Security Operations Center (SOC)

Our Security Operations Center (SOC) provides you with a 360° view for identifying and responding to security incidents with clear, competitive, monthly pricing. SOC identifies and responds to anomalies in time—tirelessly, 24/7. The service also helps you achieve compliance with the NIS2 directive.

Contact Us

Continuous service to identify security threats in time

The costs caused by serious security incidents are much higher than the costs of preparing for them—that’s why investing in anticipating and quickly preventing attacks pays off. Indeed, in many companies, early detection is typically where there is the most room for improvement.

Our SOC team reacts to potential attacks as soon as unusual activity occurs. With data collected from multiple different sources, we effectively catch a wide range of attack attempts and security incidents. Workstations, servers, cloud services and data are kept safe, whether you’re working from inside or outside your company’s network.

In other words, the SOC service identifies, detects, classifies, isolates and recovers from detected security incidents in real time, according to the service level agreed with you. You can rest easy, as the SOC monitors your company’s security around the clock.

NIS2 Compliance

Ensure NIS2 compliance with a SOC service

The NIS2 directive applies to a wide range of finnish companies and public administration entities, ranging from the energy sector to banking, and from healthcare to the food industry.

According to the NIS2 directive, security breaches must be reported within 24 hours, which in practice requires an effective SOC service. Failure to comply with the directive can result not only in a wide range of security risks, but also in a heavy fine. With a SOC service, you ensure that your company meets today’s requirements. We also offer NIS2 cybersecurity audit service to examine the state of your organization’s security in accordance with the directive’s requirements.

Read more about our cybersecurity audit for NIS2

“With the SOC service, we’ve detected security anomalies that we wouldn’t have noticed on our own. For a small internal IT team, having continuous monitoring in the background is particularly important, especially when our staff are on vacation or sick leave.”

Mika Jääskelä
Head of IT

Read customer story

Why choose Tietokeskus SOC service?

• Clear, competitive, device- and user-based pricing. Ongoing, monthly billed service.
  
• Monitoring security incidents 24/7, 365 days a year—including holidays and outside office hours!
  
• More than just traditional monitoring: In addition to detection and reporting, containment and prevention measures are carried out, and end users of the IT environment are contacted when necessary.
  
• The service also focuses on predicting anomalies and attacks.
  
• Instead of an outsourced service, you are supported by your own SOC team, and our customer service is always answered by a real expert.
  
• We are strongly committed to improving our customers’ cybersecurity and basic IT infrastructure—we consult, train, and help identify risks.
  
• The service is based on Microsoft Defender and Microsoft Sentinel technology and leverages the best capabilities of M365 licenses.
  
• The service includes Mac compatibility.
  
• It’s possible to implement customer-specific integrations. You only pay for what you need!
  
• The service modules work seamlessly together, and compatibility is maintained as the service evolves.

How the SOC service works:

1. Together with you, we define the detailed content of the service to meet your company’s needs. The agreement will be based on this content.
   
2. The SOC service monitors events in your company’s network environment by collecting data from multiple different sources.
   
3. The service detects a security incident, such as a situation where malware has been injected into a particular user’s workstation, or the workstation is otherwise behaving strangely.
   
4. The SOC team receives an alert regarding the anomalous events.
   
5. The team reviews the events and immediately initiates the necessary actions.
   
6. The isolation of endpoints, servers, and users from the rest of the business network begins according to the severity level agreed with you.
   
7. You will be notified of the situation.
   
8. The anomalous events are analyzed, and a report is generated based on them.