SOC vendors: who they are and how CISOs compare them, from MDR to SIEM

On CISO Tribune's record as of 18 October 2026, 84 vendors sell security operations center (SOC) products or services, filed across eight categories. They collect security telemetry, detect threats and run investigation and response, either as a service staffed by their own analysts or as software your team operates. CISOs compare them on coverage, authority to act, data custody, escalation speed and exit terms.

Key facts

• "SOC vendor" covers two purchases: a managed service, which Gartner defines as remotely delivered SOC functions, and the platforms an in-house SOC runs on.
• The National Institute of Standards and Technology (NIST) made Special Publication (SP) 800-61 Revision 3 final on 3 April 2025, replacing its 2012 incident handling guide.
• Under 2023 Securities and Exchange Commission (SEC) rules, a Form 8-K Item 1.05 filing is generally due four business days after a company decides an incident is material.
• The EU's second Network and Information Security Directive (NIS2) requires an early warning within 24 hours of becoming aware of a significant incident.
• MITRE has run two managed services evaluations, in 2022 and 2024, and assigns no scores, rankings or ratings.
• The Cybersecurity and Infrastructure Security Agency (CISA) and partners told buyers on 27 May 2025 to run a proof of concept before buying a security information and event management (SIEM) or security orchestration, automation and response (SOAR) platform.

What SOC vendors sell: two purchases, eight categories

The first purchase is a service. Gartner's market definition, last updated on 15 July 2026, describes managed detection and response (MDR) as "remotely delivered security operations center (SOC) functions". Its mandatory features include round-the-clock staffing and immediate remote response, such as quarantining hosts, that the customer has preapproved. A managed SOC buys you someone else's analysts and, usually, someone else's tools.

The second purchase is a platform your own team runs. Gartner's SIEM definition calls SIEM a configurable system of record that collects and analyzes security event data. Around it sit tools that automate response, investigate alerts, move data and supply intelligence. Some buyers combine the two: a platform they own and a provider who watches it.

CISO Tribune's taxonomy files the 84 vendors in eight categories. A vendor can file in more than one, so the counts below add up to 125 filings:

• MDR and managed SOC (33): a provider's analysts monitor your environment around the clock and respond to threats.
• SIEM (18): platforms that collect and correlate logs and events for detection, investigation and compliance reporting.
• SOAR and security automation (9): workflow and playbook engines that automate SOC tasks across tools.
• AI SOC analysts (17): software agents that triage, investigate and document alerts with limited human input.
• Security data lakes and pipelines (7): products that route, reduce and store telemetry, often apart from where detection runs.
• Incident response and forensics (19): breach investigation services, forensics tools and response coordination platforms.
• Threat intelligence (22): feeds, platforms and research on actors, infrastructure, malware and exploited vulnerabilities.
• Deception technology (0): decoys, honeypots and canary tokens that alert when an attacker touches them. No deception vendor is on the published record yet.

Two neighbors are out of scope here: endpoint agents, filed under endpoint detection and response (EDR) and extended detection and response (XDR), and managed security service providers that run firewalls or identity tools under contract. Both overlap with SOC work and have their own pages.

What NIST, CISA, MITRE and regulators say about SOC vendors

Four kinds of public documents shape this purchase: frameworks that define the work, reporting clocks that bound it, public tests that measure parts of it, and buying guidance from government agencies.

NIST: the work and the contract

NIST's Cybersecurity Framework (CSF) 2.0, released on 26 February 2024, organizes its core around six functions, adding Govern to Identify, Protect, Detect, Respond and Recover. NIST defines Detect as finding and analyzing possible attacks and compromises, and Respond as taking action on a detected incident. Those two functions cover most of what SOC vendors sell.

SP 800-61 Revision 3 speaks directly to outsourcing. It says incident handlers may be on staff, on contract, such as a SOC outsourced to a managed security services provider (MSSP), or available when needed. It calls outsourcing a shared responsibility model whose split should be defined in a contract, including information flows and authority to act for the organization. It also notes that a provider may detect activity sooner because it correlates events across customers.

The reporting clocks a provider must fit inside

A SOC vendor detects; the company discloses. The SEC's adopting announcement of 26 July 2023 says an Item 1.05 Form 8-K is generally due four business days after a registrant determines an incident is material. The SEC fact sheet adds that materiality must be determined without unreasonable delay after discovery, and that the United States Attorney General can delay disclosure on national security or public safety grounds. The same rules added Regulation S-K Item 106, which requires annual descriptions of how a company assesses, identifies and manages material cyber risks; our 10-K disclosures record shows how companies describe them.

In the European Union, NIS2 Article 23 sets three steps for essential and important entities: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month of that notification. Member States had to apply their national rules from 18 October 2024. Article 21 lists supply chain security, including relationships with direct service providers, among required measures; we read that as reaching an MDR contract.

In the United States, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) directs CISA to require reports of covered incidents within 72 hours and of ransom payments within 24 hours. CISA's CIRCIA page, read on 18 October 2026, says no report is required until the final rule takes effect. Our read: every one of these clocks starts at detection, so a provider's contracted escalation time must sit far inside the regulator's.

MITRE: tests and a book on running a SOC

MITRE's ATT&CK Evaluations have tested managed services twice: against OilRig in 2022, and against menuPass plus ALPHV BlackCat in 2024. The results page says MITRE assigns no scores, rankings or ratings and leaves interpretation to others. The 2024 round had 11 providers and tested detection of stealthy activity, abuse of trusted relationships and ransomware that blocks recovery.

