--- title: Closing the loop: Why an effective SOC focuses on... description: Managed Detection and Response (MDR) services focus on containing incidents rather than fixing the root cause, Oliver Spence argues. A Hiscox report found 38... canonical: https://daily.dev/posts/closing-the-loop-why-an-effective-soc-focuses-on-remediation-not-just-containment-2eiztpgfd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Closing the loop: Why an effective SOC focuses on remediation, not just containment | daily.dev og:description: Managed Detection and Response (MDR) services focus on containing incidents rather than fixing the root cause, Oliver Spence argues. A Hiscox report found 38... og:url: https://daily.dev/posts/closing-the-loop-why-an-effective-soc-focuses-on-remediation-not-just-containment-2eiztpgfd og:image: https://api.daily.dev/og/posts/2EIzTpgFD.png og:image:alt: Closing the loop: Why an effective SOC focuses on remediation, not just containment og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Closing the loop: Why an effective SOC focuses on remediation, not just containment **[IT Security Guru](https://daily.dev/sources/itsecurityguru)** · 4 min read · 0 upvotes · 0 comments ## Summary Managed Detection and Response (MDR) services focus on containing incidents rather than fixing the root cause, Oliver Spence argues. A Hiscox report found 38 percent of UK organisations suffered a cyberattack in the past year, despite the average UK firm spending £44,294 on resilience and a UK cyber services market worth approximately £8.4 billion annually. Spence says containing an incident, like isolating a device after an unpatched vulnerability is exploited, leaves the underlying weakness in place. He proposes 'MDR+R', where providers also remediate root causes, and suggests organisations apply a three-year test: ask whether known weaknesses have actually been closed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### what's the difference between containment and remediation in incident response Containment stops the immediate threat, such as isolating a compromised device and removing malicious files, while remediation fixes the underlying weakness that let the attack happen, like patching the vulnerability or correcting a misconfiguration. Without remediation, restoring a system to its prior state also restores the security gap, leaving organizations open to repeat attacks. _Teams weighing MDR providers can track this containment-versus-remediation debate on daily.dev._ ### what percentage of UK organisations have suffered a cyber attack in the past year 38 percent of UK organisations suffered a cyberattack in the past year, according to a Hiscox Cyber Readiness Report. This came despite the average UK firm spending £44,294 on cyber resilience measures, highlighting a gap between security spend and actual outcomes. _Security leaders benchmarking their own exposure follow stats like this on daily.dev._ ### how much is the UK outsourced cyber security services market worth The UK cyber services market, which includes managed security service providers (MSSPs), is worth approximately £8.4 billion annually, based on UK government sectoral analysis. This reflects how heavily UK organisations rely on outsourced experts rather than managing security entirely in-house. _Those evaluating outsourced security spend track market context like this on daily.dev._ ## Similar posts on daily.dev - [SA’s cybersecurity triple bind: more threats, less talent, tighter regulation](https://daily.dev/posts/sa-s-cybersecurity-triple-bind-more-threats-less-talent-tighter-regulation-ripcqhoin) · TechCentral · 0 upvotes · 0 comments - [How Threat Research and MDR Help SMBs Build a Defensive Edge](https://daily.dev/posts/how-threat-research-and-mdr-help-smbs-build-a-defensive-edge-uk19f1r0j) · BleepingComputer · 0 upvotes · 0 comments - [The containment paradox: Why your ransomware playbook has the wrong people in charge](https://daily.dev/posts/the-containment-paradox-why-your-ransomware-playbook-has-the-wrong-people-in-charge-lvxepxnng) · CSO Online · 0 upvotes · 0 comments - [A Day in the Life of an MDR Analyst: Rapid7 Cybersecurity Summit Panel](https://daily.dev/posts/a-day-in-the-life-of-an-mdr-analyst-rapid7-cybersecurity-summit-panel-3jln8ehlv) · Rapid7 Cybersecurity Blog · 0 upvotes · 0 comments - [The cybersecurity industry built a $200B business selling you problems. Nobody got paid to fix them.](https://daily.dev/posts/the-cybersecurity-industry-built-a-200b-business-selling-you-problems-nobody-got-paid-to-fix-them--6dueydy5v) · The Next Web · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/closing-the-loop-why-an-effective-soc-focuses-on-remediation-not-just-containment-2eiztpgfd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Closing the loop: Why an effective SOC focuses on remediation, not just containment","url":"https://daily.dev/posts/closing-the-loop-why-an-effective-soc-focuses-on-remediation-not-just-containment-2eiztpgfd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/closing-the-loop-why-an-effective-soc-focuses-on-remediation-not-just-containment-2eiztpgfd"},"datePublished":"2026-10-29T15:35:26.465Z","dateModified":"2026-10-29T15:41:42.187Z","description":"Managed Detection and Response (MDR) services focus on containing incidents rather than fixing the root cause, Oliver Spence argues. A Hiscox report found 38...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1773d91441de882fcc1b66b778bff5fc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1773d91441de882fcc1b66b778bff5fc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"IT Security Guru","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"IT Security Guru","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ae9fe7d07c814192b35f86ad698fb374","url":"https://daily.dev/sources/itsecurityguru"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/closing-the-loop-why-an-effective-soc-focuses-on-remediation-not-just-containment-2eiztpgfd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"IT Security Guru","item":"https://daily.dev/sources/itsecurityguru"},{"@type":"ListItem","position":3,"name":"Closing the loop: Why an effective SOC focuses on remediation, not just containment"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/closing-the-loop-why-an-effective-soc-focuses-on-remediation-not-just-containment-2eiztpgfd#faq","mainEntity":[{"@type":"Question","name":"what's the difference between containment and remediation in incident response","acceptedAnswer":{"@type":"Answer","text":"Containment stops the immediate threat, such as isolating a compromised device and removing malicious files, while remediation fixes the underlying weakness that let the attack happen, like patching the vulnerability or correcting a misconfiguration. Without remediation, restoring a system to its prior state also restores the security gap, leaving organizations open to repeat attacks. Teams weighing MDR providers can track this containment-versus-remediation debate on daily.dev."}},{"@type":"Question","name":"what percentage of UK organisations have suffered a cyber attack in the past year","acceptedAnswer":{"@type":"Answer","text":"38 percent of UK organisations suffered a cyberattack in the past year, according to a Hiscox Cyber Readiness Report. This came despite the average UK firm spending £44,294 on cyber resilience measures, highlighting a gap between security spend and actual outcomes. Security leaders benchmarking their own exposure follow stats like this on daily.dev."}},{"@type":"Question","name":"how much is the UK outsourced cyber security services market worth","acceptedAnswer":{"@type":"Answer","text":"The UK cyber services market, which includes managed security service providers (MSSPs), is worth approximately £8.4 billion annually, based on UK government sectoral analysis. This reflects how heavily UK organisations rely on outsourced experts rather than managing security entirely in-house. Those evaluating outsourced security spend track market context like this on daily.dev."}}]} ```