NOC vs SOC: what's the difference, and do you need both?

Two teams, two questions

A NOC asks: is everything working, and will it keep working? Its measures are uptime, latency, capacity, failed jobs and unpatched systems.

A SOC asks: is anything here hostile? Its measures are detections, investigations, contained incidents and time to respond. The same server can be perfectly healthy from a NOC's perspective while an attacker is quietly logged into it — which is exactly why one function cannot substitute for the other.

What a NOC handles

• Continuous monitoring of networks, servers and connectivity
• Alerting on outages, degradation and capacity limits
• Patch and firmware management
• Backup job monitoring and verification
• Incident triage, escalation and vendor liaison
• Availability and performance reporting

What a SOC handles

• Log and telemetry collection across identity, endpoint and network
• Threat detection and alert triage
• Investigation of suspicious sign-ins, malware and data movement
• Containment — isolating devices, disabling accounts, blocking traffic
• Vulnerability visibility and posture improvement
• Incident reporting and post-incident review

Where they overlap

Both functions run on monitoring data, and both depend on knowing what you own. In smaller organisations the same engineers often cover both, which works as long as the two mandates stay distinct — availability work has a habit of crowding out security work when everything lands in one queue.

The healthy pattern is shared tooling and asset data, separate playbooks, and clear rules about who is allowed to take a system offline in an emergency.

Do you need both?

If your business loses money when systems are down, you need NOC capability. If you hold customer data, handle payments, or rely on email for anything commercially sensitive, you need SOC capability. Most New Zealand businesses of any size are in both categories.

The practical decision isn't whether to have both functions, but whether you build them in-house or buy them as a service. Running genuine 24/7 coverage internally means a roster, not a person.