Follow-the-Sun SOC vs. Local SOC: Who's Watching at 3 am?

The bottom line

I have spent more than fifteen years in managed security services, governance and risk, and enterprise architecture. In all that time, one question has decided more outcomes than any tool, feed or dashboard: when the attack starts at 3 am on a Sunday, is a trained analyst already awake, at a desk, looking at it?

Two models, one label

A SOC is the team and tooling that watches an organisation's systems for signs of attack and responds when it finds one. The tooling never sleeps. Your SIEM platform, which collects and correlates logs, and your EDR agents on laptops and servers will raise alerts at any hour. The question is what happens to an alert when it lands.

In the first model, which I will call the local pager model, analysts sit at their desks for roughly eight hours a day, seven days a week, typically something like 08:00 to 16:00 local time. Outside that window, high severity alerts trigger a page to an on call analyst. That person is usually at home, often asleep, and is expected to wake, log in, work out what is going on and decide whether to escalate.

In the second model, a Five Eyes follow the sun SOC, there are teams in several of the Five Eyes countries. Each works ordinary daytime hours in its own time zone and hands the live queue to the next team in sequence. Somebody fully awake, on shift and in context is always at a desk.

Both providers can honestly print "24/7" on the brochure. The difference is what the number counts.

Put the two clocks over a full week and the gap becomes stark. The pager model has an analyst awake at a desk for 56 of the week's 168 hours, which is one third. For the other 112 hours, coverage depends on a phone, a sleeping person and a home network connection.

When attackers choose to work

Attackers are not guessing about this. They choose their moment, and the moment is when you are least likely to notice.

Microsoft's threat intelligence team says attackers deliberately time campaigns for periods when people are distracted, rushed and more trusting, and that these seasonal patterns show up consistently in its telemetry [8]. SentinelOne's researchers make the same point about the final stage of an attack: ransomware operators invest in faster encryption precisely because the sooner it finishes, the less likely a defender is to notice and stop it [9].

The arithmetic of the calendar does the rest. A Monday to Friday, 09:00 to 17:00 week is 40 hours out of 168, so roughly 76 per cent of the week sits outside business hours. Under the pager model, 112 hours a week, two thirds of it, have nobody awake at a desk. An attacker who wants to avoid a human being does not need to be clever about timing. Almost any evening will do.

Public incident reports rarely publish consistent counts of intrusions by hour of the day, and I am not going to invent them. What I can show precisely is the exposure. The heatmap below plots, hour by hour across an Australian week, who is awake at a desk. Switch between the two models to compare.

Under the pager model, the red squares are where the most damaging moments of an attack are most likely to land, because they are where attackers can be most confident that nobody is watching. A follow the sun model turns every square blue.

Global campaigns follow the same logic. CISA reports that the CL0P group began mass exploitation of the MOVEit Transfer vulnerability on 27 May 2023 [27]. That was the Saturday of the Memorial Day long weekend in the United States, and the Sunday morning of an ordinary weekend here.

Speed is what turns this exposure into harm. Palo Alto Networks' Unit 42 found that in a quarter of the incidents it handled in 2024, data was stolen in under five hours, and in about one in five it took less than an hour [2]. An unstaffed night under the pager model lasts sixteen.

The arithmetic of speed

SOC performance is usually reported through a handful of "mean time to" measures. Mean time to detect is how long it takes for malicious activity to be noticed. Mean time to acknowledge is how long before a person picks the alert up. Triage is the work of deciding whether it is real and how serious it is. Containment is the action that stops the spread, such as isolating a host or disabling an account. Response covers everything after that, through to recovery. Each step needs a human, and in the pager model each step at night starts with waking one up.

Now look at the attacker's clock. Unit 42's 2026 Global Incident Response Report, drawn from more than 750 major incidents in over 50 countries, found the fastest attackers moved from initial access to data exfiltration in 72 minutes, four times faster than the year before [1]. Palo Alto Networks has separately described attacks that achieved their objectives, including full data theft, in as little as 25 minutes [10]. Microsoft measured a median of 1 hour and 12 minutes between a victim opening a phishing email and the attacker reaching their private data [7].

