Building a Security Operations Process Without a 24/7 SOC

The 2 AM Alert Nobody Saw

A mid-size federal contractor in Virginia discovered a credential-stuffing attack against their VPN gateway at 9:15 AM on a Monday. The attack had started Friday at 11:47 PM. Seventy-two hours of uncontested access. The contractor had antivirus, a firewall, and a SIEM subscription. What they lacked was any defined process for what happens when nobody is watching the screen.

That gap, not the technology, was the actual vulnerability. A 24/7 security operations center (SOC) would have caught it faster, but most small agencies and GovCon firms cannot justify the $800,000 to $1.2 million annual cost of staffing one in-house. The realistic alternative is not "accept the risk" -- it is building a structured, documented process that compresses detection and response time even when your team works business hours.

Start With Threat Prioritization, Not Tool Purchases

Before adding any new platform, map your actual attack surface. For a small contractor or agency office, that surface is usually narrow and predictable: remote access (VPN or RDP), email, cloud storage (SharePoint, OneDrive, or an S3 bucket), and endpoints running Windows. Identity infrastructure, specifically Active Directory or Azure AD, sits underneath all of it.

Rank threats by likelihood and impact against those five categories. Credential compromise and phishing account for over 80 percent of initial access vectors in federal contractor breaches according to CISA advisories from 2022 through 2024. Ransomware is the dominant impact. That ranking tells you where to invest process design first: identity monitoring and email filtering, not exotic threat hunting.

Write a one-page threat model. It does not need to be formal. It needs to answer three questions: What are we protecting? What are the most likely ways it gets compromised? What would we know if that happened? That document becomes the foundation for every detection rule and response procedure you write afterward.

Detection Without Continuous Eyes on Glass

A SOC's core value is continuous monitoring. You can replicate a significant portion of that value through alert triage design rather than headcount. The goal is to ensure that high-fidelity alerts reach a human within minutes, not hours, regardless of time of day.

Layer 1: SIEM or Log Aggregation With Pre-Built Rules

If you have a SIEM (Microsoft Sentinel, Splunk, or even a managed SIEM from an MSSP), configure it with a small set of high-confidence rules rather than hundreds of noisy ones. Recommended starting rules for a small shop:

• Failed login attempts exceeding 10 in 5 minutes on any account
• Successful login from a country not on your approved list
• New local administrator account created outside a change window
• Large outbound data transfer (define a threshold based on your baseline, typically 500 MB or more in one session)
• Disabled antivirus or EDR agent on any endpoint
• Lateral movement indicators: net use commands, PsExec execution, or WMI remote calls

Each rule should map to a specific response action, not just generate a ticket. If you cannot define the response action when you write the rule, the rule is not ready to deploy.

Layer 2: After-Hours Alert Routing

This is where most small shops fail. Alerts fire into a queue that nobody checks until 8 AM. Fix this with a tiered escalation path using tools you already pay for. Microsoft Sentinel and most MSSPs support PagerDuty or direct SMS/phone call integration. Configure Severity 1 alerts (active credential compromise, ransomware indicators, data exfiltration) to call a designated on-call person directly. Severity 2 alerts go to email and Slack. Severity 3 and below queue for morning review.

Assign on-call rotation explicitly. Even a two-person rotation, alternating weekly, means someone is reachable within 15 minutes rather than 10 hours. Document the rotation in your incident response plan and test it quarterly with a simulated alert.

Layer 3: Managed Detection and Response (MDR)

For organizations that cannot staff any after-hours coverage internally, a managed detection and response provider fills the gap at a fraction of SOC cost. MDR contracts typically run $15,000 to $60,000 per year depending on endpoint count and scope. The provider monitors your environment, triages alerts, and contacts your team when action is required. You retain decision authority; they provide the eyes.

When evaluating MDR providers, ask specifically: What is your mean time to notify (MTTN) for a Severity 1 event? What is your escalation path if my on-call does not answer? Do you have FedRAMP-authorized tooling if required by my contracts? Get those answers in writing before signing.

Response Procedures That Work Without a Playbook Library

Large SOCs maintain dozens of playbooks. You need four. Cover the scenarios that account for the majority of incidents:

1. Compromised credential: Disable account, reset password, review sign-in logs for the past 30 days, check for mailbox forwarding rules, notify the user and their manager.
2. Ransomware indicator: Isolate the affected endpoint from the network immediately (pull the network cable or disable the NIC via remote management), preserve memory if possible, contact your MDR or IR retainer, do not pay until you have confirmed backup integrity.
3. Phishing with click: Identify the user, pull the email headers, check if credentials were entered, scan the endpoint, block the sender domain and URL at the gateway.
4. Unauthorized data access: Identify what data was accessed and from where, determine if it meets your breach notification threshold under your contracts or FISMA, preserve logs, loop in legal counsel.

Each procedure should fit on one page. Include specific tool names, not generic steps. "Check sign-in logs" is not useful. "Open Azure AD, navigate to Sign-in logs, filter by the compromised UPN for the past 30 days, export to CSV" is useful.

Compensating Controls That Reduce Exposure During Off-Hours

Process alone does not close the 2 AM window. Pair your detection and response procedures with controls that slow attackers down when nobody is watching.

• Conditional access policies: Block logins from outside the U.S. (or your specific approved regions) entirely if your mission does not require international access. This eliminates a large category of credential-stuffing success without any monitoring required.
• Privileged access workstations (PAWs) or just-in-time (JIT) access: Admin accounts that only have elevated rights for defined windows cannot be abused at 2 AM if the elevation window has expired.
• Immutable backups: Ransomware impact is directly proportional to backup integrity. Backups that cannot be deleted or encrypted by a compromised account (air-gapped or append-only cloud storage) convert a catastrophic event into a recoverable one.
• Network segmentation: If your file servers, domain controllers, and workstations are on separate VLANs with firewall rules between them, lateral movement after initial access is slower and noisier.

Metrics to Track Without a SOC Team

Measure three numbers monthly: mean time to detect (MTTD), mean time to respond (MTTR), and alert-to-incident ratio. MTTD and MTTR tell you whether your process is actually compressing the attacker's window. Alert-to-incident ratio tells you whether your detection rules are tuned or generating noise. A ratio above 50:1 (50 alerts per confirmed incident) usually means your rules need tightening. Review these numbers in your monthly IT meeting and adjust rules accordingly.

Practical Takeaway

You do not need a 24/7 SOC to run a defensible security operations process. You need a written threat model, a small set of high-fidelity detection rules with defined response actions, an after-hours escalation path that actually reaches a human, four response procedures that fit on one page each, and compensating controls that slow attackers during off-hours. Build those six things before buying another security tool. The Virginia contractor's 72-hour dwell time was not a technology problem. It was a process gap, and process gaps are cheaper to fix than breaches.