2021 Devo SOC Performance Report: SOC Leaders and Staff Are Not Aligned

The third annual Devo SOC Performance Report^TM shows that working in a security operations center continues to be painful. Based on an independent survey of more than 1,000 global cybersecurity professionals commissioned by Devo and conducted in September 2021, the report examines current SOC trends and challenges.

The 2021 report presents a new perspective on the challenges facing SOCs and those who work there by comparing and contrasting survey results from 535 SOC leaders and 485 SOC staff. Responses from the two groups often diverge widely, pointing to the vastly different perspectives of leaders and analysts about SOC performance. There are more differences than areas of agreement about what makes a SOC successful, especially in its ability to gather evidence, investigate, and identify the source of threats.

This year’s report, based on a survey conducted by Ponemon Institute, also examines the two types of SOCs — high and low performers. High performers are those with the funding, tools and staff to accomplish most of their cybersecurity goals. Low performers are those SOCs lacking in some or all of the foundational elements required for success, which is why they struggle in the face of myriad challenges. This year’s report provides fresh insights about what separates high- and low-performing SOCs.

The 2021 results show no significant improvement in either overall SOC trends or a reduction in the gap between high- and low-performing SOCs. The continuing challenges for organizations’ cybersecurity programs — particularly when it comes to the pain experienced by those who work in SOCs — keep the job satisfaction and mental well-being of SOC analysts firmly in the spotlight. This year, of course, both SOC leaders and staff also had to deal with the ongoing pandemic and its impact on where and how people work.

Other key results from the report include:

• 73% of overall respondents said their SOC is a key component of their cybersecurity strategy, up slightly from 72% in 2020.
• 72% of respondents rated the pain of SOC analysts at a 7 or above on a 10-point scale. While better than the 2020 number (78%), it remains clear that working in a SOC continues to be far more painful than staff members and organizations can tolerate.
• 63% of respondents said the pain of SOC work led them to consider changing careers or leaving their current job.

There is more work to do to address SOC performance and the many underlying issues adversely affecting it. This report gives SOC leaders and staff, as well as those responsible for their organization’s overall cybersecurity program, a great deal of information to consider as they work to improve SOC performance and reduce the pain experienced by analysts.

Download the 2021 Devo SOC Performance Report report to gain a deeper understanding of the challenges facing SOCs and SOC workers.