The trend matters as much as the snapshot. In its 2024 report, Unit 42 found the median time from compromise to exfiltration had fallen from nine days in 2021 to two days in 2023, with roughly 45 per cent of cases seeing data leave within a day [3].

Against that clock, I want to be precise about what a pager costs. There is no industry dataset that measures the nighttime response of paged analysts across providers, so the figures below are a model, built from steps I have watched play out many times. Treat them as assumptions to challenge, not as findings.

On those assumptions the pager adds around 40 minutes in a typical case, and more than an hour and a half on a bad night. In other words, on a typical night the paged analyst starts containing an incident at roughly the moment the fastest attackers Unit 42 has studied are finishing theirs.

A pager does not just add delay. It adds delay at exactly the hours attackers have chosen to work.

Grant Hutchons

There is a fair counterpoint. Most intrusions are not sprints. Microsoft's 2025 Digital Defense Report puts average dwell time, the period an attacker sits undetected, at 12 days, and Unit 42 reported a median of 13 days for 2023 [4][3]. That sounds like plenty of time. It is actually the strongest argument for an awake SOC. A long dwell time means there were days of quieter signals, an odd login, a new scheduled task, an unusual data transfer, that never crossed the threshold that wakes someone up. An analyst on shift works the medium severity queue all night. A pager only fires on the loud ones, and by the time an alert is loud the attacker is usually close to the end of the chain.

The same Microsoft report found that only 54 per cent of organisations engaged their response teams within three days of detecting a compromise [4]. Meanwhile Microsoft saw human operated ransomware encounters rise 2.75 times while the share of attacks reaching the ransom stage fell threefold, and in more than 90 per cent of attacks that did reach that stage the attacker used unmanaged devices for initial access or remote encryption [6]. My reading is simple. Attacks that someone is watching, and interrupts early, rarely become ransom events. Unit 42 found 86 per cent of the major incidents it handled in 2024 caused operational downtime, reputational damage or financial loss [2]. Interruption is the whole game.

The people on the night shift

I want to be careful here, because this section is about people I respect. Analysts who carry a pager or work permanent nights are usually dedicated, often junior, and frequently doing it because the model gives them no other option. The problem is not their commitment. It is biology, and no amount of commitment changes biology.

Start with simple fatigue. In a study published in Occupational and Environmental Medicine, Williamson and Feyer found that after 17 to 19 hours without sleep, performance on some tests was equivalent to or worse than at a blood alcohol concentration of 0.05 per cent [22]. A paged analyst woken at 02:00 after a full day is in that territory, and is being asked to make containment decisions about a production environment.

Then add sleep inertia, the grogginess that follows abrupt waking. A 2019 review in Nature and Science of Sleep found the most significant effects occur within 30 minutes of waking, that impairment can match or exceed that seen after a full night without sleep, and that people tend to feel alert before their performance actually recovers [24]. That last finding matters in a SOC. The person most confident they are ready may not be.

Being on call costs sleep even on nights when the phone stays silent. A systematic review led by Hall and colleagues concluded that on call work adversely affects sleep quantity and, in most studies, sleep quality [25]. Anticipation alone is enough to fragment rest.

Over longer periods, the evidence becomes more serious. Folkard and Tucker's analysis of shift work and safety found the relative risk of incidents was around 30 per cent higher on night shifts than morning shifts, and 36 per cent higher on a fourth successive night than on the first [23]. The International Agency for Research on Cancer classifies night shift work as probably carcinogenic to humans, Group 2A, citing disruption of circadian rhythms as the key mechanism [26].

Now combine fatigue with alert volume. An IDC survey of 350 security operations staff found that 45 per cent of the alerts enterprise teams receive are false positives, that analysts spend around half their time on them, and that 35 per cent of enterprise analysts, and 44 per cent at managed service providers, ignore alerts when their queues overflow. Three in four said they worry about missing incidents [11]. Gartner has warned that cybersecurity professionals face unsustainable stress, predicting that nearly half of cyber leaders would change jobs by 2025, a quarter of them leaving for different roles entirely, and that a lack of talent or human failure would be responsible for over half of significant incidents [12].

