Where staffing, outsourcing, AI, and automation are improving detection and response—and where complexity is holding teams back.
No two SOCs look the same, but they all face similar challenges: detect earlier, respond faster, and prove it's all working, against a backdrop of a sprawling attack surface, thin staffing, and increasingly complex tool stacks. AI is helping both defenders and attackers scale up, but its long-term impact on defense has yet to fully materialize.
The 11th annual SANS SOC Survey looks at how security operations are being rebuilt to keep pace. This year's research digs into how SOC models are changing, how organizations are splitting work between in-house teams and outsourced partners, and how AI and automation are being woven into detection, investigation, and response. Just as importantly, it asks where these investments are driving better outcomes versus adding unnecessary cost and complexity.
SANS experts and industry leaders will unpack the 2027 findings and turn the data into actionable guidance. Attendees will leave with fresh benchmarks and practical strategies for running a SOC that's more integrated, more efficient, and built around outcomes rather than volume.
Why Join?
- See how your SOC's staffing, tooling, and performance stack up against the field.
- Get a clear-eyed view of where AI and automation are paying off, and where they're not.
- Understand where teams are investing, what's slowing them down, and what modernization looks like in practice.
- Learn how top-performing SOCs define and track detection and response effectiveness.
- Earn 3 CPE credits
