The Short Answer
What Is X-SOC™?
X-SOC™ is an outsourced security operations center (SOC-as-a-Service) from DAG Tech. A 24/7/365 team of DAG Tech analysts delivers 24/7 SOC monitoring and managed detection and response (MDR), triaging, investigating, and containing threats across your identities, endpoints, email, and cloud, then reporting monthly in plain English. Unlike fixed security bundles, every X-SOC starts with three core services and adds only the modules you choose from a catalog of 23. Tools you already own can stay, and the whole thing rolls into one monthly per-user price.
Severity is defined by compromise, not by whether systems are still up. An attacker in an admin account is Critical even when everything is running. X-SOC runs on its own, co-managed alongside your internal security team, or with A+ Animal™ and managed cybersecurity.
X-SOC™ at a glance
SPEC SHEET- PRODUCT TYPE
- Outsourced SOC / managed SOC as a service
- ALSO KNOWN AS
- SOCaaS, virtual SOC, co-managed SOC, SOC augmentation, 24/7 SOC monitoring
- BEST FOR
- Mid-market and enterprise organizations that need 24/7 SOC monitoring, with or without an internal security team
- PLATFORMS
- Microsoft 365, Entra ID, Active Directory, Google Workspace, Okta, AWS, Google Cloud, Windows, macOS, servers
- PRICING MODEL
- Custom monthly per-user price, set by the modules you choose
- DEPLOYMENT
- Within 60 days; as little as 4 weeks
- CONTRACT
- X-SOC SLA & Reasonable Use Policy under the DAG Tech MSA
- FRAMEWORKS
- Reporting aligned to NIST CSF, HIPAA, CMMC, NYDFS 500, PCI DSS, and SOC 2
Inside X-SOC™
Managed SOC Services, Configured to Fit
A 25-person office and a 600-person enterprise get the same SOC, the same analysts, and the same SLA. What differs is which of the 23 modules you add. Vendors are never hardwired.
THE CORE · INCLUDED IN EVERY X-SOC
Security Operations Center
DAG Tech analysts monitor, triage, investigate, and respond 24/7/365. US-only or follow-the-sun coverage.
Response Authority & Containment
You decide how we act on a confirmed threat:
- ANotify First: we call you before any disruptive action.
- BPre-Authorized: we contain at once from your approved action list.
- CCo-Managed: we cover nights, weekends, and escalations for your team.
Reporting & Strategic Guidance
Monthly X-SOC report with posture, events, incidents, and prioritized recommendations, plus optional CxO™ advisory hours.
BUILD YOUR X-SOC · 23 OPTIONAL MODULES
Click a module to add it. Everything you pick shows in Your X-SOC and travels with your proposal request.
Detection & Response
Watch every place an attacker can get in, and every way they move once inside.0 OF 9 ADDEDEmail, Web & User Protection
Stop the attacks that start with a person: phishing, spoofing, and malicious sites.0 OF 4 ADDEDExposure Management
Find and fix weaknesses before an attacker does.0 OF 2 ADDEDData Protection & Resilience
Respond fast when something happens, and prove you can recover.0 OF 3 ADDEDGovernance & Assurance
Show auditors, customers, and insurers that your controls work.0 OF 2 ADDEDHow It Works
From Signed Order to 24/7 Coverage
Scope
We map your environment and tools, then choose the modules you need.
Onboard
Modules, quantities, and retention go on one Service Order. Live within 60 days, often in 4 weeks.
Monitor & Respond
Analysts triage 24/7, notify your escalation path, and contain under the authority you've set.
Inside the SOC
What 24/7 Looks Like
Every alert is confirmed by a DAG Tech analyst, contained under the Response Authority Model you chose, and written up in plain English for your team. This is a typical overnight shift.
- +Analyst-confirmed before anyone is paged
- +Contained under your rules: Notify First, Pre-Authorized, or Co-Managed
- +A plain-English summary after every incident
The X-SOC Method
How We Run Your SOC
X-SOC runs one continuous loop, built on the NIST Cybersecurity Framework 2.0, NIST SP 800-61 incident handling, and MITRE ATT&CK. Every alert, from every platform, goes through the same six stages.
- 01
Collect
Identity, endpoint, email, cloud, network, and SaaS telemetry flows into one SIEM, normalized and correlated. Every data source is health-checked, so a sensor that goes quiet is treated as an alert, not a blind spot.
