It’s 1:40 a.m. at a small accounting firm, and one work laptop is still switched on in the dark office. Its security software flags a program nobody installed. The account tied to that laptop has just signed in from a city no one at the firm is visiting. A few minutes later, a second account logs in from a cloud data center and starts reading invoice records.
The alerts go off. The office manager who normally watches the console is asleep, which is reasonable, since it’s 1:40 a.m.
One of those two sign-ins is almost certainly harmless. The firm set up an AI bookkeeping agent last quarter, and reconciling invoices overnight is its whole job. The other might be a break-in. Somebody has to tell them apart, and preferably before anyone arrives for coffee.
Small and mid-sized businesses increasingly hand that job to a managed security operations center (SOC). Some buy a narrower version called managed detection and response (MDR), sold by vendors such as ESET. Below is a plain-English look at what these services do, what they catch, and why AI, on both sides of the fight, has changed what you need to tell them.
First, What Is a Managed SOC?
A security operations center is a team that watches an organization’s systems for signs of attack and steps in when it finds one. “Managed” just means someone else runs it. You pay a provider, usually called a managed security service provider (MSSP), instead of hiring your own night shift. Most small firms couldn’t staff one anyway.
The tooling has a few layers:
- SIEM (security information and event management) collects activity logs from across your systems and flags odd patterns.
- EDR (endpoint detection and response) sits on each laptop and server, watches for suspicious behavior, and can cut a device off from the network.
- Threat intelligence feeds supply fresh data on known attackers and bad websites.
- AI-assisted triage sorts the thousands of alerts all this generates, so analysts see the urgent ones first.
Then there are the analysts themselves, and they’re the bit you’re really paying for. Software is good at noticing that a sign-in looks strange. It’s much worse at deciding whether the cause is a criminal, a sales rep at a conference in Denver, or an AI agent doing its rounds. Honestly, so are most exhausted office managers.
Attackers Have AI Now. It’s Less Dramatic Than You’d Think
Verizon’s 2026 Data Breach Investigations Report found ransomware in 48% of the breaches it studied, up from 44% the year before. Exploiting unpatched software became the most common way in, at 31% of breaches. Credential abuse fell to 13%, though some of that drop comes from Verizon counting pretexting separately for the first time. Stolen credentials still turn up somewhere in 39% of breaches, so nobody should retire their password manager.
The AI findings are the surprising bit. Verizon looked at how threat actors misuse AI tools and found that fewer than 2.5% of AI-assisted attack techniques were rare or novel. Criminals mostly use AI to run the old playbook faster and in bulk. Phishing accounted for 44% of AI-assisted initial access, and exploitation for 32%.
So the threat looks familiar: ransomware, phishing, account takeover, exploited software, malware, and the occasional insider who clicks the wrong thing. What’s changed is the pace. When attacks move faster, the minutes between an alert firing and a qualified person acting on it matter more than they used to. That gap is exactly what a managed SOC sells.
There’s a compliance angle too. Rules like HIPAA (health data) and PCI DSS (card payments) expect monitoring and records, and a managed SOC produces both as a by-product of doing its job.
The Night Shift’s Newest Headache: Your Own AI Agents
Back to the accounting firm and its invoice bot.
The agent runs under a service account, connects from a cloud provider’s servers, and reads financial records at 2:40 a.m. Now imagine an analyst who has never been told it exists. From where they sit, that’s account takeover by the book: wrong hour, unfamiliar location, sensitive data.
Their options aren’t great. Suspend the account and month-end close grinds to a halt. Let it run and maybe miss a real intruder hiding in the same noise.
AI agents use real credentials, move at machine speed, and mostly work when nobody’s watching. That makes them a new source of false alarms. It also makes them a target, because an attacker who hijacks an agent gets everything the agent was allowed to touch. It’s one reason limiting what agents can reach has become its own security discipline.
The practical fix is an inventory you hand to your provider. Note what each agent does, which account it uses, where it signs in from, and when it usually runs. It takes an afternoon to write. Without it, the analyst is guessing. With it, they can wave the invoice bot through in seconds and spend their attention on the laptop running mystery software.
A Night in the Life of an Alert
Most providers work through the same loop. They monitor your devices, accounts and network around the clock. When something looks off, an analyst investigates whether it’s a genuine threat or something boring, like a scheduled update. If it’s real, they act within whatever permissions you’ve agreed, such as isolating a laptop or disabling an account, and then they call you. Afterwards come regular reports on what they found and what still needs fixing.
Here’s how the accounting firm’s night plays out with a provider that has the agent list. The analyst checks the cloud sign-in, matches it to the invoice agent, and moves on. The other two signals, the unknown program and the out-of-town login, trace back to a single staff account, and neither matches anything approved. The laptop gets isolated, the account suspended, and the firm’s designated contact gets a phone call they probably didn’t enjoy. By 8 a.m. there’s a written summary and a short to-do list waiting.
Managed SOC or MDR?
