Pune · Delivered from our Delhi NCR SOC
Pune runs two very different estates at once: the IT and ITeS parks of Hinjewadi, Wakad and Kharadi, and the automotive and engineering belt from Chakan through Talegaon to Ranjangaon. Both are now large enough to be attacked deliberately and, in most cases, too small to justify an in-house security operations centre. SOC as a Service is the third option: our analysts, our platform and our round-the-clock roster, watching your estate for a scoped monthly fee.
This page is about how that works for a Pune organisation — what each estate feeds into a SIEM, how plant-floor monitoring differs from watching an office network, and how remote onboarding works. The full model is on our SOC as a Service page, the tiering and SLA on SOC services, and the commercial side on managed SOC services.
The Pune estate
One city, two very different monitoring problems
A provider that treats Pune as one market will get half of it wrong. What a Hinjewadi software company feeds a SIEM and what a Chakan auto-ancillary plant feeds it barely overlap — and the detections, escalation paths and even the definition of “urgent” differ between them.
The IT/ITeS half — Hinjewadi, Kharadi, Magarpatta
Identity-led estates: Microsoft 365 and Entra sign-in logs, EDR across a laptop fleet, VPN and firewall logs, cloud audit trails. Attacks start with credentials — phishing, MFA fatigue, token theft — so the detections that matter are behavioural: impossible travel, unusual mailbox rules, privilege escalation at 2 a.m.
The manufacturing half — Chakan, Talegaon, Ranjangaon
Estates with a plant floor behind the office network: ERP and MES servers, engineering workstations, an OT DMZ, historians, and the remote-access paths vendors use to maintain line equipment. Attacks here are about disruption and extortion, and the telemetry that matters is the boundary — who crossed from IT to OT, when, and through which jump host.
Plenty of Pune companies are both at once: an IT services firm in Hinjewadi Phase 2 whose parent group runs plants on the Chakan corridor. That is normal for us — the estate is scoped as it actually is, and one roster watches the whole of it.
The gap nobody staffs for
Too big for antivirus, too small for a ₹1.4 crore roster
Most Pune mid-market companies sit in the same uncomfortable middle: large enough that a breach means regulatory reporting, customer audits and real money — nowhere near large enough to staff a SOC themselves.
The arithmetic is unforgiving. One console seat covered continuously is 8,760 hours a year. One analyst, after leave, holidays and training, delivers roughly 1,900 productive hours. That is about 4.6 full-time equivalents to keep one chair occupied around the clock — so you hire five or six to survive a single resignation. A credible minimum three-tier roster — eight L1 analysts, four L2, two L3, a detection engineer and a manager — comes to roughly ₹1.4 crore a year in base salary at Indian market medians, before recruitment, facilities and the SIEM licence itself.
The figure does not improve in Pune: analyst salaries track the national medians, and competition from every GCC and IT services major in Hinjewadi makes retention harder, not easier. SOC as a Service exists for exactly this gap: the same tiers shared across many estates, so the rare L3 skills one company could never keep busy become affordable. The full model is on our SOC as a Service explained page.
“Firewall plus EDR means we are monitored”
It means you are instrumented. Tools generate alerts; monitoring is a person reading them at 3 a.m., deciding which matter, and acting. Untriaged shelfware is the most common thing we inherit when a Pune estate first comes to us.
Below twenty servers, outsourcing wins on cost alone
You cannot buy 4.6 FTE of coverage for less than the subscription. Above that scale the decision stops being about price and becomes whether you can sustain the night shift at all.
Plant floors
OT and ICS monitoring for Chakan’s factories, done carefully
Monitoring a plant floor is not office monitoring with different logos. The first rule is that availability outranks everything: a security control that stops a line is worse than the gap it covered.
So we collect passively — mirrored traffic at the OT DMZ, historian and engineering-station logs — rather than installing agents on controllers or scanning PLCs. We baseline what normal looks like: which engineering station talks to which controller, which vendor remote-access sessions are expected. Detections then target the events that precede real incidents: a new path from the corporate network into the OT segment, a vendor VPN session outside its maintenance window, lateral movement towards the MES or ERP servers a ransomware crew would need for leverage.
