SOC Maturity Model: Stages, Costs, and How to Assess Yours

A SOC maturity model, also called a security operations center maturity model, is a framework for scoring how consistently a SOC runs. It should measure how your SOC operates, yet it often turns into a procurement list: buy a SIEM, add SOAR, start hunting, build a dashboard.

Then the self-assessment comes back at a 3, and the next quarter goes to arguing about the alerts nobody looked at over the weekend. Tooling is usually the cheapest part of maturity to acquire and the least informative part to score.

The stages differ in how much telemetry reaches a detection, who decides an alert is benign and on what evidence, what runs without a person, when hunting starts, and what you can prove to an auditor. The sections below cover each stage, where the cost steps up twice, how to run an honest assessment, and where AI and outsourcing change the path.

TL;DR:

• SOC maturity measures how consistently the SOC operates, so an expensive stack can score low and a modest one can score high.
• In most build models, costs step up twice: once when coverage moves from business hours to 24/7, and again when detection engineering and hunting become dedicated roles.
• Self-assessments tend to run high, and the honest signals are how much telemetry feeds a detection and how many investigations close without an open question.
• AI can make the documentation side of maturity fast but leaves telemetry, organizational context, and process ownership for people to build, so an AI-assisted SOC still has to earn each stage in order.

What a SOC Maturity Model Is For, and How the Frameworks Define It

A security operations maturity model should set a target level that fits your risk and budget, which SOC-CMM notes is not necessarily the highest level. The frameworks differ mainly in how they score progress toward it.

SOC-CMM, the SOC Capability Maturity Model and the SOC-specific reference, is at model v2.4, with no new version planned for 2026, and covers five domains: business, people, process, technology, and services. It scores maturity on a continuous zero-to-five scale across all five, and separately scores capability, on a zero-to-three scale, for technology and services only.

CMMI V3.0, released in April 2023, is the staged alternative with nearly the same level names. CMMI sets the overall level to the lowest level an organization fully satisfies, while SOC-CMM keeps the average score.

NIST's CSF 2.0 Tiers describe the rigor of organizational risk governance, and SOC-CMM publishes a mapping to the CSF. MITRE's 11 Strategies guide, published in 2022, treats its capability table as a catalog, notes that few SOCs cover every capability in it, and suggests using the table to account for the SOC's activities in aggregate.

Anton Chuvakin describes the maturity models he built at Gartner as "vaguely CMM-shaped," and his current post walks through ad hoc, defined, managed, and optimizing levels. The five stages below are this article's working model, built from Chuvakin's levels plus a measured stage drawn from SOC-CMM's Quantitatively Managed level. They are not SOC-CMM scores or certification levels, so use the model itself for formal assessment. SOC-CMM and CMMI also put Managed before Defined, so map the labels before you benchmark.

The Five Stages: What Changes and What It Costs

The expensive transitions typically add people and shifts, and licenses are the smaller line in a first 24/7 build. Each stage below starts with the operating change and then the spend. The SOC-CMM certification controls cited along the way illustrate the evidence a maturing SOC keeps, and they sit on their own scale. The Defined certification level, for instance, already asks for MITRE ATT&CK-mapped detections and a defined detection engineering process.

1. Ad Hoc

Coverage is whatever someone turned on, or as Chuvakin sums up his first level: "Some logs, some alerts, heroics." Investigation depth depends on who is awake, and hunting has no program. Spend is mostly the salaries and endpoint licensing that already exist; the hidden cost is that institutional memory often lives with one or two people.

2. Defined

A SIEM runs intentional use cases, triage is documented, and an IR plan sets first response, while alert review stays manual. At its Defined certification level, the SOC-CMM certification scheme asks for a documented detection technology architecture and named ownership of the monitoring platform.

The first ingestion bill arrives too. Microsoft Sentinel's generally available commitment tiers start at 100 GB/day, which Daylight's June 2026 estimate prices at $108,000 to $127,600 a year depending on region. Splunk licensing also scales with ingest volume and contract terms; price it from a current quote for the intended workload. Per-GB pricing can tempt teams to filter logs and open detection gaps.

3. Managed

Use cases map to ATT&CK, log-source health monitoring alerts on volume drops, SOAR handles routine tasks, and hunting runs on a cadence. MITRE's guide recommends adding hunting once incident response has matured, and detection engineering becomes a dedicated role. A build typically gets expensive here, because both large cost steps, 24/7 coverage and specialist headcount, land in the move to this stage.

