Co-managed SOC: sharing security operations

What co-managed SOC means

In a fully managed SOC, the provider does almost everything and your team mostly receives reports. In a co-managed SOC, the work is deliberately shared. Your people stay involved in investigation and response, keep access to the same console and data, and make the calls that need knowledge of your business, while a vendor SOC provides round-the-clock monitoring, threat hunting and specialist analysts.

The term covers a range of arrangements. At one end, your team handles daytime alerts and the vendor SOC covers nights and weekends. At the other, the vendor SOC triages everything and your team takes over for remediation and business decisions. The common thread is shared visibility and agreed rules about who acts when.

If you are new to the idea, start with what a security operations centre does and how managed SOC services work, then come back here.

Who does what in a co-managed model

With Forever Systems there are three parties, not two. This is a typical split; yours is agreed and written into the quote.

Writing this down before go-live is what makes co-management work. When an alert arrives at 2am, nobody should be wondering whose job it is.

Response modes that keep you in control

The clearest example of co-management in practice is the choice of response mode. Sophos MDR offers three:

• Authorize: Sophos's analysts act to contain a threat and then tell you what they did.
• Collaborate: Sophos investigates but takes response actions only with your consent, with an option to switch to Authorize if nobody responds.
• Notify Only: Sophos sends notifications and takes no containment action; Sophos does not recommend this mode for extended periods.

Collaborate is the natural co-managed choice for teams that want to approve actions, provided someone can be reached at any hour. If your team is not available overnight, the fallback to Authorize stops an attack waiting for a reply. Other vendor services offer similar controls under different names, and most let you set different rules for devices, servers and user accounts. We help you choose settings that match how your team actually works, not how it would like to work. The Sophos MDR page on our Sophos site covers the service in depth.

Co-managed SIEM: Check Point MXDR 360

Co-management is not only about endpoint alerts. When Check Point launched MXDR 360 in July 2025, it described the package as adding a fully managed SIEM and an enterprise-grade security data lake for long-term retention, run within a co-managed SOC framework. MXDR 360 sits above Check Point's MDR package (24/7 detection and response using endpoint agents and APIs) and MDR 360, which the launch announcement said adds identity threat detection, broader data integrations and access to Check Point's XDR platform.

That suits organisations with their own security analysts, or a compliance need for central logging, who want Check Point's team running the SIEM and its detections while they keep access to the data. Check Point's own pages describe the package contents in slightly different ways, so we confirm exactly what your contract includes before you sign. See Check Point MDR for the package details, and SIEM as a service for the other SIEM options we supply.

Co-managed vs fully managed SOC

The choice between co-managed and fully managed is mostly about how much your own team wants, and is able, to do.

Neither is better in the abstract. Many organisations start fully managed and move towards co-management as their own security capability grows, or the reverse when a key person leaves. We review response settings with you as your team changes, and confirm with the vendor how a change of response mode is handled during the contract. If you are still comparing service types, MDR vs SOC vs SIEM sets out the differences, and our guide on how to choose an MSSP lists the questions to ask any provider.

Who a co-managed SOC suits

Co-management works best when you have some in-house capability and want to keep it:

• IT teams with security skills who can investigate in working hours but cannot staff nights and weekends
• Organisations with an internal security lead who wants analysts' findings in their own console, not just in a monthly report
• Regulated organisations that must show they oversee third parties and understand incidents, such as those under the NIS Regulations or FCA operational resilience rules
• Businesses with sensitive operations where some response actions need a business decision, such as isolating a production server

If your IT team is small and already stretched, a fully managed service with Authorize-style response is often the safer choice: co-management only helps if someone on your side has the time to take part.

Making co-management work

Shared models fail when responsibilities are vague. These steps make the difference:

1. Agree a RACI for monitoring, triage, containment, remediation, communications and reporting.
2. Set response authority per action type: devices, servers, user accounts and cloud services.
3. Name contacts for working hours, evenings, weekends and holidays, with a fallback when the first contact does not answer.
4. Give your team access to the vendor console, cases and reports, with sensible permissions.
5. Review regularly: look back at cases, false positives and recommendations, and adjust rules as people and systems change.

We set this up with you at onboarding and can run the reviews. The detail, including which of these Forever Systems handles, is confirmed at quote. When you are ready, contact us to talk through a co-managed model.