Question 1

Do you hold an NCA MSOC licence?

Accepted Answer

We deliver monitoring together with an NCA-licensed MSOC partner rather than holding the licence ourselves. This matters because NCNICC-1:2025 and ECC-2:2024 both expect outsourced monitoring and escalation arrangements to involve a licensed provider. We are direct about the structure because it is the first thing a Saudi buyer should check, and any provider who is vague about it is worth a second question.

Question 2

Is SOC as a service the same as managed SOC or MDR?

Accepted Answer

They describe the same service from different angles, which is why buyers see all three terms. SOC as a service and managed SOC both mean the monitoring function is run for you rather than staffed in house. MDR, managed detection and response, is the term that emphasises the response half: analysts who triage alerts and take agreed containment actions, not just a feed of alerts. What matters when comparing providers is not which label they use but whether analysts act on what they see, and what they are pre-authorised to do at 03:00.

Question 3

How do EDR, XDR and MDR relate to each other?

Accepted Answer

EDR and XDR are tooling categories; MDR is a service. EDR watches endpoint telemetry and XDR extends that correlation across endpoint, identity, network and cloud. Either can generate alerts nobody reads. MDR is the layer where analysts triage that output and act on it, which is the part that turns telemetry into detection. We monitor endpoint, identity, network and cloud telemetry, so the tooling category matters less than whether the coverage matches your estate.

Question 4

What is the difference between MDR and a SIEM?

Accepted Answer

A SIEM is a tool that collects and correlates logs. MDR is a service where analysts watch the output and act on it. Buying a SIEM without the people to run it is the most common way organisations end up with an expensive log archive and no detection capability. If you already own a SIEM, we can often work with it rather than replacing it.

Question 5

What detection tooling do you use?

Accepted Answer

AI-driven detection tooling from an established North American security vendor, combined with analyst triage. We deliberately do not build the service around a single product name, because the tooling changes faster than the service does and the value is in the detection content and the response process rather than the logo.

Question 6

How quickly do you respond?

Accepted Answer

Response targets are agreed per engagement and written into the service description rather than left implied. Ask any provider for time to acknowledge, time to triage and time to contain as separate numbers, because a single blended response time usually hides the one that matters.

Question 7

Does this satisfy the NCNICC logging and monitoring control?

Accepted Answer

It addresses it directly, and produces the evidence a review asks for: log sources in scope, retention configuration, and records of review and escalation. It does not on its own make you NCNICC compliant, since monitoring is one control area among the mandatory set. The readiness assessment shows where the rest stand.

Question 8

Can you monitor cloud as well as endpoints?

Accepted Answer

Yes. Cloud control plane and identity telemetry are usually where the earliest signal of a compromise appears, often before anything reaches an endpoint. Cloud coverage is part of scoping rather than an add-on.

SOC as a Service for Saudi Organisations

What the service covers

24x7 Detection

Response, Not Just Alerting

Regulatory Evidence

Licensed Monitoring Path

Why organisations move to a managed model

Out-of-Hours Is the Gap

Hiring a SOC Is Not Realistic

The Control Is Explicit

Tooling Alone Does Not Detect

How onboarding runs

Scoping & Log Sources

Deployment & Tuning

Response Playbooks

Go Live

Find out whether monitoring is your gap

Related services

Incident Response

Cloud Security

Cybersecurity Audit

Managed SOC and MDR FAQ