SOC Maturity & Detection Coverage Assessment
An honest measurement of what your monitoring can actually see — telemetry gaps, alert quality, ATT&CK coverage, false-positive burden and triage reality — producing a picture of your true detection surface rather than your intended one.
Verified Solvex Specialist
Verified by SolvexDirect specialist contact for Solvex engagements
What this means. An authorized Solvex administrator registered and approved this exact public identity. What it does not. Solvex has not inspected the account on the platform, and this is not the platform's own verification.
Solvex specialists never ask for your passwords, recovery phrases, one-time codes, or payments to a personal account. Work, scope and invoices are agreed in writing through the official channels on this site.
What's covered
- Telemetry inventory and coverage gap analysis
- Alert quality review: precision, actionability and duplication
- MITRE ATT&CK coverage mapping against deployed detections
- Triage workflow and analyst experience assessment
- False-positive burden measurement and its cost in analyst hours
- Escalation effectiveness and response readiness
- Automation and orchestration maturity
- Case management and metrics review
What you receive
- Maturity assessment scored against a stated, transparent model
- ATT&CK coverage heat map: detected, partial, blind
- Alert quality analysis with the worst offenders named
- Telemetry gap list prioritised by detection value per unit of cost
- Prioritised improvement roadmap
- Executive summary suitable for a board
Evidence and reporting
How the work is kept honest- Evidence, frozen at issuanceFindings tie to something observed. When the report is issued, the evidence behind it is frozen in the same transaction and cannot be edited afterwards.
- A signed reportAn Ed25519 signature covers both the report content and the delivered file. Alter a byte of either and verification fails.
- Written scope firstAdvisory work runs to a written scope agreed before it starts, so what you receive is what was agreed.
Anyone holding a Solvex report can verify it publicly without seeing its contents.
Our boundaries
What this engagement does not do, stated before it starts.
- Assessment reflects the environment and detections in place at the time of review
- Coverage mapping indicates detection capability, never a guarantee of detection
- Implementing the recommendations is a separate engagement
- We do not grade against a vendor maturity model designed to sell that vendor's product
How this engagement runs
- 01
Intake
Tell us the system, the goal and the constraints. If the work is not a good fit, we say so before anyone is invoiced.
- 02
Scope and authorization
Written scope and signed authorization before anything is touched. Security testing runs only against systems you own or are contractually entitled to have tested.
- 03
Investigation or build
Specialists matched to the work. Findings are proven by hand — scanner output is a lead, never a finding.
- 04
Evidence
Every finding ties to something observed. When a report is issued, its evidence is frozen in the same transaction, so what backed the report cannot change afterwards.
- 05
Delivery
A signed report: an Ed25519 signature over both the content and the file, with a short verification reference you can read down a phone.
- 06
Verification and retest
Anyone holding the report can verify it publicly without seeing its contents. Fixes are retested as part of the engagement — “fixed” means we confirmed it.
Questions we are asked
- Our dashboard shows 90% ATT&CK coverage. Is that real?
- Usually not. Most coverage figures count whether a detection exists, not whether it fires on a real technique, survives obvious evasion, or reaches an analyst who acts. We test the claim rather than restating it, and the honest number is normally lower and far more useful.
- What is the most common finding?
- Alert fatigue with a specific cause: a small number of noisy rules producing the majority of volume, which trains analysts to close alerts quickly, which is precisely how the real one gets closed too. Fixing a handful of rules often transforms the operation.
- Is this the same as a purple team exercise?
- Complementary. Purple teaming tests whether specific techniques are detected in practice. This assesses whether the operation around detection — telemetry, tuning, triage, escalation — is capable of doing its job at all. They pair well and answer different questions.
Related services
SOC / Detection
SOC Design & Security Operations Architecture
The operating model for detection and response — telemetry planning, SIEM architecture, alert pipeline, case management, escalation paths and the playbooks that turn an alert into a decision rather than a notification nobody owns.
SOC / Detection
Managed Detection Engineering & SOC Enablement
Detection-as-code delivered as an ongoing engineering practice — version-controlled Sigma and platform rules, telemetry onboarding, tuning against real alert data, and the lifecycle that stops detections rotting the moment the environment changes.
Offensive / Testing
Purple Team Engagement
Red and blue working side by side. We run realistic attack techniques while your defenders watch, measure and tune detection in real time — turning a single test into a lasting uplift in your detection coverage.