4. Measured

In SOC-CMM's model, the Quantitatively Managed level adds regular measurement, evaluation, and formalized reporting. At the Validated certification level, the scheme adds monitoring of data-source ingestion and coverage, a measured detection engineering process, and testing of ATT&CK techniques to validate detections. In SOC-CMM's 2025 data, 64% of respondents had no metrics program and only 3% had one implemented and optimized. Spend goes to validation tooling and KPI collection.

5. Optimized

Hunting feeds detection in a continuous loop. Splunk's PEAK threat hunting framework recommends turning hunts into detections so the team stops re-running them by hand. SOC-CMM cautions that this level takes significant effort to reach and sustain.

The table condenses each stage's operating traits and the work that moves a SOC to the next one, drawing on Chuvakin's levels, the SOC-CMM certification scheme, and per-level trait lists from Ampcus.

‍

SOC Economics: Where the Costs Jump

The move from business hours to 24/7 is usually the largest single step, and it is a headcount step before a tooling step. Covering one seat around the clock takes 4.2 FTEs at a 40-hour week before any absence, and closer to five once PTO, sick leave, and holidays are counted.

Two people per shift for escalation redundancy puts the operations layer at eight to 10, and adding two detection engineers, a security engineer, and a SOC manager brings a functioning operation to 12 to 14. Daylight estimates roughly $1.5M to $2.86M a year for an illustrative minimum viable 24/7 in-house SOC, and geography, staffing mix, telemetry volume, and existing tooling all move the number. Salaries usually make up most of the bill, with the BLS median for U.S. infosec analysts at $129,180 in May 2025.

Specialist headcount is the second step. Decryption Digest recommends a planning ratio of one detection engineer per five to seven SOC analysts, with a minimum of two. Each specialist role, whether threat intelligence, security engineering, or a hunt team, adds another salary on top of the operations layer. SOAR carries its own labor bill: Torq, a vendor that sells a SOAR alternative, puts dedicated engineering headcount at $400K to $600K+ a year in loaded cost, plus ongoing integration and maintenance work.

How to Run a SOC Maturity Assessment That Survives an Audit

A self-score is best treated as provisional until operational evidence backs it. In SOC-CMM's 2026 data, self-assessments averaged 0.6 maturity points higher than third-party assessments, a group-level gap that does not tell you how far any single SOC has overrated itself.

The SOC-CMM self-assessment tool, currently version 2.4.2, supplies the questionnaire, and its free basic version contains the full assessment. Evidence comes next: a governance process description and an approved SOC RACI at the Defined certification level, plus critical-asset documentation if you aim for the Risk-driven certification level.

DeTT&CT, now at version 2.2.0, scores data-source quality, visibility, and detection coverage per ATT&CK technique. A log source inventory rounds out the inputs, and it matters because Kaspersky's SOC consultants see only about half of ingested telemetry used for threat detection across their assessment projects.

Use complementary metrics that make gaps visible, and read them together so no single number gets optimized at the expense of investigation quality:

• The share of ingested telemetry that feeds a detection, and the share of detections with a named owner
• Closure quality: how many alerts closed as false positives were checked before closing
• Escalation rate, which shows how much work still needs a handoff
• Alert backlog over time, since a growing queue of uninvestigated alerts means the SOC is running past its capacity
• Executed hunts against planned hunts, for which SOC-CMM gives an example target of 100%
• Investigations completed without an unresolved unknown, a fraction Chuvakin calls "far more honest than any maturity model"

Number of incidents handled is a weak measure of effectiveness on its own. It has been the top SOC metric for 10 consecutive years, cited by 70% of respondents in the SANS 2026 SOC report. The report notes that it measures activity volume, which says little about whether the right threats were caught early. Outcome measures such as dwell time trends and investigation rework rate say more about which stage a SOC has reached.

AI Security Operations Maturity: Which Stages AI and Agents Compress

AI can speed up the artifact work of maturity, including documentation, parsers, baseline detections, and dashboards. Mapped to this article's stages, AI and agentic tooling shorten the documentation-heavy climb to Defined and the tooling work of Managed, but they do little for the telemetry coverage stage 1 lacks or the evidence stage 4 demands.

Chuvakin writes that AI "can generate the paperwork of a mature SOC in an afternoon," but reliable telemetry, process ownership, knowledge of the environment, and earned trust in automation still have to be built in order. For the most part, he concludes, levels can't be skipped, and an agent working over gappy telemetry produces confident but wrong conclusions at scale.

Context, more than model capability, is often the binding constraint, and analysts outside the vendor camp say so too. Gartner VP Analyst Tori Paulman called context one of the most critical differentiators for successful agent deployments in October 2025, when the firm introduced its 2026 technology trends. People usually have to capture and own organizational context, the policies and exceptions that define normal, before an agent puts it to work.