- SIEM ingestion and normalization
- Data-source health monitoring
- Asset and identity context
- 02
Detect
Platform detections are layered with DAG Tech detection engineering mapped to MITRE ATT&CK, including rules written for your environment, such as Active Directory attacks by technique.
- MITRE ATT&CK-mapped detections
- Environment-specific rules
- Threat intelligence enrichment
- 03
Triage
A DAG Tech analyst reviews every escalated alert. Severity is set by attacker activity, not uptime, and each finding is enriched with user, device, and threat context before anyone is paged.
- Human-verified alerts
- Severity by compromise
- Noise tuned out every week
- 04
Contain
Confirmed threats are stopped under the Response Authority Model you chose: Notify First, Pre-Authorized, or Co-Managed. Devices are isolated, sessions revoked, and accounts disabled from SOAR playbooks, never outside your rules.
- Containment Authority Matrix
- SOAR playbooks
- Escalation to your on-call list
- 05
Remediate & Recover
Containment stops the attack; remediation removes it. We eradicate malware and persistence, reset compromised credentials, and close the gap that let the attacker in. Fixes inside your Service Order are done by DAG Tech; anything beyond it comes with step-by-step guidance for your IT team.
- Eradication and credential resets
- Root-cause fix and hardening
- Verified clean before the incident closes
- 06
Report & Improve
Every incident gets a post-incident review under NIST SP 800-61, and its lessons become new detections. A monthly X-SOC report tracks response times, incidents, and open remediation items against your goals.
- Post-incident review
- Monthly KPI and remediation tracking
- Quarterly delivery review
Stage 6 feeds Stage 2: every incident and every remediation makes the next detection sharper.
Every function, covered
How X-SOC maps to the six functions of the NIST Cybersecurity Framework, the standard auditors, insurers, and boards use to judge a security program.
| Function | What X-SOC does | Delivered by |
|---|---|---|
| GOVERN | Response Authority Model, Containment Authority Matrix, escalation paths, and CxO advisory hours. | Core: Response Authority · Reporting & Guidance |
| IDENTIFY | Asset and log-source inventory, vulnerability and attack-surface discovery, SaaS and shadow-IT visibility. | Vuln Mgmt · Workspace Posture · Pen Testing · EASM · Dark Web |
| PROTECT | Email and collaboration security, email authentication, DNS filtering, and security awareness training. | Email Security · DMARC · DNS Filtering · Awareness |
| DETECT | 24/7 monitoring, correlation, and threat hunting across identity, endpoint, cloud, and network. | Core: SOC · SIEM · Endpoint · Identity · Cloud · Hunting |
| RESPOND | Triage, containment under your rules, eradication and remediation, incident command, forensics, and plain-English communication. | Core: Response Authority · Incident Response |
| RECOVER | Verified-clean recovery, backup integrity checks, restore testing, and post-incident review. | Backup Integrity · Incident Response |
- NIST CSF 2.0 ↗Program structure and reporting
- NIST SP 800-61 Rev. 3 ↗Incident handling and post-incident review
- MITRE ATT&CK ↗Detection coverage, hunting, and gap analysis
- CIS Controls v8.1 ↗Hardening and remediation priorities
- Human-verifiedAutomation speeds the work; a DAG Tech analyst confirms every escalation.
- Severity by compromiseAn attacker in an admin account is Critical even when every system is up.
- Your rules, every timeContainment follows the authority you approved. No surprise outages.
- Detections that evolveEvery incident and hunt produces new or better detections.
- Measured, not promisedResponse times are tracked per event and reported monthly.
Service Level Agreement
X-SOC™ Response Targets
Every X-SOC runs to the same response targets, whatever modules you add. Severity is defined by compromise, so an attacker in an admin account is Critical even when every system is still running.
| SEVERITY | ACKNOWLEDGE | TRIAGE COMPLETE | YOU'RE NOTIFIED | CONTAINMENT* |
|---|---|---|---|---|
| CriticalActive compromise: intrusion, ransomware behavior, privileged account takeover, exfiltration | 15 min | 30 min | 30 min | 60 min |
| HighProbable compromise: suspicious privilege escalation, suspected credential exposure | 30 min | 2 hr | 4 hr | 4 hr |
| MediumNeeds investigation, no active compromise: policy violations, config weaknesses | 4 hr | 8 hr | Next bus. day | By agreement |
| StandardInformational findings, hygiene, low-confidence detections, routine requests | 8 hr | 24 hr | Next bus. day | By agreement |
*Containment times apply to actions you pre-authorize (Model B). Under Notify First (Model A), containment starts the moment you approve. Times are mean targets measured quarterly; clocks pause while awaiting your approval or access. Exact terms are set in your Service Order.
