Delhi NCR · Operating since 2002
A virtual SOC (vSOC) is a complete security operations centre — L1, L2 and L3 analysts, a SIEM, threat intelligence and a 24×7 roster — delivered from the provider’s facility against your telemetry, instead of from a room built on your premises. “Virtual” describes where the desks are, not a smaller function.
Our desks are in Mayapuri, Delhi NCR, and you can walk into them. This page covers what a virtual security operations centre is, how it compares with an on-site SOC, SOC as a Service and a co-managed SOC, where your logs sit under CERT-In, how onboarding works without hardware on your premises, and where the model is the wrong answer. For the SLA, see 24×7 SOC monitoring in India.
The definition
What a virtual SOC actually is
A virtual SOC is a security operations centre whose analysts, tooling and roster sit in the provider’s facility while the telemetry, detections and incidents remain yours. Every element of a conventional SOC is present: tiered analysts, a SIEM, threat intelligence, playbooks, shift handovers and an escalation path that ends at a named human.
The confusion comes from the word. In Indian RFPs, “virtual SOC” gets used for three things: a remote SOC delivered from the provider’s premises (the correct meaning), a cut-down alerting service with no L2 or L3 behind it (a marketing meaning), and occasionally analysts working from home. Only the first is a real operating model, and you tell it apart by asking the questions you would ask of any SOC: analysts per shift, tier structure, what happens at 3 a.m.
The honest test is subtraction. Take a well-run on-site SOC and remove only the room — keep the tiers, roster, SLAs, log sources and escalation authority. What remains is a virtual SOC. If anything else disappears in the subtraction, it was never a SOC to begin with.
The comparison
Virtual SOC vs on-site SOC vs SOC as a Service vs co-managed
All four models can deliver the same function. The useful axis is not capability but where the people sit and who owns the platform.
Scroll the table sideways →
| Model | Where the analysts sit | Who owns the platform | What you give up | Best fit |
|---|---|---|---|---|
| On-site SOCdedicated room | A room on your premises, staffed by your people, a provider’s residents, or both. | You — licences, hardware and the room itself. | Nothing operationally, but you fund the room and full roster whether you use it or not. | Air-gapped, defence and other estates where data cannot leave the building. |
| Virtual SOCvSOC | The provider’s facility, working remotely against your telemetry. | Usually the provider; can also be your own SIEM monitored remotely. | A room to walk into — and the capital cost of building one. | Most Indian estates wanting full function without facilities. |
| SOC as a ServiceSOCaaS | The provider’s facility — the same delivery as a virtual SOC. | The provider, subscription-priced, platform included. | Platform ownership, unless the contract says otherwise. | Buyers purchasing the outcome — investigated incidents — rather than the tooling. |
| Co-managed SOChybrid staffing | Split: your day team on your side, the provider on nights, weekends and L3 work. | Shared — typically your SIEM, their analysts. | Sole ownership of the console; handovers must be written down. | Teams with a working day shift and no realistic path to 24×7. |
A short history
Why the operations room is a legacy of on-premise SIEM
The physical SOC room was never the point of a SOC. It was a side effect of where the data lived — and the data no longer lives there.
Fifteen years ago a SIEM was an appliance racked in your own data centre, fed by syslog from servers ten metres away. Consoles had to sit near the appliance, analysts near the consoles, and so the room with the video wall was born. Data gravity produced the building, not the other way round.
Three things dissolved that gravity. Encrypted forwarding moves telemetry across the country as reliably as across the corridor. The estate itself left the building: Microsoft 365, AWS CloudTrail and IdP audit logs were never in your data centre, so an on-premise room already watches much of your estate over a wire. And SIEM consoles moved to the browser. What the room still offers is real but modest — somewhere to visit, a war-room venue, segregation for air-gapped work. We answer the first two by making Mayapuri visitable; the third is the exception covered below.
“A virtual SOC is a cost-cut version of the real thing”
The saving comes from sharing a facility and roster across many estates, not from removing tiers. The function is identical; the real estate is not.