The knock on effect is direct. Tired analysts miss things, burnt out analysts leave, and every departure takes tribal knowledge about your environment with it. A follow the sun model does not make SOC work easy. It does mean nobody has to do it at 3 am, and in my experience that single change does more for detection quality and retention than any wellbeing programme layered on top of a night roster.

Seeing it coming

Timing works in the defender's favour too, if you are set up to use it. Because Australia starts its day ahead of Europe and the Americas, a campaign that begins against organisations in London or Toronto during their working day is happening during our night. Analysts in those regions, working the same platform and the same detection content, see it first.

In a follow the sun SOC, that observation does not wait for a morning briefing. The analyst who triages the first case in the United Kingdom writes the detection, adds the indicators and hunts across every client environment, including Australian ones, before Australia wakes up. The relay works in the other direction as well: activity first seen in the Asia Pacific morning reaches the British shift with hours of context already attached.

Scale matters too. Microsoft says it processes more than 100 trillion security signals a day [5]. The principle holds for any SOC: the more environments and time zones your analysts watch, the sooner they recognise a campaign the second time it appears.

There is also a government layer. The cyber agencies of the Five Eyes nations, the Australian Signals Directorate's Australian Cyber Security Centre, the United Kingdom's National Cyber Security Centre, the Canadian Centre for Cyber Security, New Zealand's National Cyber Security Centre and, in the United States, CISA, the NSA and the FBI, routinely publish joint advisories. The July 2024 advisory on the state sponsored group APT40, for example, was led by ASD's ACSC and jointly sealed by agencies from all five nations, alongside partners in Germany, Korea and Japan [28]. Advisories released in a northern hemisphere morning arrive in the Australian evening. An awake shift can read, test and deploy the guidance the same night. A pager model will usually pick it up the next day.

I do not want to overstate this. Agency advisories are public, and any good SOC reads them. The advantage is not secret access. It is that a team spread across five countries sees more client environments, in more sectors, at more hours, and has someone awake to act on what it sees.

Your legal clock

For boards, risk committees and anyone who signs off a regulatory notification, this is where the operating model stops being a technical preference. Australian obligations are measured in hours, and the clocks do not pause overnight.

The volume is not theoretical either. ASD received more than 84,700 cybercrime reports in the 2024 to 2025 financial year, about one every six minutes, and 13 per cent of the incidents it responded to involved critical infrastructure [13][14]. The OAIC received 1,205 data breach notifications in calendar 2025, the highest since the scheme began, and 716 of them stemmed from malicious or criminal attacks [15]. In its July to December 2024 report, 66 per cent of breaches were identified within 30 days of occurring, and 52 per cent were notified to the OAIC within 10 days of the organisation becoming aware [16].

Two points deserve emphasis. First, these clocks generally start when you become aware of an incident. It is tempting to think a slower SOC buys time because awareness comes later. I would not want to make that argument to a regulator, and I would not want a board to rely on it. I would expect any regulator to ask when an organisation ought reasonably to have known. Second, the deadline is not the real risk. The real risk is submitting a report built on thin facts gathered by one tired person, then spending weeks correcting it.

Cost and resilience

It would be easy to make the cost argument sound one sided. It is not, and buyers deserve the honest version.

Keeping one seat occupied around the clock needs 8,760 hours of work a year. Under the National Employment Standards a full-time employee works 38 ordinary hours a week, with four weeks of annual leave and ten days of personal and carer's leave [29]. Take out leave, public holidays and a modest training allowance and each analyst delivers roughly 1,634 productive hours. The arithmetic follows in the table.

Three things come out of those numbers. A genuine local 24/7 roster needs about three times the analysts of a day shift with a pager. That cost gap is the commercial reason the pager model exists, and why it is so often sold under a 24/7 label. Follow the sun needs the same total hours as a local 24/7 roster, so it is not free, but every one of those hours is worked in daylight, without night penalty rates, and a provider can spread the cost across many clients in a way a single organisation cannot.

Resilience is the part buyers underestimate. A small local team is exposed to a single point of failure in a way that is easy to miss on a sales slide. One analyst on sick leave, one flu season, one resignation, one regional power outage, flood or bushfire, and coverage collapses. A follow the sun SOC has other regions that can absorb load, and an Australian team working daylight hours with continuity cover from New Zealand reduces dependence on any single site.

