Running an end-of-life/end-of-support access control and video management platforms that couldn’t meet enterprise needs across 30+ offices. Key gaps included an aging platform, limited integrations, and inconsistent identity/credentialing workflows.

So while the “Minority Report” style interfaces of early VSOC marketing may have never materialized, they did inspire a new way of thinking about how SOCs operate. Instead of “How do we avoid complexity?”, the question became, “How do we manage that complexity well?”

Today’s VSOCs are already complex in their design, deployment, and operation. Working with experienced industry resources can eliminate some of that complexity, helping organizations determine where and how to focus their efforts.

For example, consultants bridge the gap between ambitious VSOC concepts and real-world implementation. They have first-hand knowledge of where technology adds value and where people add impact. This experience allows them to create effective SOC strategies that are both applicable today and scalable for tomorrow.

Integrators then help organizations deploy those strategies. Their role is to bring SOC solutions to life, ensuring that technologies and systems work as intended. From creating fully on-site SOCs to integrating fractional SOC solutions into existing workflows, their technical expertise ensures interoperability across platforms.

Finally, vendors and technology providers serve as the foundation that makes it all possible. By advancing interoperability standards, cloud infrastructure, and open APIs, and automation frameworks, they are redefining what a ‘virtual’ SOC really looks like.

And maybe tomorrow we will reach a point where AI has the contextual awareness equivalent to a human. And where automation can make life-altering decisions with reliability and nuance. But until then, long live the VSOCs of today.

It’s both and it’s cyclical. People are reluctant to change because they’re comfortable, it’s working, it may not be perfect but it’s working, or they’ve tried it, and they’ve met resistance or they have met roadblocks. So that’s the first resistance.

The second resistance is they don’t understand it. How would it benefit them? Or why would it benefit the security program at large or initiative at large? So that’s the typical initial resistance or reluctance.

Once you get through to that, now you have deployed this, executed the program, you’re managing it, and now there’s actually things that are changing with it. So if you put very rigid controls, if you didn’t have a good change management process that was fluid and flexible and dynamic, you’re not going to know how to address those changes. So typically when that starts to happen, if you don’t have good principles in place, now things are going to start happening ad hoc. People are going to start improvising, your program now starts to fray at the edges, and ten years later, you are back at square one where things are not working and everybody’s resistant to the new program.

So when we say 10 to 20 years, obviously we’re not developing a 20-year program. What we’re trying to do is put a framework of best practices in place for end users who are now able to follow that framework to say, okay, as technology is changing or whatever environment is changing within my organization, I know who the roles and responsibilities are. I know what the process is to get in front of it to become proactive about it. And that’s the 10-year longevity that we look at and talk about – how to give them the tools to basically keep refreshing their security program and keep staying ahead of it as opposed to reacting to it.