AI adoption is running ahead of integration. Among the SOCs in the same SANS report, 79% use AI or ML tools but only 36% have integrated them into a defined SOC workflow. An AI-assisted SOC that cannot show what each investigation checked and why can easily automate its way out of stage 4.

Decision Criteria: Build the Stage or Buy It

Outsourcing can add 24/7 coverage faster than hiring, but the measured stage still needs someone on your side who owns the evidence. Use these conditions to decide which parts to buy:

• If you cannot staff and retain eight or more operations FTEs, outsource the coverage layer, because staffing is usually the binding constraint on a build.
• If the foundation is ad hoc, with no SIEM and nobody watching alerts, start with a managed service and add an in-house build once that foundation is solid.
• If legal obligations prohibit third-party access to security telemetry, keeping the SOC in-house is usually the safer path.
• If you run a small in-house team and the target is stage 4, contract detection engineering ownership explicitly, since providers differ on who writes custom detections and whether that work transfers when the contract ends.
• If you buy, read the contract for service liability and in-scope response obligations, and ask for exportable investigation records, because the measured stage is an evidence problem and a provider that hides its decisions makes it hard to assess.

Check these conditions against a third-party SOC-CMM score. Detection engineering ranks among the biggest maturity challenges in SOC-CMM's 2025 report, and it is the aspect a stage-4 target depends on.

The Shift From Buying Coverage to Buying Investigation Depth

Round-the-clock coverage is usually the first hurdle out of stage 2: someone watching alerts at 3 a.m. For a small SOC, the harder stage-3 question is who investigates those alerts and records the evidence.

By Daylight's estimate, an in-house 24/7 SOC takes six to 18 months from budget approval, with an average of seven months to fill each vacancy, while a managed service typically starts in weeks. For SOCs of two to 10 people, the most common fully staffed size in the SANS 2025 SOC Survey, that hiring gap makes managed coverage a practical way to add capacity.

Managed options take on different shares of that work. Traditional managed detection and response (MDR) providers investigate agreed-upon alerts and respond within an agreed scope, though organizational context, including policies and exceptions, can remain a gap. AI SOC tools automate triage and investigation but leave response and accountability with your team, so they sit on the build side. AI-native MDR providers pair agentic investigation with an expert team under contract.

A managed service adds investigation and response capacity without equivalent internal hiring, and how much it adds to maturity depends on scope, evidence quality, detection ownership, and how you govern the service. Daylight is a MASS company, meaning it offers managed agentic security services for Security Operations. Its AI-native MDR is one example of that service model.

Frequently Asked Questions About the SOC Maturity Model

Is SOC-CMM Certification the Same as a SOC-CMM Maturity Level?

No. Certification has three levels (Defined, Validated, Risk-driven) built on 127 controls, and the published scheme still rests on model v2.3; SOC-CMM's May 2026 report said a v2.4 certification update would follow during the year. A level-3 self-score does not imply the Defined certificate.

Which Stage Do Compliance Regimes Actually Require?

None of the three regimes covered here specifies a maturity level, but several presume detection outside business hours. NIS2, adopted in 2022, requires an early warning within 24 hours of becoming aware of a significant incident. DORA's incident reporting rules require an initial notification within four hours of classifying an incident as major and no later than 24 hours after becoming aware of it, with set exceptions for later classification and weekends. PCI DSS v4.0.1 requires personnel available 24/7 to respond to suspected incidents and automated audit log reviews. These obligations tend to push a SOC toward 24/7 coverage without establishing any maturity level.

Does Cyber Insurance Underwrite Against Maturity?

Indirectly, through specific controls such as continuous monitoring. Coalition offers premium credits of up to 12.5% to eligible policyholders using qualifying MDR services, a credit tied to the service and not to any maturity score.

How Do I Benchmark My Score Against Peers?

With caution, because average scores do not show what share of SOCs sits at each level. SOC-CMM's 2026 report publishes averages by region, sector, and SOC size and no distribution by level. A more useful benchmark is the set of aspects the report names as hardest, which include Charter, Knowledge management, Cyber threat intelligence, and Threat hunting.

Does Threat Hunting Need Its Own Maturity Track?

Yes, because hunting runs into its own data and measurement problems. In the SANS 2026 Threat Hunting Survey, 40% of organizations formally measure hunt outcomes, down from 64% in 2024, and data quality or quantity has overtaken skilled staff as the top barrier. Elastic's Detection Engineering Behavior Maturity Model complements a hunting assessment by tracking detection engineering behaviors, including how hunting findings feed detection rules.