“Remote analysts respond slower”
Response time is set by the roster, the escalation matrix and the authority in the contract — not by commuting distance. A remote L2 on shift at 3 a.m. beats an on-site team that went home at 7 p.m.
The honest ledger
What stays the same — and what actually changes
Buyers are right to ask what they lose when the room goes. Here is the ledger without the sales filter.
Same: the three tiers
L1 triage, L2 investigation, L3 forensics and hunting, exactly as RBI’s Annex-2 describes them. Removing the room does not remove a tier; a provider who says otherwise is selling monitoring, not a SOC.
Same: the 24×7 roster
One continuous seat is 8,760 console-hours a year; one analyst delivers roughly 1,900 productive hours; a seat needs about 4.6 full-time equivalents. We carry that roster; you consume the coverage.
Same: SLAs and telemetry
Time-to-verify, escalation paths and P1 call-outs are contractual and identical to an on-site engagement, and the same log sources are collected with the same retention and detection content.
Changes: no room to walk into
There is no operations room on your premises. Ours is visitable — C-160, Mayapuri Phase II, New Delhi — for audits, shift-shadowing and quarterly reviews. Virtual delivery, physical accountability.
Changes: no room to build
You skip the secured room, the video wall, redundant power and the twelve-plus months it takes to stand a facility up before a single analyst is productive inside it.
Changes: a new dependency
Delivery now rides on the link between your estate and ours. We mitigate it with dual paths and local log buffering, but it belongs in your risk register.
Data residency
Where your logs go, and the CERT-In rules that govern them
For an Indian organisation the first question about a virtual SOC is not “where are the analysts” but “where do the logs physically sit”. That is what the regulation actually asks.
CERT-In’s 2022 directions require security logs to be retained for a rolling 180 days within Indian jurisdiction, and specified incidents to be reported within six hours of being noticed. Both obligations land on you even when a provider does the watching — so the vSOC contract must make the provider’s part explicit: retention region, retention duration, and who drafts the report when the clock starts.
Forwarded logs land in SIEM storage in an Indian region, retained 180 days by default and longer where your regulator requires it. Because the six-hour window runs from noticing rather than confirming, our verified-incident SLA is what keeps you inside it, and we support the submission with the investigation’s evidence trail.
Sector rules layer on top: SEBI’s CSCRF expressly permits third-party managed SOCs, RBI’s framework is silent on whose building the C-SOC sits in, and the DPDP Act 2023 cares about personal data within the logs, not the label on the SOC. Our compliance services page maps each instrument to its clauses.
“Residency means the analysts must be in India”
No Indian regulation requires that. CERT-In’s rule governs where logs are stored, not where eyes sit. Our analysts are in Delhi NCR regardless — an operational advantage, not a legal claim.
Onboarding
How remote onboarding works with no hardware on your premises
The most common technical question is what physically has to happen at your sites. The honest answer: usually nothing that involves a screwdriver.
1. Telemetry, not appliances
Firewalls, servers, EDR and applications forward logs with the agents they already have; Microsoft 365, AWS, Azure and your IdP connect by API. Where local buffering is prudent we deploy a collector as a VM on your estate, not a shipped box.
2. The link
Logs travel one way — out — over an encrypted tunnel or private interconnect, with a secondary path where availability justifies it. Analyst access back in, if granted for response, is a separate, separately authorised and logged channel.
3. Your SIEM or ours
We can operate a SIEM you already license, auditing the inherited rule set first, or run the engagement on our platform — PrahiX Ora or FortiSIEM — under managed SIEM terms.
4. Baseline and tune
First sources ingest within days; the following four to six weeks of baselining and tuning decide quality. A provider promising reliable detection on day one is describing alerting, not detection.
5. Agree the authority
Before go-live we write the escalation matrix: who is called for a P1, what we may contain without asking, what always waits for your approval. This is the document that matters at 3 a.m.
6. Prove it
Go-live closes with a live test incident walked through the full chain — detection, verification, call-out, containment — so the first real incident is not the first rehearsal of the phone tree.
The honest exceptions
When a virtual SOC is the wrong choice
We would rather lose the deal here than fail you during an incident. Some estates genuinely need a different architecture.
