Licensed SOC Model

Licensed SOC model. How partners can build a repeatable monitoring, detection and response service without creating every platform capability from scratch.

Positioning for partners. My IT Channel licenses the platform and capabilities to partners. The partner operates the service and owns the customer relationship; My IT Channel does not sell a direct SOC service to the end customer.

What SOCaaS means

SOCaaS, or Security Operations Center as a Service, is an operating model in which an organisation delegates detection, investigation and incident response to a specialised provider with 24/7 coverage. The licensed SOC model adapts that capability for partners that want to deliver the service under their own brand.

The distinction matters commercially: the platform and enablement come from the distributor, while the partner defines the proposition, service levels and relationship with its customer.

Why organisations moved away from the traditional SOC

Building an internal SOC requires analysts, shifts, detection engineering, retention infrastructure, escalation and continuous tuning. Hiring and retaining that combination is difficult for most mid-market organisations. A licensed, multi-tenant operating model provides 24/7 capability with a more predictable cost structure and a partner-led relationship.

Internal SOC, licensed SOC and MDR

A licensed SOC is not a promise that the distributor will operate the end customer’s service. It is the technical and commercial foundation for the partner to do so.

How the platform works

Telemetry ingestion

Connectors receive endpoint, network, identity, cloud, email and application telemetry. Retention and search are designed to keep investigation practical without forcing the partner to discard useful data by volume.

Rules, behaviour and threat intelligence

Detection combines tuned rules, UEBA and current indicators and tactics. The partner can adapt use cases to the customer’s vertical and risk profile.

AI-assisted triage

Enrichment adds asset, user and business context and creates an investigation summary. The analyst remains accountable for the decision and escalation.

Orchestrated response

Approved playbooks can isolate endpoints, block accounts, reset credentials and contain lateral movement. High-severity cases escalate with the investigation already assembled.

Reporting and improvement

Operational, executive and strategic reports show coverage, MTTD, MTTC, false positives, active risks and recommendations.

How a licensed SOC is priced

Pricing depends on protected assets, telemetry sources, retention, service levels and the partner’s own managed-service layer. A sustainable proposal separates platform cost, partner operations, customer onboarding and optional response or compliance services. Avoid pricing solely by raw log volume when the objective is predictable customer value.

For MSSPs and MSPs

The licensed model allows a partner to start with a defined customer segment, standardise onboarding and expand the service without adding analysts linearly for every account. The partner still needs ownership of service design, escalation, customer communication, reporting and commercial margin.

For mid-market CISOs

The customer should define the escalation matrix, data residency requirements, critical assets, response authority and success metrics. A pilot should validate detections and operational communication before full migration.

Use cases

MSP launches a managed security line. The partner begins with a repeatable endpoint and identity package, enables two existing engineers, and adds network and cloud telemetry as the first customer cohort matures.

Mid-market company obtains 24/7 coverage. The internal team retains governance and architecture while the partner operates tactical detection and response, reducing blind hours without building shifts internally.

KPIs for a well-operated service

• High-severity MTTD and MTTC measured from customer telemetry.
• Coverage of agreed MITRE ATT&CK techniques.
• Escalated false-positive rate and analyst quality review.
• Time to onboard a new customer and connect its sources.
• Report delivery cadence and action closure.

Frequently asked questions

What is the difference between SOCaaS and MDR?

MDR is usually focused on detection and response around a defined technology, often endpoint. SOCaaS covers a broader operating capability across telemetry sources, processes and analysts.

Can I change provider without losing history?

Define retention, export and data-ownership terms before signing. A serious programme documents how historical evidence is retained or transferred.

Does it replace my internal security team?

No. It replaces or supplements tactical 24/7 operations. Governance, risk, architecture and business coordination remain internal.

Does it meet data sovereignty requirements?

It can, when the platform, retention region and contractual processing terms are selected for the applicable jurisdiction. Verify the actual data path during design.

How long is implementation?

A defined pilot can start in weeks; a full deployment commonly takes 60 to 120 days depending on sources, tuning and escalation design.

Can I operate it for my own customers?

Yes. That is the purpose of the licensed model. The partner owns the customer proposition, service communication and commercial relationship.

How to evaluate a licensed SOC platform

Review telemetry coverage, detection engineering, response authority, multi-tenancy, reporting, APIs, data residency, onboarding effort, support escalation and commercial protection. Request a pilot with measurable acceptance criteria rather than a generic product demonstration.

How to get started

Partners can apply through the partner programme. Organisations seeking a partner-led service can request an architecture session at the demo page.

Control criteria: document the validation of licensed SOC model, record the evidence and confirm operational closure before moving to production.