People use the two terms interchangeably. They shouldn’t.
| Managed SOC | MDR | |
| Main job | Broad monitoring and oversight | Fast detection and containment |
| Typical scope | Logs from many systems, compliance reporting, incident response | Devices and accounts, threat hunting, rapid response |
| Best for | Regulated businesses needing documented visibility | Firms whose biggest gap is someone to act at 2 a.m. |
| Watch out for | Paying for breadth you don’t use | Gaps in log retention or compliance reporting |
For a lot of small businesses, MDR plugs the scariest hole first. ESET’s version runs 24/7 and is described by the company as human-led but accelerated by AI, with proactive threat hunting included. There’s a tier for small and mid-sized businesses and an Ultimate tier for larger ones. ESET reports a mean time to respond of six minutes, and KuppingerCole named it a Market Leader in its 2026 Leadership Compass for MDR.
Read the fine print on that six minutes, though. ESET defines it as the average time from first detecting an incident to taking the first action. That’s a containment step, which is valuable, but it isn’t a fully resolved incident. Any provider quoting a response time should be able to tell you exactly which clock they’re using.
If you need broad log coverage and audit trails, a managed SOC fits. If your real fear is nobody answering at 2 a.m., MDR probably does. Strict regulation plus a tiny team is the case where buying both starts to make sense.
Is This You?
You’re likely a good fit if nobody on staff can properly investigate a security alert, or if one IT person (or an outside IT firm) covers everything but goes home at six. The same goes if HIPAA or PCI DSS applies to you, or if you’ve started running AI agents and automations that can reach sensitive data.
What you get in return is fairly concrete. Someone qualified is awake while your team sleeps, travels or takes a holiday. Threats get contained before they spread, and the audit evidence builds up as reports rather than spreadsheets. Your staff can also stop chasing alerts they were never trained to judge.
One caution: if an employee or your current IT provider already monitors and responds around the clock, adding another service may just double up the work. Ask them what they actually cover before you buy anything new.
Questions Worth Asking Before You Sign
Security contracts tend to sound identical until something goes wrong. These questions help separate them:
- Which laptops, servers, cloud accounts and email systems are covered? Get the list in writing.
- Does a human review incidents overnight, or only automation?
- Which actions, like isolating a device, can they take without calling you, and which need your approval?
- How will they use your AI agent inventory, and how do they watch non-human accounts?
- What’s their response-time figure, and is it measured to first action or to resolution?
- Who cleans up afterwards, meaning removing the threat, resetting accounts and restoring files?
- Can you see a sample incident report?
Some providers bundle a warranty or insurance-style benefit. Read its eligibility conditions as closely as the service terms; that’s usually where the surprises live.
If your business is wiring agents deeper into its systems, it’s worth reading up on zero trust for AI agents too. Short-lived credentials and tightly scoped permissions make an analyst’s 2 a.m. judgment call much easier.
And keep the boring basics running alongside any service. Patch promptly, since unpatched software is now the most common way in. Keep backups somewhere offline, and switch on multi-factor authentication for business accounts. Print a list of emergency contacts and stick it somewhere sensible, because the day you need it may be the day email is down.
The Question Most Contracts Skip
A managed SOC gives a small business the security team it couldn’t realistically build. Firms that need broad monitoring and compliance support get the most from the full version. Firms mostly worried about stopping attacks fast may find MDR covers the gap.
Either way, the overnight call now involves software as well as people. Attackers use AI to move faster, and your own AI agents keep adding accounts the night shift has to judge. So before you sign, ask the one thing most contracts never mention: when your own agent signs in at 3 a.m., will the person watching know it’s yours?
FAQs
Q.1 What is a managed SOC in simple terms?
It’s an outside team of security experts who watch your systems around the clock, look into anything suspicious, and respond to threats for you.
Q.2 Is a managed SOC the same as MDR?
Not quite. A managed SOC usually covers broader monitoring and compliance reporting. MDR concentrates on catching and stopping threats quickly. Plenty of providers offer a mix.
Q.3 Are AI-powered attacks a new kind of threat?
Mostly no. Verizon’s 2026 report found fewer than 2.5% of AI-assisted attack techniques were novel. AI mainly helps criminals run phishing and software exploits faster and in larger numbers.
Q.4 Do small businesses need a managed SOC?
Often, yes, especially those without in-house security staff, those handling sensitive data, or those facing compliance rules. If fast response is the main worry, MDR may be enough.
Q.5 Can a SOC tell my AI agents apart from attackers?
Only if you’ve told it they exist. Share an inventory of each agent’s account, sign-in locations and normal schedule, and update it whenever you add one.
Q.6 What should a managed SOC contract include?
At minimum:
- the systems covered
- the actions the provider can take without asking you
- how AI agents and service accounts are handled
- response-time commitments and how they’re measured
- who handles cleanup
- a sample report
Related: Why Adelaide Businesses Are Choosing Commuserv for Managed IT in 2026