Air-gapped OT and industrial systems
If the network carrying your logs has no path out by design, nothing can monitor it remotely. The right model is an on-site SOC or resident engineers, sometimes fed by a one-way data diode — and we will say so rather than sell around it.
Data that cannot leave a segment
Some defence, government and PCI-scoped segments prohibit security telemetry itself from crossing the boundary. A virtual SOC cannot see that segment, and any provider offering to “work something out” is offering to breach your compliance posture.
Mixed estates are the norm
Most organisations are 90 per cent virtual-able and 10 per cent not. The workable pattern is a virtual SOC for the connected estate with an on-site or co-managed arrangement for the sealed segment, under one escalation matrix.
Straight answers
Virtual SOC in India, answered
Is a virtual SOC less capable than a physical one?
No — provided it is genuinely a SOC and not a monitoring service using the label. The tiers, roster, SIEM, SLAs and escalation authority are the same; only the location of the desks differs. Verify it as you would any SOC: analysts per shift, tier structure, what happens at 3 a.m. If capability disappears with the room, it was never fully a SOC.
Where do our logs physically sit?
In SIEM storage in an Indian region, retained for a rolling 180 days under CERT-In’s 2022 directions, and longer where your sector regulator requires it. The residency rule governs where data is stored, not where analysts sit — though ours are in Delhi NCR regardless, which helps context, response time and the fact that you can visit them.
Do we need any hardware on-premise?
Usually none. Firewalls, servers, EDR and applications forward logs with the agents they already have; cloud and SaaS sources connect by API. Where local buffering is prudent we deploy a collector as a virtual machine on your infrastructure rather than shipping an appliance. The only new dependency is the encrypted link itself.
How is a vSOC different from SOC as a Service?
Mostly in terminology, and we will not pretend otherwise. Both describe a full security operations function delivered from the provider’s facility. Where a real difference exists it is contractual: SOC as a Service is usually quoted platform-inclusive, while virtual SOC sometimes describes monitoring a platform you own. Ask who owns the SIEM and where the detection content lives — the answer matters more than the label.
Can we visit your facility even if delivery is virtual?
Yes, and we encourage it. Our SOC operates from C-160, Mayapuri Phase II, New Delhi 110064, and clients are welcome for audits, shift-shadowing, reviews and war-rooms. Virtual describes where the desks are relative to your premises; it does not make the operation intangible. Physical accountability is part of the offer.
What does a virtual SOC cost in India?
There is no honest flat figure: price follows log volume, monitored asset count and whether you buy monitoring alone or with response. The meaningful comparison is the alternative — a credible in-house three-tier roster is roughly 1.4 crore rupees a year in base salary before overheads, one continuous seat needs about 4.6 full-time equivalents, plus SIEM licensing and the room. Below genuine scale, virtual wins on cost and it is not close.
How long does onboarding take?
First log sources typically ingest within days; meaningful detection coverage lands in four to six weeks for a mid-market estate. The binding constraint is tuning, not connectivity: a freshly pointed SIEM produces noise, and value comes from the baselining weeks that follow. Reliable detection promised on day one is alerting, not detection.
Does a virtual SOC work for air-gapped networks?
Not directly, and we will not sell you one for that. An air-gapped segment has no path out for its telemetry by design, so remote monitoring is impossible by definition. The honest architectures are an on-site SOC, resident engineers, or a one-way data diode where policy permits. Mixed estates work: virtual SOC for the connected estate, on-site for the sealed segment, one escalation matrix.
Next step
See the room your virtual SOC would run from
Bring your asset list and a log-volume estimate; we will scope the estate, quote a specific monthly figure, and put the in-house comparison beside it. If you are one of the honest exceptions above, we will tell you that instead.
P J Networks Pvt Ltd · C-160, Mayapuri Phase II, New Delhi 110064
+91 98183 61787 · sanjay@pjnetworks.com
Related
Related to virtual SOC: the authority page on SOC as a Service, our 24×7 SOC monitoring in India SLA, the co-managed SOC model, our SOC services and tiering, what moves a quote in SOC as a Service pricing in India, and managed SIEM for the platform underneath.