Security Operations Assessment
Evaluating Detection, Investigation, and Response Capability Across Your SOC with a Structured Maturity Model
Most security operations centers can tell you they have a SIEM, an EDR tool, and a team that monitors alerts. Very few can tell you what percentage of their environment generates security telemetry, which ATT&CK techniques they can detect, or how long it takes to move from alert to containment. This assessment answers those questions.
The evaluation covers six domains — Visibility & Log Coverage, Detection Engineering, Alert Management, Investigation Capability, Incident Response Process, and Metrics & Governance — scored against a five-level maturity model. Every score is grounded in evidence from 4 to 8 stakeholder interviews, configuration review, and process documentation analysis. No surveys. No self-assessments.
The output is not a theoretical capability model. It is a concrete gap analysis with a prioritized improvement roadmap that maps maturity improvements to specific, actionable initiatives — what to fix first, what to build next, and what to defer.
Who This Is For
Ideal clients for this engagement.
The Problem
What this engagement addresses.
Unknown Detection Coverage
The SIEM ingests logs, but no one has mapped what those logs actually detect. ATT&CK coverage is unknown, and critical techniques go unmonitored because no one has inventoried the gap between log sources and detection rules.
Alert Fatigue Without Metrics
Analysts process hundreds of alerts per shift with no data on true-positive rates, mean time to investigate, or alert-to-incident ratios. Tuning decisions are reactive — driven by complaint volume, not measured effectiveness.
Incident Response Exists on Paper Only
IR playbooks were written during a compliance push and never operationalized. When an incident occurs, response depends on whoever is on shift, not a repeatable, tested process.
No Baseline for Investment Decisions
Security leadership cannot articulate current SOC maturity in a way that connects to business risk. Budget requests lack the evidence base to survive executive scrutiny.
Visibility Gaps Across Hybrid Infrastructure
Cloud workloads, SaaS applications, and OT/IoT environments generate telemetry that never reaches the SIEM. The SOC monitors what is easy to collect, not what matters most.
Assessment Coverage
What we test — systematically.
Log source inventory across on-premises, cloud, SaaS, and endpoint. Gap analysis against critical asset coverage and ATT&CK data source requirements. Telemetry quality assessment.
Detection rule inventory, ATT&CK technique mapping, rule quality review, false-positive analysis, detection-as-code maturity, and threat intelligence integration.
Alert volume analysis, triage process review, escalation criteria, true-positive rates, alert routing logic, and analyst workload distribution.
Analyst tooling and access, investigation workflow maturity, evidence collection processes, forensic capability, and cross-system correlation.
IR playbook coverage and operationalization, communication protocols, containment and eradication procedures, post-incident review process, and lessons-learned integration.
KPI definition and tracking, reporting cadence, SOC performance dashboards, shift management, knowledge management, and continuous improvement processes.
Deliverables
What you receive.
Assessment Report
Detailed findings across all six domains with evidence-based maturity scores, gap analysis, and specific improvement recommendations. Each finding tied to stakeholder interview evidence and configuration review.
Executive Summary
Board-ready summary of overall SOC maturity posture, critical gaps, risk implications, and prioritized investment recommendations. Written for security leadership and executive audiences.
Log Coverage Gap Analysis
Complete inventory of current log sources mapped against critical assets and required ATT&CK data sources. Identifies blind spots by environment tier — what is collected, what is missing, and what matters most.
Detection Coverage Mapping
Current detection rules mapped to MITRE ATT&CK techniques. Visual heat map of coverage versus priority threat scenarios. Identifies detection gaps for the techniques most relevant to the organization's threat profile.
Domain Maturity Scorecard
Five-level maturity score for each of the six assessment domains with scoring rationale, peer benchmarking context, and target state recommendations.
Improvement Roadmap
Prioritized, phased roadmap of initiatives to advance maturity across each domain. Quick wins, medium-term projects, and strategic initiatives with effort estimates and dependency mapping.
