Summary
The SANS 2023 SOC Survey is a technical report detailing the findings from the seventh annual survey conducted by the SANS Institute. The report outlines new areas of focus, including operational threat hunting, threat intelligence, data ingestion into SIEM, and SOAR, while also examining staff hiring and retention. Key findings indicate that over 75% of respondents detected incidents before external notification, with 84% of SOCs collecting metrics on incidents. The report discusses the importance of continual tuning of SOAR by skilled analysts and highlights the traditional IT model of SOC funding. Additionally, it presents insights into the demographics of respondents, the allocation of budgets, and the challenges faced by SOC managers in demonstrating the value of cybersecurity investments. The report emphasizes the need for qualified personnel to operate a SOC and provides data on the typical size of SOC teams. Overall, it serves as a comprehensive resource for understanding current trends and challenges in the security operations center landscape.
