Build and expand a Security Operations Center as a living facility. Create specialized rooms, hire and vet employees, train teams, allocate scarce specialists, manage budgets and bottlenecks, and keep the operation working while attacks, fatigue and even rare insider threats test the organization you built.
Screenshots are on the way. Follow development on Discord to see them first.
Features
Every room does a job
Triage filters the alert flood, Investigation works the escalations and Incident Response handles the serious cases, while Detection Engineering, Threat Intelligence, Automation and Training feed the chain. You decide which departments exist, how big they get and where scarce floor space goes.
Fix one bottleneck and you expose the next: better Triage can bury Investigation, and more investigators can swamp Incident Response. Find the real constraint instead of adding more people.
Hire with your eyes open
Hiring is a process, not a shop. Screening, interviews, references and security vetting cost time and money, but each step reveals more about a candidate. Skip them to fill seats fast during an expansion, and accept the uncertainty.
Probation shows who people really are through actual work. Training and mentoring build long-term capability, but pulling your best analyst off the floor costs capacity today.
Keep your people standing
Long queues, long shifts and back-to-back incidents wear people down. Stress slows work and dulls accuracy; burnout means leave or a resignation.
You have clear levers: design the shift schedule, add a recovery space, give leave or a raise, automate the repetitive load. Burnout is predictable enough to manage, never a random punishment.
Decide what the SOC can see
Every detection trades sensitivity against noise, and every new log source costs money, capacity and analyst attention. A mature SOC is not one with perfect coverage, but one whose blind spots are understood and chosen.
Automation can enrich, route and close the routine work, but a badly built rule can close an important alert or flood the next queue. Give it high-impact actions only when you trust it.
Contain it before it spreads
Attacks arrive as campaigns that build across many signals, and the earlier you break the chain, the cheaper it is. Disable an account, isolate an endpoint or cut off a whole network segment, knowing aggressive containment can take down the services the business depends on.
Adversaries notice what you block and shift to what you are not watching. Every major incident ends in a review that turns what you missed into improvements you choose to pay for.
Rare insiders, real evidence
Weak vetting and excessive access can let an insider in, but malicious insiders are rare and always leave evidence. Build a case from access history, data movement and interviews while the floor keeps running.
Then decide: keep watching, restrict access, let them go or refer them to the authorities. A wrong accusation hurts the team's morale and the budget more than a right one gains.
Concept Art
Early concept art, not in-game footage. The final look may change.
The SOC as a living facility: analyst floor, server room and briefing room · AI-assisted Incident briefing in front of the threat map · AI-assisted