Two things we will not do, because they are how OT projects go wrong: we will not promise to monitor PLCs “directly” on equipment never designed for it, and we will not take containment actions on plant-floor systems without your operations team on the call. Isolating a compromised office host at 3 a.m. is our decision if the contract grants it; touching anything that can affect a running line is yours, with our analyst beside you on the phone.
Both halves — plant and corporate — run into the same SIEM and the same roster, so an intrusion that starts in a phishing email and moves towards the line is one investigation, not two tickets in two queues.
How delivery works
Delivered from Delhi NCR, onboarded like a project
Our SOC is a staffed facility in Delhi NCR — we do not run a Pune operations room, and we say so plainly. What we run instead is a structured remote onboarding refined across hundreds of estates.
Onboarding follows a written plan with named owners on both sides. Week one is discovery: log-source inventory, crown-jewel identification and the escalation matrix. Weeks two and three are collection — lightweight collectors or direct syslog and API feeds from firewalls, EDR, identity and cloud, deployed remotely with your IT team on a call. Weeks four to six are tuning: a newly pointed SIEM is noisy, and our detection engineers baseline your estate until the alerts that reach you are worth reaching you. Anyone promising reliable detection on day one is describing alerting, not detection.
For manufacturing sites we add one in-person element: an engineer walks the OT boundary with your team during onboarding, because plant network diagrams are reliably out of date. Thereafter the relationship is remote by design, with quarterly service reviews held in person in Pune.
The subscription
What a Pune engagement actually includes
The short version: everything the ₹1.4 crore roster was going to give you, for a monthly fee, with the platform included. The complete model, delivery variants and co-managed options are on our SOC as a Service page; this is what lands on a typical Pune scope.
24×7×365 analyst cover
L1 triage, L2 investigation and L3 specialists from our own 50-plus in-house team in Delhi NCR — not subcontracted.
The SIEM platform
Our PrahiX Ora platform or FortiSIEM, or monitoring on a SIEM you already own — we audit inherited rule sets first.
OT-aware monitoring
Passive collection at the OT boundary, with baselines for vendor remote access and engineering-station behaviour.
Threat intelligence and hunting
Feeds tuned to Indian threat activity, plus hypothesis-led hunting by the L3 tier — not just waiting for rules to fire.
Escalation with a name on it
A written matrix agreed before go-live: P1 means a phone call to a named person, not an email into a shared mailbox.
Reporting an auditor can use
Monthly reports with investigated incidents, mean time to detect and respond, and the evidence CERT-In and customer audits ask for.
Tier definitions and SLA clocks are documented on our SOC services page, and the commercial structure — pricing units, contract shape, RFP questions — on managed SOC services.
Compliance
CERT-In’s six-hour clock and 180 days in India
Two obligations in the CERT-In directions of April 2022 shape every SOC engagement we run in India, and both are harder operationally than they read.
The first is reporting: specified incidents must reach CERT-In within six hours of being noticed. The trigger is noticing, not confirming — which makes the deadline a detection problem before it is a paperwork problem. If an attacker gets in on Saturday night and you learn of it from a customer on Tuesday, the clock did not start on Tuesday. A 24×7 SOC is the difference between learning about an incident from your own console and learning about it from someone else.
The second is retention: security logs must be kept for a rolling 180 days within Indian jurisdiction. We retain them in Indian regions by default, and the residency commitment is written into the contract. For Pune’s IT and ITeS companies there is a third layer: the DPDP Act 2023 makes personal-data breaches a board-level topic, and customer security audits now ask for exactly what a SOC produces — monitored coverage, investigated incidents, measured response times.
Money
What it costs a Pune mid-market company
We do not publish a rate card, because an honest figure depends on your estate: log volume, monitored asset count, OT scope, and whether you are buying monitoring alone or monitoring with response authority.
What we will do is frame the comparison properly. The alternative is the roster described above — roughly ₹1.4 crore a year in base salary, plus SIEM licensing that scales with data, plus twelve to eighteen months before in-house detections are trustworthy. For a typical Pune mid-market estate — a few hundred endpoints, mixed firewalls, Microsoft 365, one or two cloud tenants, possibly a plant — the subscription lands at a small fraction of that floor, scoped to the log sources you actually have.
