What is a co-managed SOC?

The model in one picture

Fully managed means the provider runs everything and escalates to you. In-house means you run everything and own every gap. Co-managed sits between, but it is not a compromise — it is a different allocation of the same work. The provider brings what benefits from scale: the platform, detection engineering across many customers, tuning discipline, and staffed overnight coverage. You keep what benefits from proximity: knowing which server is the crown jewel, which alert is the finance system doing month-end, and who is authorised to approve pulling a segment offline.

What stays in-house

Risk ownership does not transfer — a provider can contain an incident, but deciding what risk the business accepts remains yours. Alongside it stay the approval calls with business consequences, the context that separates anomaly from routine, relationships with auditors and regulators, and any investigation you prefer to keep close. In a good co-managed engagement your analysts also work cases directly on the shared platform, which keeps their skills current instead of atrophying behind a vendor portal.

What the provider runs

The provider carries the platform and its upkeep — collection, correlation, detection content, the SOAR playbooks — plus first-line triage around the clock, so the queue never waits for your morning. They handle the volume work: separating the few real incidents from the noise, containing what is pre-authorised, and packaging escalations with context so your team starts from evidence rather than from a raw alert. They also bring cross-customer pattern knowledge your team cannot get from one estate, which sharpens detection for everyone.

When co-managed beats fully managed

The model earns its keep in three situations. First, when you already employ capable analysts — handing the whole function out wastes them, and co-managing keeps them on the interesting work while the provider absorbs the shift grind. Second, in regulated environments where the organisation wants demonstrable involvement in its own security operation rather than a fully delegated one. Third, as a deliberate maturity path: teams that intend to grow their capability learn faster working real incidents on a shared console than reading a provider's monthly report.

When it doesn't

With no security analysts on staff and none planned, co-managed is the wrong purchase — there is nobody on your side of the split, and you are paying for involvement you cannot supply. It also fails where the split is aspirational rather than written down: if both teams can plausibly believe the other one owns an alert category, one day nobody will own the one that matters. That is not a flaw in the model so much as the model applied without its governance.

A day in the model: one alert, two teams

Concreteness helps, so follow one alert through. At 02:10 the platform correlates an unusual login with outbound traffic to an address with poor reputation and promotes an incident. The provider's overnight analyst triages it, confirms it is not noise, and executes the pre-authorised containment — the host is isolated, the token revoked — because that action sits on their side of the authority matrix. At 08:30 your analyst picks up the same incident on the same console, sees the full timeline including everything already done, and makes the calls that need business context: whether the affected account's projects warrant a wider credential reset, and what the disclosure obligations are. Nobody re-investigates from scratch, and nobody made a business decision at 3am without the business in the room.

Co-managed SOC vs co-managed SIEM

Buyers meet both phrases, and they are not the same offer. Co-managed SIEM shares the platform work — you and the provider both administer the correlation tooling, its rules and its health — but the operational function around it stays wherever it already was. A co-managed SOC shares the operation itself: triage, investigation and response are split across the two teams by agreement. The SIEM variant suits organisations whose pain is platform upkeep; the SOC variant suits those whose pain is coverage and headcount. Price and involvement differ accordingly, so make sure a proposal names which one it is offering.

Governance: the part that decides success

Every successful co-managed engagement rests on the same written artefacts. Agree them during onboarding, not during an incident.

• An ownership matrix: which alert categories, systems and hours belong to which team
• A containment authority matrix: what runs unattended, what needs approval, and whose
• Escalation paths with names and hours — who is woken, by whom, for what severity
• One shared console and one incident timeline, so both teams read the same truth
• A standing review — tuning decisions, false-positive rates, and who owns each follow-up