Why Most SOC Builds Fail
Organisations budget ₹2-5 crore for a SOC, buy a tier-1 SIEM, hire 10 analysts, and still get breached within a year. The tools aren't the problem. The processes and training are.
The ₹50 Lakh Blueprint
Phase 1: Detection Stack (₹15L)
- Wazuh SIEM (open-source) + ELK stack
- Endpoint agents on all servers
- Network flow analysis with Zeek
Phase 2: People (₹25L)
- 2 Tier-1 analysts (24/7 rotation with a partner MSSP)
- 1 Tier-2 analyst + IR lead
Phase 3: Process (₹10L)
- Playbook development for top 20 alert types
- Tabletop exercises quarterly
- Threat intelligence subscription
The Result
Following this blueprint, a 500-person fintech achieved ISO 27001 certification and reduced MTTD from 72 hours to under 4 hours, all under budget.