Question 1

What is SOC-as-a-Service and how is it different from MSSP?

Accepted Answer

SOC-as-a-Service delivers the full Security Operations Center function — SIEM (log aggregation), threat detection, threat hunting, incident response — on a subscription. Traditional MSSP (Managed Security Service Provider) typically only manages specific tools (firewall, AV). We cover the full detection + response loop, not just device administration.

Question 2

Why would an SME need a SOC?

Accepted Answer

Three compelling reasons: (1) cyber insurance carriers now require demonstrable 24/7 monitoring for coverage or better rates; (2) Bank Negara RMiT (Risk Management in Technology) + MAS TRM compliance for financial institutions and regulated entities mandates continuous monitoring; (3) enterprise customers + GLCs increasingly require SOC attestations from SME suppliers in procurement. Plus — every ransomware case we respond to, 90% had no real-time detection in place.

Question 3

How is this different from LGMS / Firmus / BAE Systems?

Accepted Answer

They serve enterprise (RM100K+/month price points). We serve Malaysian SMEs (RM15-60K/month) with the same underlying technology stack but smaller endpoint counts and simpler service catalogs. Enterprise SOCs do custom threat intelligence work — we standardise on proven playbooks + co-managed response with your internal team.

Question 4

What tools do you use?

Accepted Answer

SIEM: Microsoft Sentinel (primary) or Elastic for cost-sensitive customers. EDR: Microsoft Defender for Business + CrowdStrike (enterprise tier). Threat intel: OpenCTI + commercial feeds. Case management: TheHive + MISP. Deployment: tools run in your M365 tenant or our managed Azure environment — you own the data.

Question 5

What's covered at RM15,000/month vs RM60,000/month?

Accepted Answer

Essential (RM15K/mo, up to 50 endpoints): 24/7 monitoring of email/endpoints/identity, baseline detection rules, weekly report, Tier-1 incident triage. Advanced (RM30K/mo, up to 150 endpoints): + threat hunting, custom detection rules, Tier-2 response, monthly tabletops. Enterprise (RM60K/mo, up to 500 endpoints): + dedicated analyst hours, integration with on-prem systems, bi-weekly executive reporting, SOC-2 attestation support.

Question 6

How long does SOC deployment take?

Accepted Answer

30-day onboarding: Week 1 — SIEM deployment, log source enumeration, agent rollout. Week 2 — baseline rules tuning, false positive calibration. Week 3 — runbook customisation, escalation policy agreement, on-call schedule. Week 4 — tabletop exercise, SOC go-live. Customers with existing Microsoft Sentinel/Defender shorten this to 14 days.

Question 7

What happens when you detect something?

Accepted Answer

Tier-1 (suspicious activity): analyst triages within 15 minutes, enriches alert with context, calls you if verified. Tier-2 (confirmed incident): immediate isolation of affected asset, credential rotation trigger, full incident report within 4 hours. Tier-3 (active breach): emergency response team engaged, parallel ransomware-recovery workflow activated (see our Ransomware Recovery page for the full 5-phase framework).

Question 8

Do you support Bank Negara RMiT and MAS TRM?

Accepted Answer

Yes. Our SOC deployment includes RMiT-aligned controls: continuous monitoring, incident response, audit logging retention (7 years), segregation of duties, and regulatory breach notification workflows. Similar coverage for Singapore MAS TRM for orgs serving Singapore. We provide quarterly compliance reports suitable for regulatory submissions.

SOC-as-a-ServiceMalaysia · 24/7 Threat Detection

What your SOC delivers

24/7 Monitoring

Threat Hunting

Real-Time Alerting

Detection Engineering

Incident Response

Compliance Reporting

Service tiers

Essential

Advanced

Enterprise

Scope your SOC deployment

Get Your Free Quote

Quote Preview

Frequently asked questions