What is threat detection?

Threat detection is the process of identifying cyber threats in real time through analysis of network traffic, system logs and anomalous behavior. It is the operational heart of a Security Operations Center (SOC).

How does the Fidem SOC work?

The Fidem SOC operates 24/7 with dedicated analysts and AI triage. It collects data from the Sensor (internal network), XT (external surface), endpoints and application logs. Every alert is classified by priority and handled according to incident response procedures.

AI triage is the artificial intelligence system that automatically pre-analyzes and classifies security alerts, separating false positives from real threats. It reduces response time and lets human analysts focus on critical incidents.

Does the SOC replace the internal IT department?

No. The SOC deals specifically with security: threat monitoring, incident response and forensic analysis. The internal IT department keeps managing infrastructure, help desk and daily operations. The two teams work together.

Managed SOC and MDR: continuous monitoring for your company

Managed CSOC Service

Experience, technology and security for your data for your infrastructure for your customers for your business for your digital future

Managed security
for your Infrastructure.

Our Intrusion Detection service, managed by our CSOC and integrated with the Defensio® ecosystem, provides continuous protection for your IT infrastructure. We monitor the network in real time, detecting threats with advanced technologies, behavioral analysis and threat intelligence, ensuring a proactive approach to cybersecurity.

your Hybrid Defense.

With our hybrid methodology we combine advanced technologies and human supervision to tell real threats from false positives, detecting anomalous behavior, intrusion attempts and malicious activity. This approach ensures complete defense, overcoming the limits of automated solutions and ensuring precise responses to security incidents.

your Layered Defense.

The Intrusion Detection service, combined with our Email Security and Endpoint Protection services, provides layered defense to protect company infrastructure. Monitored by our CSOC, this integrated approach ensures continuous protection against cyber threats, going beyond automated solutions.

Which threats do we detect?

Suspicious activity and insider threats: anomalous behavior of devices and users that could indicate a compromise
Network attacks: port scanning, intrusion attempts, DDoS attacks, exploits of known vulnerabilities.
Botnets and C2: networks of infected computers or devices used to launch attacks.
Malware: viruses, trojans, ransomware, spyware and other forms of malicious software.
Data exfiltration: unauthorized attempts to transfer data to the Internet.

How does it work?

Threat intelligence: our systems update in real time from online databases, ensuring continuous protection against the latest threats and targeted attacks
Deep traffic analysis: our systems analyze every data packet entering and leaving your network to identify anomalous traffic and potential threats.
Behavioral analysis: our experts and our systems analyze the behavior of users and systems to identify suspicious activity and anomalies.
Signature detection: we use up-to-date databases of known attack signatures to quickly identify common threats.

Next-Generation Threat Detection

Fidem’s Next-Gen Threat Detection & SOC service is the evolution of the traditional SIEM (Security Information and Event Management) towards a proactive, AI-based detection model. Unlike traditional rule-based systems that can only detect known threats, our detection engine combines signature matching, behavioral analysis and machine learning to identify even zero-day threats and the most sophisticated evasion techniques.

The Platform: Defensio SOC

The service is delivered through Defensio SOC, the command center of the Defensio ecosystem: telemetry from sensors and network sources is correlated to reconstruct the complete kill chain of an attack, the multi-stage AI pipeline filters out the noise and brings to the analysts only what deserves a human decision, and every response recommendation goes through human approval, never blind automation. Architecture, control room modules and operating modes are described on the platform page: Defensio SOC & MDR.

Next-Gen SOC and NIS2 Compliance (Italian Legislative Decree 138/2024)

Fidem’s Next-Gen Threat Detection & SOC service directly meets the obligations of Art. 21 of Legislative Decree 138/2024 (NIS2) on continuous monitoring and incident management:

Continuous monitoring: the platform monitors your infrastructure continuously, an explicit Art. 21 requirement for essential and important entities.
Incident detection and response: the multi-layer detection engine identifies significant threats and starts the managed incident response procedure, including support for the mandatory notification to CSIRT Italia within 24 hours.
Multi-source correlation: central collection of logs from firewalls, endpoints, DNS, email and network sensors meets the obligation of centralized security event management.
Evidence pack for ACN: the service produces continuous documentation of the alerts handled, incident responses and monitoring activities, essential for the inspections by Italy’s National Cybersecurity Agency planned from the end of 2026.

Assessing NIS2 compliance? Discover the complete NIS2 compliance path with Fidem, from Gap Analysis to operational implementation.

What is a managed SOC?

A managed SOC is the service through which an external provider continuously monitors a company’s systems, separates the alerts that matter from the noise and acts when needed, without the company having to build an internal department. That is the whole difference from a detection product: the technology generates warnings, the SOC decides which ones deserve a reaction and carries it out.

This is why installing an EDR without oversight does not produce security: alerts pile up and nobody reads them. The value is not in the tool, it is in who watches it.

SOC, SIEM, MDR: the differences in one line each

SIEM: the technology that collects and correlates logs. It is a component, not a service.
SOC: the function (people + processes + technology) that monitors and decides. It can be internal or managed.
MDR: the managed SOC that also includes response, not just detection: isolating a machine, blocking an account, containing.

The practical question to ask a provider is not which SIEM it uses, but who answers at three in the morning and with what mandate: whether they can only warn or also act.

How much does a managed SOC cost?

The cost is sized on how much there is to monitor and how broad the response mandate is, not on a per-user license. The variables that move the quote:

Sources to monitor: endpoints, servers, firewalls, cloud, identities.
Hours covered: business hours or around the clock.
Mandate: notification only, or managed response with the power to isolate.
Log retention: how long logs remain searchable, which is what makes it possible to reconstruct an incident afterwards.
Regulatory obligations: whether you need to produce evidence for NIS2 or for a customer who asks for it.

In-house or managed: how to decide

An in-house SOC makes sense when the company can afford three shifts of trained people. Below that threshold, oversight exists on paper and not in practice: night and weekend alerts go unread, which is exactly when they arrive.

The hybrid model, technology in-house and monitoring outsourced, is the one most often chosen by companies that have already invested in tools and do not want to throw them away.

What the SOC needs to work

Oversight is effective only if it receives the right data: authentication logs, endpoints, perimeter. The sources that feed the service are the same ones that cover the other controls, endpoint protection, email security and log analysis, which is why the SOC is usually activated after, not before, an exposure assessment.

What a managed SOC does NOT cover

The SOC detects and contains, it does not repair: fixing vulnerabilities and restoring systems remain separate activities, usually the IT provider’s, as does backup. It does not replace offensive testing (penetration testing). And when a fact has to be established with evidential value, such as unauthorized access or data theft, the activity is a different one: a digital forensic examination, which requires repeatable acquisition and chain of custody.

The platform: Defensio SOC

The service is delivered on the proprietary Defensio SOC platform: telemetry from sensors and scan engines is analyzed by a pipeline that brings to the analysts only what deserves a human decision, with AI processing entirely on-premise, so data never leaves the infrastructure. It is available as an MDR service managed by Fidem or under license, for those who want to run it with their own team.

Full product data sheet: SOC as a service · passive network probe.

The terms on this page are defined in the cybersecurity glossary.