, but particularly so in the event of a breach. It’s why we’re delighted to partner with Thomas Murray and offer their clients that are dealing with a cyber incident the expertise they need to rapidly scale their capabilities and prevent repeat attacks. Thomas Murray’s considerable experience managing cyber incidents means they will also play an important role in helping our own clients to further increase their cyber preparedness.”

Andy Kays, CEO at Socura

‍

‍

 “We are excited to join forces with Socura, an innovative company that shares our passion for delivering exceptional cyber security services. Together, we will help organisations strengthen their defences against cyber threats and be better prepared to respond in the event of a security incident.”

Ioan Peters, Managing Director of Cyber Risk at Thomas Murray

CymruSOC, Wales’ National Security Operations Centre, has been awarded Project of the Year at the Computing Security Awards 2024.

Led by the Welsh Government in collaboration with Merthyr Tydfil County Borough Council, the initiative - the first of its kind in the UK - is strengthening the resilience of public sector organisations across Wales.

Socura was awarded the contract to deliver CymruSOC earlier this year and is in the process of rolling out Managed Detection and Response (MDR) to over 21 local authorities and fire and rescue services across the country.

Securing the Public Sector Across Wales

Every day, thousands of people rely on councils and other public sector organisations in Wales for essential services such as social care, education, and waste collection. Should a cyber attack impact the availability of these services, the results can be highly disruptive.

By delivering a proactive MDR service that includes a team of security experts to detect and respond to threats, Socura is helping to improve cyber resilience across Wales and foster CymruSOC’s ‘defend as one’ approach.

“CymruSOC is a pioneering initiative in the UK, and Socura is proud to have been trusted by the Welsh government to help deliver it”, says Jamie Brummell, CTO at Socura “CymruSOC is already making a significant impact on the resilience of the public sector in Wales, and we’re delighted that this has been recognised by the judges of the Computing Security Awards. Congratulations to all the winners and shortlisted finalists.”

About the Computing Security Awards

The Computing Security Awards is an annual event that recognises companies, products and services that protect the critical digital infrastructure of organisations around the world. The Project of the Year category as this year’s event was determined by a panel of judges, including the editor of Computing Security.

About Socura

Socura reduces cyber risk by proactively detecting and responding to threats, 24/7. Our Managed Detection and Response service operates as an extension of an organisation’s security team - supplying highly skilled SOC experts and the additional capabilities needed to scale security operations and accelerate response to attacks.

Socura has been recognised as a top managed services provider for the third successive year. MSSP Alerts’s annual list of the top 250 MSSPs, MDRs and MSPs globally, places Socura at 127 - a rise of 103 places since 2022.

Socura is one of just 14 UK-headquartered businesses to make the list, which is determined by criteria such as business growth rate and third-party industry honour

“In a highly competitive market, we’re delighted that Socura continues to be recognised as a top choice for organisations that need support from a managed services partner,” said Andrew Kays, CEO of Socura.  "Rising over 100 places in MSSP Alert’s lists shows the trajectory we are on as a business. We are determined to continuing improving the outcomes we deliver and show the world how Managed Detection and Response should be delivered.”

‍

“MSSP Alert and CyberRisk Alliance congratulate Socura on this honour,” said Jessica C. Davis, editorial director of MSSP Alert, a CyberRisk Alliance resource. “The Top 250 MSSPs are an elite group of cybersecurity service providers, and they continue to outperform the overall cybersecurity services market. Members of this list are the best of the best.”

‍

Find out more about the MSSPs list and see all the companies named on the list here: https://www.msspalert.com/top-250-2024

‍

About MSSP Alert

MSSP Alert is part of CyberRisk Alliance (CRA), a business intelligence company that helps the cybersecurity ecosystem connect, share knowledge, accelerate careers, and make smarter and faster decisions. Through our trusted information brands, network of experts, and more than 250 innovative annual events we provide cybersecurity professionals with actionable insights and act as a powerful extension of cybersecurity marketing teams. Our brands include SCWorld, the Official Cybersecurity Summits, Security Weekly, InfoSec World, Identiverse, CyberRisk Collaborative, ChannelE2E, MSSP Alert, LaunchTech Communications and TECHEXPO Top Secret.

About Socura

Socura reduces cyber risk by proactively detecting and responding to threats, 24/7. Our Managed Detection and Response service operates as an extension of an organisation’s security team - supplying highly skilled SOC experts and the additional capabilities needed to scale security operations and accelerate response to attacks.