Methodology
How the engagement works.
Scoping & Discovery
Week 1
- Define assessment scope — environments, teams, and tools in scope
- Collect existing documentation: playbooks, architecture diagrams, org charts, SIEM configuration exports
- Schedule 4–8 stakeholder interviews across SOC, IR, engineering, and leadership
- Establish evidence collection requirements
Interviews & Technical Review
Weeks 2 – 3
- Conduct stakeholder interviews across all six assessment domains
- Review SIEM log source configuration and detection rule inventory
- Analyze alert volume, triage workflows, and escalation patterns
- Review IR playbooks and post-incident documentation
- Assess metrics collection and reporting processes
Analysis & Scoring
Week 4
- Score each domain against the five-level maturity model
- Build ATT&CK detection coverage map from rule inventory
- Develop log coverage gap analysis against critical assets
- Draft improvement roadmap with prioritization
Reporting & Debrief
Week 5
- Deliver assessment report, executive summary, and all deliverables
- Live debrief session with SOC leadership and stakeholders
- Roadmap walkthrough and initiative prioritization discussion
Engagement Tiers
Scoped to your architecture.
Focused
Single SOC team or single environment (e.g., cloud-only or on-premises-only). Covers all six domains at standard depth. 4 stakeholder interviews.
- Six-domain maturity assessment
- Log coverage gap analysis
- Detection coverage mapping
- Domain maturity scorecard
- Improvement roadmap
- Executive summary
Standard
Full SOC operations across hybrid infrastructure. 6–8 stakeholder interviews. Includes MSSP/MDR relationship review if applicable.
- Everything in Focused
- MSSP/MDR effectiveness evaluation
- Cross-environment visibility analysis
- Extended stakeholder interview coverage
Comprehensive
Multi-site or multi-SOC operations with complex tool ecosystems. Extended interview schedule and deep-dive into automation, orchestration, and threat hunting maturity.
- Everything in Standard
- Threat hunting capability assessment
- SOAR and automation maturity review
- Multi-SOC coordination evaluation
- Tool consolidation opportunity analysis
Prerequisites
- No privileged access to systems or tools is required
- Access to SOC leadership and analysts for stakeholder interviews
- Existing documentation: playbooks, org charts, tool inventory, architecture diagrams
- SIEM detection rule export and log source inventory (or access to generate these)
Frequently Asked Questions
Common questions.
Do you need privileged access to our SIEM or security tools?
No. The assessment is conducted through stakeholder interviews, documentation review, and configuration exports. We do not require administrative access to your SIEM, EDR, or SOAR platforms. If you can provide read-only dashboard access or configuration exports, that accelerates the technical review, but it is not required.
How is this different from an MSSP or MDR vendor's assessment?
MSSP and MDR assessments are designed to justify their own services. This assessment is vendor-independent — the output is an honest maturity evaluation and improvement roadmap, whether that roadmap leads to in-house investment, co-managed services, full outsourcing, or a combination. We have no monitoring services to sell.
What maturity model do you use?
A five-level model (Initial, Developing, Defined, Managed, Optimizing) applied consistently across all six domains. Each level has specific, observable criteria — not subjective judgment. Scores are grounded in interview evidence and configuration review, not self-reported surveys.
Related Offerings
Often paired with this engagement.
SOC Build & Transformation
End-to-end SOC design and build for organizations that need to act on assessment findings — operating model, detection rules, playbooks, and maturation roadmap.
SIEM & Detection Engineering
Focused engagement to close detection gaps identified in the assessment — custom rules, ATT&CK coverage expansion, and alert tuning.
Security Tool Evaluation
Vendor-independent tool selection if the assessment reveals tooling gaps or consolidation opportunities.
Vulnerability & Exposure Management
Builds the vulnerability management program that feeds findings into SOC detection and response workflows.
Ready to discuss this engagement?
30-minute discovery call. We will discuss your application architecture, your specific concerns, and whether this assessment is the right fit.