SOC/Detection Maturity Review
Two-day review of your SOC and detection chain. Not how many alerts come in. Whether the right alerts lead to action in time.
What it delivers, recognisable per role.
For the CISO
An independent verdict on whether the detection chain covers what it should. And where the blind spots are.
For the SOC manager
Insight into where the team loses capacity to noise. And where the actual detection gaps are.
For the Head of IT
A telemetry review. Which logs are missing, and which deliver nothing.
For the CFO
Insight where the SOC investment yields return. And where money disappears into tooling that does not contribute.
For the detection engineer
Independent peer review of detection rules. Which work, which produce noise.
For the board
An independent verdict on whether the detection function delivers what is expected of it. Not whether the tooling works, whether the organisation steers it.
Many alerts is not the same as good detection.
Most SOC teams drown in alerts while the real attacks disappear in the noise. The question is not whether the dashboard blinks. Whether the right signals lead to action at the right moment. We test whether that is the case.
A review on process, telemetry and team.
- Final report with findings on three core dimensions: process, telemetry, team.
- A list of detection gaps, weighted on actual attack relevance.
- Concrete recommendations to reduce noise and increase relevance.
- A prioritisation with the first three improvement steps.
Four phases, three weeks duration.
Intake
Short session in which we determine scope and environment. Which SOC functions, which vendors, which interlocutors.
Investigation
Two-day review with SOC manager, detection engineers and IT. Plus a sample of detection rules and alerts.
Analysis
We weigh findings against current attack techniques and the existing detection chain.
Report
Final report with grounded findings and concrete follow-up steps. Within three weeks of intake. Including debrief.
A scoped review. Not an open-ended track.
A SOC/Detection Maturity Review is a scoped investigation. Not an open-ended track. Duration is three weeks from intake. The investment depends on scope (number of SOC functions, vendors, available telemetry). We discuss that in a first conversation.
Rasham Rastegarpour
Senior detection architect. Spent years vendor-side at ReliaQuest, Blackberry-Cylance and Balbix.
Knows the detection market from the inside. Runs the review and writes the report in person.
30 minutes. No pitch. Clarity.
In a first conversation we determine whether a SOC/Detection Review fits your question.