Our Commitments
SLA- +24/7/365 SOC, staffed by DAG Tech analysts
- +Severity set by attacker activity, not uptime
- +75% alert when included incident hours run low
- +Log export window after termination
Outside Scope
RUP- −Personal, BYOD, and unmanaged devices
- −End-of-life systems without vendor patches
- −Ransom negotiation or payment
- −Breach notices and regulator, insurer, or counsel communications
Your Side
CUSTOMER- →Keep a reachable after-hours escalation list
- →Provide the access each component needs
- →Keep any platforms you license in good standing
- →Choose a Response Authority Model
Evidence your auditors and insurers will accept
X-SOC findings map to the frameworks you report against. Add the Compliance Evidence & Control Mapping module for audit-ready control mapping.
Pricing
How Much Does an Outsourced SOC Cost?
Every X-SOC is custom-priced as one monthly per-user rate. That rate is set by three things:
Seats
Every user covered by the service is a seat.
Modules you add
The three core services, plus only the modules your risk profile needs.
Platforms you already own
Bring your own EDR, email security, or identity platform and we integrate it.
Term length and onboarding are set in your proposal.
Proposal within 1 business day · No obligation
Compare Your Options
Outsourced SOC vs. In-House SOC vs. MDR
Most managed SOC, MDR, and MSSP quotes look alike on paper. These are the differences that show up during an incident, not during a demo.
Swipe the table sideways to compare →
| CAPABILITY | X-SOC™ | In-House SOC | Typical MDR Provider | Antivirus / DIY |
|---|---|---|---|---|
| 24/7 analyst coverage | Yes | Requires 5+ hires | Yes | No |
| Co-managed with your team | Yes | n/a | Sometimes | No |
| Active Directory attack detections | Named, by technique | If you build them | Often cloud identity only | No |
| Microsoft 365 and Google Workspace | Both | Depends on tooling | Usually one | No |
| Works with tools you already own | Yes | Yes | Own agent preferred | n/a |
| Named delivery lead | Yes | Yes | Pooled analysts | No |
| Penetration testing | Available | Separate vendor | Add-on | No |
| Modular, pay for what you use | 3 core + 23 modules | Build everything | Fixed tiers | No |
| Pricing model | Per seat | Salaries + tools | Per user, modules extra | License only |
Most MDR quotes are fixed tiers: you pay for modules you don't need to get the one you do. X-SOC starts with the same core for everyone and adds only the modules your environment calls for, on one Service Order and one per-user price.
Get Started
Request an X-SOC™ Proposal
Tell us what you need to protect. A senior engineer reviews every request and sends a configured X-SOC proposal within 1 business day. Modules you picked in the builder above are attached automatically.
- 01Scoping call with a solutions architect
- 02The modules you picked, priced as one per-user rate
- 03Response targets and start date in one proposal
Why DAG Tech
The Team Behind X-SOC™
DAG Tech analysts, not a reseller
Your SOC is staffed by DAG Tech people 24/7/365, with US-only or follow-the-sun coverage.
A named delivery lead
One person who knows your environment owns your escalations, your monthly report, and your delivery reviews.
Screened and insured
Staff with privileged access are background-screened, and DAG Tech carries cyber liability insurance.
Works With
The Platforms You Already Own
Already license an EDR, email filter, or identity platform? Keep it. X-SOC connects to 75+ platforms across identity, endpoint, email, cloud, and network, so you never pay twice for the same capability.
MicrosoftSolutions PartnerIdentity & Access10
Productivity & Email8
Endpoint Security6
Device Management8
Network & Firewall9
Zero Trust & Secure Access4
SIEM & Security Platforms3
Vulnerability & Exposure5
Cloud & SaaS Security5
Collaboration & Storage3
Logos are trademarks of their respective owners and indicate platform compatibility, not endorsement.
FAQ
Outsourced SOC Questions, Answered
Is X-SOC™ an outsourced SOC?−
Yes. X-SOC is an outsourced security operations center, also called SOC-as-a-Service or a managed SOC. DAG Tech analysts monitor, triage, and respond to threats in your environment 24/7/365, so you get SOC coverage without hiring, training, or retaining a security team.
