Cysiv SOCaaS

Security Operations Center-as-a-Service (SOCaaS) is gaining adoption as organizations try to secure an expanded attack surface created by digital transformation, cloud adoption, and a more mobile and remote workforce. With employees accessing systems and data from both on-premises and cloud environments outside the corporate network, risk has increased further in the post-Covid era. To meet regulatory obligations and protect sensitive and proprietary information, many organizations have invested heavily in security tools, but this has produced daily alert volumes that are difficult—especially for small and medium-sized businesses—to investigate and analyze.

SOCaaS has emerged to address alert overload, extract more value from existing security investments, extend monitoring to cloud, operational technology (OT), and IoT, and drive continual improvement by measuring control effectiveness. It also helps demonstrate to auditors a standardized detection and response capability, and mitigates the cybersecurity skills shortage by providing scalable SOC resources at lower cost than building capacity in-house. As a cloud-based, multi-tenant SaaS offering, SOCaaS avoids hardware and software management while improving resiliency, update cadence, scalability, and remote co-management.

Cysiv, founded in 2018 and now independent after incubation within Trend Micro, provides a cloud-native, co-managed SOCaaS platform that ingests telemetry from any log-generating source, integrates with existing SIEMs (or provides SIEM capabilities), and emphasizes detection, investigation, triage, threat hunting, remediation, and built-in SOAR. It uses machine learning, signature recognition, behavior analytics, statistics, and broad threat intelligence sources to reduce false positives and alert fatigue while enabling higher-fidelity detection and forensics. Pricing is consumption-based (events per second and users/workloads). Strengths include scalability, service tiers, co-management access, threat intelligence breadth, and SOAR; challenges include reliance on third parties for intrusion detection/prevention and missing automatic containment, vulnerability scanning, and asset discovery (on the roadmap).

• SOCaaS adoption is being driven by alert overload, the push to maximize existing security investments, expanded monitoring needs (cloud/OT/IoT), and the desire to measure effectiveness for continual improvement.
• Cloud-based SOCaaS requires no software licensing/installation and no hardware purchase or maintenance.
• SOCaaS commonly includes monitoring and management for IDS, firewalls, anti-malware, VPNs, endpoint protection (EPP), and endpoint detection and response (EPDR), plus analyst-led alert resolution and attack response.
• MSSPs often generate too many alerts, may lack advanced threat detection/remediation skills, and commonly require fixed long-term contracts and a specific technology stack.
• MDR offerings can provide 24/7 monitoring but may produce high false positives due to narrow reliance on endpoint telemetry and often do not include remediation.
• Cysiv was founded in 2018 and is based in Irving, Texas, with offices in Ottawa, Cairo, and Pune.
• Cysiv SOCaaS is cloud-native, supports multi-tenancy, and ingests telemetry from any source that generates logs.
• Cysiv SOCaaS integrates with existing SIEM solutions and can provide SIEM functionality where none exists, including normalization to a common information model and tiered storage.
• Cysiv’s consumption-based billing is based on average monthly events per second ingested and the number of users or workloads monitored.
• Cysiv is ISO 27001 and SOC 2 certified.

• “SOCaaS solutions provide the means of demonstrating to auditors a concerted effort to cover all cybersecurity risks and enable a comprehensive and standardized threat detection and response capability.”
• “SOCaaS provides a way of tapping into the benefits of a SOC or additional SOC resources without the challenge of finding and retaining people with the necessary skills.”
• “Essentially, a SOCaaS solution is a type of managed security service (MSS) that is cloud-based, built on a multi-tenant Software-as-a-Service (SaaS) platform, and goes beyond the offerings of traditional Managed Security Service Providers (MSSPs).”
• “The approach of ingesting data from existing security controls means that Cysiv SOCaaS does not use any software agents and provides the opportunity of getting additional value from current security technology investments.”
• “Cysiv SOCaaS is designed to work with what end user organizations have in place.”
• “Where technology gaps are identified, Cysiv will make recommendations on how to improve monitoring coverage.”
• “The Cysiv platform uses data science to convert raw logs and data into detections and security incidents that warrant human investigation.”
• “As a platform-based solution, Cysiv SOCaaS is designed to deliver: Faster, higher fidelity threat detection.”
• “Cysiv recently added a MITRE ATT&CK dashboard that gives users an instant view of their detection coverage.”
• “The highly scalable nature of the Cysiv SOCaaS platform means that it can adapt to changing business needs, especially as organizations grow.”