Skip to content
logo

Download the 2025 SANS SOC Survey Report

For nine years, the SANS Institute has conducted an annual industry survey analyzing how security operations centers are built, staffed, and managed globally. The 2025 edition, authored by SANS Senior Instructor Christopher Crowley, synthesizes responses from security professionals across 57 countries to reveal critical trends shaping modern SOCs.
 

What the Data Reveals

This year's survey uncovers striking realities about the current state of security operations:
  • 79% of SOCs now operate 24/7, yet 69% still rely on manual processes for reporting metrics
  • 62% of security professionals say their organizations aren't doing enough to retain top talent
  • 42% of SOCs dump all incoming data into SIEMs without retrieval plans, creating future visibility challenges
  • AI/ML adoption paradox: While 40% use AI/ML tools, satisfaction scores rank these technologies at the bottom

Download the Report to Discover:

SOC Structure & Operations

  • Baseline SOC capabilities and the most common team size (10 FTEs)
  • Which functions organizations keep in-house vs. outsource
  • How cloud migration is reshaping SOC architectures

Technology Performance Analysis

  • Why EDR/XDR remains the only technology scoring above 3/4 in satisfaction
  • The disconnect between AI/ML investment and actual value delivery
  • Critical gaps in threat intelligence utilization

Staffing & Retention Insights

  • The skills SOC managers seek most when hiring (SIEM expertise leads at 43%)
  • Why tenure averages just 3-5 years and what drives retention
  • Remote work realities: 73% allow it, but not for all roles

Operational Benchmarks

  • How your incident response capabilities compare to peers
  • The truth about "threat hunting" practices across the industry
  • Budget awareness gaps: 42% of SOC staff don't know their department's budget

Make Data-Driven Decisions for Your SOC

Whether you're evaluating your team's performance, planning technology investments, or building a business case for additional resources, this report provides the peer benchmarks and industry context you need.

Written by Christopher Crowley, a 25-year industry veteran and leading SOC expert, this report distills complex operational data into actionable insights for security leaders and practitioners alike.

Get your complimentary copy of the 2025 SANS SOC Survey today.

Download the Report