Among the primary reasons for establishing a Security Operations Center (SOC) are strengthening cybersecurity posture, enabling faster detection and response and gaining a competitive edge.

Interestingly, despite the increasing demand for automated cybersecurity solutions, businesses rely on skilled security professionals to make key decisions, as human expertise remains essential for effective security management.

A Security Operations Center (SOC) is a dedicated organisational unit responsible for continuous monitoring and safeguarding of a company’s IT infrastructure. Its core mission is to proactively detect, analyse and respond to cybersecurity threats.

To identify the main drivers, strategic priorities, and potential challenges in SOC planning and implementation, Kaspersky has conducted a comprehensive global study involving senior IT security specialists, managers and directors from companies with 500 or more employees.

All participants operate without a SOC but have plans to establish one in the near future. The study spans 16 countries across APAC, META, LATAM, Europe, and Russia, providing valuable insights into the emerging trends and best practices in SOC development worldwide.

The findings of the research reveal that 50% of companies intend to establish SOCs to strengthen their cybersecurity posture, and 45% are motivated by the need to address increasingly sophisticated and dangerous threats.

Other drivers include budget optimisation, the necessity for faster detection and response, and the expansion of software, endpoints and user devices – factors that demand more comprehensive and layered security measures.

These are cited by 41% of organisations. Additionally, 40% seek better protection of confidential information, 39% aim to meet regulatory requirements and one-third (33%) expect SOC capabilities to provide a competitive edge. Larger enterprises tend to cite each of these reasons more often, reflecting the broader operational and regulatory pressures they experience.

Continuous monitoring becomes the leading SOC requirement

Among the key functions organisations plan to delegate, 24/7 security monitoring leads at 54%. This around-the-clock vigilance enables early detection of anomalies, prevents escalation and sustains cyber resilience in real-time. This demand highlights a strategic requirement for proactive risk management, as organisations aim to defend against persistent threats that can strike at any moment.

Companies intending to fully outsource SOC operations show a stronger interest in applying “lessons learned” methodologies, whereas those developing internal SOCs focus more on access management to maintain tighter control.

Human expertise drives SOC technology choices

While SOCs use advanced technology, the choices made by organisations show that human analysts are very important. Among the solutions that organisations plan to include in SOC are – Threat Intelligence Platforms (48%), Endpoint Detection and Response (42%) and Security Information and Event Management systems (40%) – sophisticated solutions that automate data collection and reduce operational load, however, they depend heavily on skilled security professionals who provide critical context, interpret complex findings and make final decisions when guiding appropriate responses.

Other solutions chosen include Extended Detection and Response (38%), Network Detection and Response (37%) and Managed Detection and Response (33%). Large enterprises tend to adopt more technologies (5.5 per SOC on average), while smaller ones integrate fewer (3.8).

“To successfully build a SOC, companies must prioritise not only the right mix of technology but also the careful planning of processes, clear goal-setting and effective resource distribution.

“Well-defined workflows and continuous improvement are essential to ensure that human analysts can focus on critical tasks, making the SOC a proactive and adaptable component of their cybersecurity strategy,” comments Roman Nazarov, Head of SOC Consulting at Kaspersky.

Terra Industries, a Nigerian defence technology startup, has raised $11.75 million to expand its development of defensive systems that protect critical facilities across Africa.

The fundraising round was led by Silicon Valley venture firm 8VC, which was founded by Palantir co-founder Joe Lonsdale.

Other investors in the round include Valour Equity Partners, Lux Capital, SV Angel, and Nova Global, as well as African-focused funds Tofino Capital, Kaleo Ventures, and DFS Lab.

Terra Industries, founded in Abuja by Nathan Nwachuku and Maxwell Maduka, provides multi-domain security solutions for both air and land. Its solutions are intended to detect and respond to threats including terrorism, sabotage, and armed attacks on infrastructure.

The company’s product portfolio includes surveillance drones, ground-based robotic systems, and fixed monitoring towers deployed around sensitive locations.

Co-founder and CEO Nathan Nwachuku said the company has now fully embraced its identity as a defence-focused startup, citing the growing urgency of security challenges across Africa.

He said safeguarding critical infrastructure from terrorist threats has become unavoidable.

Nwachuku argues that protecting Africa’s infrastructure requires a different approach, one that combines local manufacturing, end-to-end system control, and software capable of independently identifying and responding to threats over large areas.

The company aims to position itself as a defence prime, similar to the role played by firms such as Anduril Industries and Palantir in the United States.

Nwachuku also disclosed that the company had earlier raised $800,000 in pre-seed funding.

With the new funding, Terra plans to increase manufacturing capacity within Africa, establish additional defence production facilities, and expand its artificial intelligence and software teams.

While software offices are planned for San Francisco and London, the company said manufacturing operations will remain on the continent.

Kaspersky Security Bulletin reviews what shaped telecom cybersecurity in 2025 and what is likely to persist in 2026. Advanced Persistent Threat (APT) activity, supply-chain compromise, DDoS disruption and SIM-enabled fraud continued to pressure operators in 2025, while newer technology deployments introduce additional operational risk.

In 2025, telecom operators faced four broad threat categories. Targeted intrusions (APTs) continued to focus on gaining stealthy access to operator environments for long-term espionage and leverage through privileged network positioning.

Supply chain vulnerabilities remained an entry point: telecom ecosystems rely on many vendors, contractors and tightly integrated platforms, so weaknesses in widely used software and services can provide a path into operator networks. Finally, DDoS remained a practical availability and capacity problem.

Kaspersky Security Network showed that last year, between November 2024 and October 2025, 12,79% of users in the telecommunications sector encountered web threats and 20,76% faced on-device threats. 9,86% of telecom organisations worldwide experienced ransomware.

At the same time, the telecommunications sector is moving from rapid technological development to broad implementation — and the report argues that this shift creates new opportunities and new operational risks for 2026.

Kaspersky highlights three areas where technology transitions could introduce disruption if rolled out unevenly or without strong controls: AI-assisted network management, where automation can amplify configuration errors or act on misleading data; post-quantum cryptography transitions, where rushed deployment of hybrid and post-quantum approaches could cause interoperability and performance issues across IT, management and interconnect environments; and 5G-to-satellite integration (NTN), where expanding service footprints and partner dependencies introduce new integration points and potential failure modes.

“The threats that dominated 2025 — APT campaigns, supply chain attacks, DDoS floods — aren’t going away. But now they intersect with operational risks from AI automation, quantum-ready cryptography, and satellite integration.

Telecom operators need visibility across both dimensions: maintaining strong defences against known threats while building security into these new technologies from day one. The key is continuous threat intelligence that spans from endpoint to edge to orbit,” said Leonid Bezvershenko, senior security researcher at Kaspersky Global Research & Analysis Team.