Every quote is specific: a monthly figure against a written log-source list, the in-house comparison beside it, and the unit price for adding sources later in the contract. If building in-house is genuinely the better answer at your scale, we will say so. The full breakdown of what moves an Indian quote is in our guide to SOC as a Service pricing in India.
Straight answers
SOC as a Service in Pune, answered
Do you have an office in Pune?
No, and we would rather say so plainly. Our SOC is a staffed facility in Delhi NCR, and Pune engagements are delivered remotely — the same model we use for estates across India. What benefits from being in the room is done in the room: an engineer visits manufacturing sites during onboarding, and quarterly service reviews are held in person in Pune.
Can you monitor OT and ICS systems on our plant floor?
Yes, with care. We collect passively — mirrored traffic at the OT DMZ, historian and engineering-station logs — rather than installing agents on controllers or scanning PLCs, because availability outranks everything on a plant floor. Detections focus on the boundary events that precede incidents: unexpected IT-to-OT paths, vendor remote access outside maintenance windows, lateral movement towards MES or ERP. Containment on anything that can affect a running line is decided with your operations team, never unilaterally.
Are our logs stored in India?
Yes. CERT-In requires security logs to be retained for a rolling 180 days within Indian jurisdiction, and we retain them in Indian regions by default. The residency commitment is written into the contract, and retention covers both the IT and OT sides of the estate — which also keeps you ahead of the evidence requests that arrive with customer audits and DPDP-era breach assessments.
What does it cost for a Pune mid-market company?
There is no honest single figure before scoping: price follows log volume, asset count, OT scope and response authority. The benchmark is the alternative — roughly 1.4 crore rupees a year for a credible in-house roster before overheads — and a typical Pune mid-market subscription is a small fraction of that. We quote a specific monthly figure against a written log-source list, with the in-house comparison beside it.
How long does onboarding take?
First log sources are ingested within days, and meaningful detection coverage is in place within four to six weeks. The constraint is tuning, not integration: a newly connected SIEM is noisy, and the value comes from the baselining that follows. Manufacturing sites add a short in-person OT walkthrough.
Can you monitor our existing firewall and EDR?
Yes — that is the norm, not the exception. We monitor mixed estates across Fortinet, Cisco, Palo Alto, Sophos and the mainstream EDR platforms, ingesting from what you already own. If you also own a SIEM we can run monitoring on it, though we audit the inherited rule set first: platforms left without a dedicated team almost always have stale detections and log sources that silently stopped reporting.
Do you cover IT companies in Hinjewadi?
Yes. IT and ITeS estates are the other half of our Pune work: Microsoft 365 and identity telemetry, EDR across the laptop fleet, VPN and firewall logs, and cloud audit trails. The detections that matter are behavioural — credential abuse, MFA fatigue, unusual mailbox rules, privilege escalation outside working hours — and the reporting doubles as evidence for the customer security audits Hinjewadi firms increasingly face from overseas clients.
Who do we actually call at 3 a.m.?
The escalation matrix is agreed in writing before go-live: a named primary and secondary contact on your side, and on ours a duty L2 analyst with an L3 on call. For a P1 we phone the named person — not an email into a shared mailbox. What happens next depends on the authority granted in the contract: monitoring-only means we advise and you act; full response means we contain first and tell you immediately. That boundary is settled at contract stage, never during an incident.
Next step
Find out what your Pune estate would cost to monitor
Send us your log-source list — or let us build it with you on a call — and we will come back with a specific monthly figure, the in-house comparison beside it, and an onboarding plan.
P J Networks Pvt Ltd · C-160, Mayapuri Phase II, New Delhi 110064
+91 98183 61787 · sanjay@pjnetworks.com
Related
Related to SOC as a Service in Pune: the full SOC as a Service model, our SOC services and SLA, the commercial guide to managed SOC services, what drives SOC as a Service pricing in India, how to compare SOC service providers in India — or talk to us about your estate.