We have an internal security team. Is X-SOC™ for us?+
Yes. Mid-market and enterprise teams use X-SOC as a co-managed SOC to augment their analysts. Choose the Co-Managed response model and DAG Tech covers nights, weekends, and escalations alongside your team, on the same SLA and the same 15-minute critical acknowledgement.
What's included in every X-SOC™, and what's optional?+
Every X-SOC includes the 24/7 Security Operations Center, Response Authority & Containment, and Reporting & Strategic Guidance. Twenty-three optional modules cover detection and response, email and user protection, exposure management, data protection and resilience, and governance, so you pay only for what your environment needs.
What's the difference between a managed SOC and MDR?+
Managed detection and response (MDR) usually centers on endpoints and one vendor's agent. A managed SOC like X-SOC correlates signal across identities, endpoints, email, cloud, and logs, works with tools you already own, and can include remediation, vulnerability management, and advisory.
How fast does X-SOC™ respond to a critical threat?+
Critical events are acknowledged within 15 minutes, triaged within 30, and you're notified within 30 minutes of triage. Pre-authorized containment starts within 60 minutes. Critical means active compromise, such as ransomware behavior or a privileged account takeover, even if systems are still up.
What happens when X-SOC™ detects a threat at 2 a.m.?+
An analyst confirms it, then follows the Response Authority Model you chose. Under Notify First, we call your after-hours escalation contact and contain on approval. Under pre-authorized containment, we act immediately on approved actions, such as isolating a device or disabling an account, and notify you after.
Which platforms does X-SOC™ support?+
Microsoft 365, Entra ID, on-premises Active Directory, Google Workspace, Okta, AWS, Google Cloud, Windows and macOS endpoints, and servers. If you already license an EDR, email security, or identity platform, X-SOC integrates it rather than replacing it.
How much does an outsourced SOC cost?+
X-SOC is custom-priced as one monthly per-user rate, set by the modules you add to the three core services and the platforms you already own. Term length and onboarding are set in your proposal, which arrives within 1 business day.
How long does X-SOC™ take to deploy?+
Deployment is completed within 60 days and can take as little as four weeks when access and integrations are provided in the first week. Detection tuning continues for several weeks after go-live without delaying coverage.
Does X-SOC™ help with HIPAA, CMMC, NYDFS 500, or cyber insurance?+
Yes. Monitoring, response, and monthly reporting are aligned to NIST CSF, HIPAA, CMMC, NYDFS 500, PCI DSS, and SOC 2 requirements, and advisory hours can cover gap reviews and insurance readiness. Add the Compliance Evidence & Control Mapping module for audit-ready control mapping, and Cyber Insurance Readiness for underwriting and renewal support.
What security standards does DAG Tech follow?+
DAG Tech maintains an information security program aligned to the NIST Cybersecurity Framework, commits contractually to 24-hour breach notification, background-screens staff with privileged access, and carries cyber liability insurance.
What isn't included in X-SOC™?+
Personal and unmanaged devices, end-of-life systems, application code, ransom negotiation or payment, and breach notification or communication with regulators, insurers, and counsel on your behalf. Incident response beyond your included hours is billed at published rates.
Do I need A+ Animal™ to buy X-SOC™?+
No. X-SOC runs standalone, or on top of A+ Animal™, Diamond IT™, or your internal IT team.
The DAG Tech Product Family
Explore Every Product
About DAG Tech X-SOC™
X-SOC™ is DAG Tech’s managed security operations center: an outsourced SOC that delivers 24/7 SOC monitoring, managed detection and response (MDR), and incident response, staffed 24/7/365 by DAG Tech analysts. Every X-SOC includes three core services (the Security Operations Center, Response Authority & Containment, and Reporting & Strategic Guidance) plus any of 23 optional modules across detection and response, email and user protection, exposure management, data protection and resilience, and governance, including managed SIEM and log retention.
X-SOC is built for mid-market and enterprise organizations. It runs as your full SOC or as a co-managed SOC that augments an internal security team with nights, weekends, and escalation coverage. Unlike an MSSP that only forwards alerts, DAG Tech analysts triage, contain, and remediate under the response authority you set, work with the security tools you already license, and price everything as one custom monthly per-user rate.
X-SOC is delivered 24/7/365 to organizations in New York, Brooklyn, Washington DC, Maryland, Virginia, Boston, Chicago, Miami, Austin, Phoenix, Los Angeles, San Diego, San Francisco, Toronto, London, and Sydney, and across the United States.
Related: managed cybersecurity services, X-Phish™ phishing prevention, A+ Animal™ managed IT.