The honest objections

I hear the same concerns about offshore analysts in almost every conversation, and most of them are legitimate. A follow the sun model has to earn trust on each one, and it does not help anyone if a provider waves them away.

Data sovereignty and residency come first. In a well-designed model, your security data stays where it is today, in Australian hosted platforms. Analysts in other countries access it remotely, under role based access controls, with every session logged and auditable. Nothing needs to be copied offshore for an analyst to triage an alert.

Privacy is more nuanced, and I would rather be precise than reassuring. The Office of the Australian Information Commissioner's guidance on Australian Privacy Principle 8 explains that providing personal information to an overseas recipient that is a separate legal entity is a cross border disclosure, that the reasonable step is usually an enforceable contract requiring the recipient to handle the information in line with the Australian Privacy Principles, and that under section 16C the Australian organisation generally remains accountable if the recipient breaches them [21]. Whether a given remote access arrangement counts as a disclosure is a question for your privacy counsel. A credible provider will put those contractual commitments on the table without being asked.

Handover quality is the objection I take most seriously, because it is a real failure mode. Context can be lost between shifts. The answer is discipline: overlapping shifts so people talk rather than just write, a single case record that every region works from, and handover notes that are reviewed rather than filed. Ask to see them.

Accountability should be simple. You should have one contract, one named service owner in Australia and one escalation path, regardless of which region happens to be on shift.

The goal is not offshore or onshore. It is an awake, accountable analyst, with your data staying where you need it.

Grant Hutchons

A buyer's checklist

These are the questions I would ask any provider claiming 24/7 coverage, including my own team. Ask for written answers and evidence, not adjectives.

1. At 03:00 on a Sunday, how many analysts are logged in and actively working the queue for my environment?Ask for a number, a location and a recent roster, not "we have 24/7 coverage".
2. Which alerts page someone overnight, and what happens to everything below that threshold?If medium severity alerts wait until morning, you have a day shift with an alarm.
3. What are your measured acknowledgement and containment times, split by business hours and after hours?A single blended average hides the night. Ask for twelve months of data.
4. How many hours is a paged analyst expected to work after being woken?Then ask what happens the next day. Fatigue does not end when the incident does.
5. Can your analysts contain without waking my team?Agree containment actions in advance, by asset class, so the clock is not spent waiting for approval.
6. Where do my logs and case data live, and who can access them from where?Ask for the data flow, the access model and the audit evidence.
7. What contractual privacy commitments apply to analysts outside Australia?Look for APP aligned handling terms and a clear answer on accountability.
8. How is a live incident handed over between shifts?Ask to see an anonymised handover record and the overlap time between shifts.
9. Who will help me meet a 12 hour SOCI or 72 hour CPS 234 deadline at 2 am?Ask who drafts the facts, who reviews them, and how quickly.
10. What happens when your Australian site has an outage or an illness wave?Ask how another region takes the load and how quickly.

Where this leaves you

The evidence points one way. Attackers deliberately work when defenders are distracted or away. They move from foothold to stolen data in hours, sometimes in minutes. Australian law asks for facts in hours. And the people we ask to cover the night with a pager are working against their own biology.

A local SOC with a pager is not a bad thing to have. It is a reasonable model for some organisations, at some risk levels, if it is described honestly. The problem is the label. When "24/7" means an analyst is awake for a third of the week, buyers are making risk decisions on a misunderstanding, and boards are signing off coverage they do not have.

Ask the questions. Look at the roster. Compare the after hours numbers.

