Capability tracks
SOCRoot is in pre-production validation. The tracks below describe work that can be scoped and evaluated; they are not a public managed-SOC SLA, an unattended remediation promise, or a claim of regulatory certification.
Status notice
Pricing, response times, uptime commitments, and production coverage are agreed only in a written, scoped engagement after technical and operational validation. This page intentionally publishes no default SLA or checkout flow.
A bounded review of approved external assets with explicit ownership, exclusions, evidence handling, and acceptance criteria.
A lab or pilot workflow connecting alerts, enrichment, human approval, response proposals, and an evidence trail.
A structured comparison between current technical evidence and selected security-control objectives. It is not certification or legal assurance.
Practical training content and exercises that can support an organization’s program but do not constitute an accredited certification.
Engagement gates
Work should stop when authorization, evidence handling, or rollback conditions are unclear. These gates are not optional process overhead; they define whether the work is professionally defensible.
Next step
Describe the asset owner, the decision you need to support, the environment, and the evidence you expect. SOCRoot will not accept work that lacks authorization or requires unsupported production guarantees.