For the last five years, SANS has conducted the security operations center (SOC) Survey, and this year’s report continues to provide insight to SOC leaders and other professionals. For 2021, we conducted a long questionnaire and then followed up with respondents for more
details about their responses to some of the questions. The motivation for this report is to provide SOC managers, team leads, vendors, and industry analysts with an opportunity to peer into what others in the industry are doing.

The SANS Institute is uniquely positioned with trusted relationships throughout the world. We endeavor to provide transparent analysis
and include qualitative insights, where appropriate. Because we asked follow-on questions of individuals who took the survey, this
report also includes the explanations shared in those responses.

This report is organized into several sections, beginning with this executive summary, detailed demographics, and key findings. We
then cover SOC capabilities, staffing, technology, funding, and deployment strategies, before concluding the report with survey
challenges and a summary.