MITRE's 11 Strategies book, published on 31 March 2022 by Kathryn Knerler, Ingrid Parker and Carson Zimmerman, is a free reference on running a SOC. Its highlights list a managed SOC provider as one of nine organizational models, call for a SOC charter signed by executives, favor endpoint data for confirming intrusions, and ask for metrics that show what works. Each becomes a contract question when the SOC is bought rather than built.

CISA, its partners and the UK NCSC

CISA's incident and vulnerability response playbooks, released on 16 November 2021 under Executive Order 14028, give federal civilian agencies standard procedures and include checklists any organization can adapt. Buyers can use them to test a provider's runbook.

On 27 May 2025, CISA and the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) published guidance for organizations buying SIEM and SOAR platforms, including a list of priority logs for SIEM ingestion. The practitioner guidance starts with a proof of concept before any purchase.

The guidance says not to use a SIEM as a compliance log store, since data lakes and other storage suit those logs. It says SOAR platforms are usually not suitable for immature environments, and that a misconfigured SOAR may mistake normal behavior for an incident and isolate systems on its own. It adds that without outsourcing, organizations should expect several full-time staff, and that outsourcing may produce visibility gaps. Our read: the automation warning applies equally to AI SOC agents given response rights.

The UK National Cyber Security Centre's SOC guidance, published on 23 May 2022, frames the decision as a monitoring capability proportionate to the threats faced and the resources available. Its five sections, from operating model and log onboarding to incident response, work as a scoping checklist for any provider conversation.

Who the SOC vendors are

On CISO Tribune's record as of 18 October 2026, 84 vendors file under at least one of the eight SOC categories. Nine are publicly traded, 16 are private, and 12 are owned by another company or an investor; ownership is not yet recorded for 47. Headquarters are recorded for 42: 29 in the United States, three each in the United Kingdom and Ireland, and one each in Canada, Denmark, France, Israel, the Netherlands, Romania and Spain.

Overlap is common. Thirty-three vendors file in two or three SOC categories, and 36 have their primary business elsewhere, most often managed security services, consulting, endpoint protection, email security or firewalls. Four of the nine public companies file under SIEM and four under MDR, while 10 of the 16 private vendors file under AI SOC analysts.

What they sell differs by category. MDR services range from providers that work through a customer's existing tools, such as Expel, to sector services such as DefenseStorm, built for banks and credit unions. Microsoft Sentinel is a SIEM that our record notes includes a built-in data lake. AI SOC agents such as Dropzone AI investigate alerts across SIEM, endpoint and cloud tools; our record notes that the Anomali AURA agent holds consequential actions for human approval by default. Cribl Stream routes telemetry to any destination, BreachRx coordinates the business response after a breach, and VulnCheck sells exploit and vulnerability intelligence.

The full list is below this guide, grouped by category and alphabetical within each. To correct an entry, use /corrections.

How CISOs compare SOC vendors

We think four decisions matter most.

Service, platform or both. NIST notes that many organizations mix their own staff with outside help. The CISA and ASD guidance warns that external providers can miss subtle activity that people who know the network would catch, and recommends in-house capability for organizations that handle sensitive information or run critical services. Our read: buy a service for hours and headcount, and keep the judgment calls in-house.

Authority and reporting. Gartner's MDR definition expects response actions preapproved by the customer, and NIST wants the authority to act written into the contract. Gartner also lists, among common features, no limits on volume or time spent investigating. Map each preapproved action to an owner, then test escalation times against the four-business-day SEC clock and the 24-hour NIS2 early warning. A provider's notification starts your clock; it does not stop it.

Data custody and architecture. Gartner notes that less mature programs buy a SIEM to keep custody of their data while a third party monitors it. The CISA and ASD guidance recommends considering a SIEM with a data lake architecture and warns of hidden costs, including platforms that need the same vendor's other products for full functionality. It also publishes an ingestion sizing table by headcount that buyers can hold a quote against.

Exit. The same guidance warns that a misjudged product can force a costly switch and that heavy reliance on one vendor can create a single point of failure. Write into the contract that detection rules, case history and raw data come back in usable formats.

What a proof of concept should test

Our checklist, built on the CISA and ASD proof of concept questions:

• Ingest your priority log sources, not the vendor's demo data, and check the parsing.
• Replay a known incident and time each step from first alert to a named person.
• Trigger a preapproved containment action and confirm it stays inside agreed limits.
• Ask an AI agent to close an alert, then read its reasoning and action log.
• Export the data and rebuild one investigation outside the product.
• Collect feedback from the analysts who will use it, as the guidance asks.

What changed in 2025 and 2026

• 4 February 2025: SecurityWeek reported that Sophos had completed its $859 million all-cash acquisition of Secureworks, with a plan to combine the Secureworks Taegis XDR platform with Sophos's MDR services.
• 3 April 2025: NIST published SP 800-61 Revision 3 as final, superseding the 2012 guide and tying incident response to CSF 2.0.
• 27 May 2025: CISA, ASD's ACSC and partners published the SIEM and SOAR buying guidance described above.
• 21 October 2025: Dataminr announced plans to acquire ThreatConnect for $290 million in cash and equity, SecurityWeek reported. Our record lists ThreatConnect as owned by Dataminr since 2025.

Related reading

For disclosure duties, see the Item 1.05 materiality decision guide and the SEC disclosure rules for CISOs. Our 10-K cybersecurity disclosures, reporting lines report and guide to CISO reporting lines in 10-K filings show where companies place the security leader. Before deploying AI SOC agents, read AI governance for CISOs; for terms, use the security glossary, and for the role itself, what a CISO does.