References

1. Palo Alto Networks, "2026 Unit 42 Global Incident Response Report", blog, 17 February 2026. paloaltonetworks.com; see also Unit 42, "The Speed Gap: Where Strategy Meets Reality". unit42.paloaltonetworks.com
2. Palo Alto Networks, "2025 Unit 42 Incident Response Report: Attacks Shift to Disruption", 25 February 2025. paloaltonetworks.com
3. Palo Alto Networks, "Today's Attack Trends: Unit 42 Incident Response Report", 28 February 2024. paloaltonetworks.com
4. Microsoft, Microsoft Digital Defense Report 2025. microsoft.com
5. Microsoft On the Issues, "Extortion and ransomware drive over half of cyberattacks", October 2025. blogs.microsoft.com
6. Microsoft Security Insider, "10 essential insights from the Microsoft Digital Defense Report 2024". microsoft.com
7. Microsoft Digital Defense Report 2022, as reported by MSPoweruser, "Microsoft warns M365 users of growing phishing crimes in new Digital Defense Report". mspoweruser.com
8. Microsoft Security Insider, "Holiday cyberattack risks for organisations", 9 December 2025. microsoft.com
9. SentinelOne Labs, "Crimeware Trends: Ransomware Developers Turn to Intermittent Encryption to Evade Detection", 8 September 2022, updated 6 May 2025. sentinelone.com
10. Palo Alto Networks, "The Ransomware Speed Crisis", 24 September 2025. paloaltonetworks.com
11. IDC survey sponsored by FireEye, "Automating Threat Detection Desired for Security Analysts Battling Fear of Missing Incidents and Security Operations Center Inefficiency", Business Wire, 16 February 2021. businesswire.com
12. Gartner, "Gartner Predicts Nearly Half of Cybersecurity Leaders Will Change Jobs by 2025", 22 February 2023. gartner.com
13. Australian Signals Directorate, Annual Cyber Threat Report 2024 to 2025, as summarised by Cyber Daily. cyberdaily.au
14. Australian Signals Directorate, Annual Cyber Threat Report 2024 to 2025: factsheet for critical infrastructure. cyber.gov.au
15. Office of the Australian Information Commissioner, "Data breach notifications increase to all time high in 2025", 6 July 2026. oaic.gov.au
16. Office of the Australian Information Commissioner, Notifiable Data Breaches Report, July to December 2024. oaic.gov.au
17. Office of the Australian Information Commissioner, "The NDB scheme: an overview" (section 26WH assessment). oaic.gov.au
18. Cyber and Infrastructure Security Centre, Mandatory Cyber Incident Reporting guidance. cisc.gov.au
19. Bright Law, "Breach notification by APRA regulated institutions under CPS 234 Information Security". brightlaw.com.au
20. Clyde & Co, "Introduction of Mandatory Ransomware and Cyber Extortion Payment Reporting", September 2025. clydeco.com
21. Office of the Australian Information Commissioner, APP Guidelines Chapter 8: Cross border disclosure of personal information, version 1.3, October 2025. oaic.gov.au
22. Williamson AM, Feyer AM. Moderate sleep deprivation produces impairments in cognitive and motor performance equivalent to legally prescribed levels of alcohol intoxication. Occupational and Environmental Medicine, 2000. pmc.ncbi.nlm.nih.gov
23. Folkard S, Tucker P. Shift work, safety and productivity. Occupational Medicine, 2003. pubmed.ncbi.nlm.nih.gov; figures as summarised by Interdynamics
24. Hilditch CJ, McHill AW. Sleep inertia: current insights. Nature and Science of Sleep, 2019;11:155 to 165. dovepress.com
25. Hall SJ, Ferguson SA, Turner AI, Robertson SJ, Vincent GE, Aisbett B. The effect of working on call on stress physiology and sleep: a systematic review. Sleep Medicine Reviews. vuir.vu.edu.au
26. International Agency for Research on Cancer, IARC Monographs Volume 124: Night Shift Work, questions and answers, 2019. iarc.who.int
27. CISA, Advisory AA23 158A: CL0P Ransomware Gang Exploits CVE 2023 34362 MOVEit Vulnerability. cisa.gov
28. CISA, "CISA and Partners Join ASD's ACSC to Release Advisory on PRC State Sponsored Group, APT 40", 8 July 2024. cisa.gov
29. Fair Work Commission, National Employment Standards. fwc.gov.au

Vendor research is drawn only from Microsoft, Palo Alto Networks and SentinelOne, alongside analyst firms, Australian Government and regulator sources, and peer reviewed research. Modelled figures are labelled as illustrative throughout. Regulatory summaries are general information and not legal advice. Statistics were checked against the cited sources in October 2026.