Modern SOC for Small Hospitals: Build, Buy, or Hybrid

The decision looks like a budget question and is really a staffing one. Round- the-clock coverage needs continuous presence, and continuous presence has a headcount floor that does not scale down for a smaller hospital.

The staffing arithmetic

Continuous coverage requires someone present at all times. Allowing for shift rotation, leave, training, sickness and attrition, that is roughly five people for single cover — and single cover means one analyst alone at 3am with no second opinion.

Add a tier-2 capability for investigation, someone to write and tune detections, and a lead, and the realistic figure is eight to ten. Then add recruitment in a market where analysts are scarce and community hospitals rarely win on salary, and retention when the role is night shifts in a small team.

This is why "build" is usually not viable below a certain size. It is not the tooling cost.

Comparing the three models honestly

The clinical context gap is the one to plan for. An external SOC does not know that the imaging VLAN talks to the worklist server, that break-glass spikes during a mass casualty event, or that the pharmacy robot reboots on Sunday nights. That knowledge has to be transferred deliberately, or you will receive escalations for normal operations and — worse — see genuine anomalies dismissed.

The hybrid model, concretely

For most community hospitals this is the right answer: an MDR provider does 24/7 monitoring and triage; the hospital retains ownership, context and decision-making.

You still need someone internal — typically one person, not ten — who owns the relationship, feeds context in, reviews the provider's output sceptically, and can make a containment decision at 3am. Without that role the arrangement degrades into an alert feed nobody acts on.

Contract terms that decide the outcome

When buying, the security of the arrangement lives in a handful of clauses:

• Response time SLAs by severity, with the clock starting when you declare, not when the provider accepts
• Containment authority — explicitly, may they isolate an endpoint or disable an account, and under what pre-agreement
• Data ownership and portability — can you export raw logs and take custom detections with you
• Named analysts or a shared pool, and whether you get continuity
• Onboarding milestones with dates, since time-to-value is where these engagements disappoint
• Healthcare experience, evidenced by references of comparable size

Those are covered in more depth in the managed security services RFP template.

Where to start

Work out your real coverage today. Not "we have a SIEM" but: at 3am on a Sunday, who sees an alert, how long until they act, and what are they authorised to do? Most small hospitals discover the honest answer is nobody until Monday — and that single fact frames the whole decision better than any cost model.

GuardsArm provides co-managed detection for healthcare and helps organisations evaluate build-versus-buy honestly. Book a scoping call.