The SANS Institute has published findings from its 2024 SOC Survey, which provides insights into the current state and challenges of security operations centers (SOCs) worldwide. The survey received 403 responses from around the world, but with the majority (301) being based in the US.
Key findings from the survey include:
- Endpoint detection and response (EDR) stands out as the technology with the highest satisfaction levels amongst respondents with a grade point average (GPA) of 3.1, highlighting its essential role in SOC operations.
- AI generative technologies scored the lowest satisfaction score with a GPA of 1.8, indicating integration and effectiveness challenges within SOC environments.
- Decline in TLS interception: a significant 34% of respondents reported not using any TLS interception to inspect HTTPS or other encrypted communications, up from 25% in 2023, raising concerns about visibility into encrypted traffic.
- 67% of respondents provide metrics to senior management to justify SOC resources. The most common metric is number of incidents handled.
- Capabilities of the SOC are very consistent across almost all respondents. Frequently outsourced items are penetration-testing, forensics, threat-intelligence, and alert triage.
