The SOC for those without a SOC
Sep 24th, 2026 by Jesper Kråkhede
For years, a proper SOC has been something for large organisations. You needed a SIEM, people around the clock, detection engineers and a lot of integration work. Smaller organisations bought a service, or did without.
This month Microsoft made an integrated SOC experience in Defender available to eligible Microsoft 365 E5 and E7 customers who don´t have their own Sentinel workspace. It brings XDR, SIEM capabilities, threat intelligence, automation and AI together in the Defender portal.
Why does this matter? Because many of the organisations that need it most are exactly the ones without the resources to build it. The small municipality I helped on my 50th birthday. The supplier with a two person IT team. The company that bought E5 for compliance reasons and never used half of it.
For them, the barrier to a functioning SOC drops considerably. The data sources they already have are connected, the detections are built in, and automation and agents can handle a large part of the routine work.
It isn´t magic. Someone still needs to own it, look at what it finds and act on the things the automation can´t handle. A partner can help with that. And you still need to get the basics right: identities, devices and patching.
There is a compliance angle as well. Under the new Swedish cybersecurity act, many smaller organisations now have to detect and report significant incidents within 24 hours. That is very hard without some kind of SOC.
Security shouldn´t depend on the size of your budget. This is a step in the right direction.