Future Operations Center Interest Group

The future of security operations is virtual
A practical playbook for building a virtual GSOC that delivers speed, accuracy, and resilience

CONTENTS

Executive summary 3
The evolution of the virtual GSOC 4
The virtual GSOC in action 6
Roadmap to a virtual GSOC 8
Turning situational awareness into a business advantage 11

Executive summary
Every disruption now unfolds in real time. A system outage on one
continent can ripple through suppliers halfway around the world, and a
single piece of misinformation can shift public behavior before official
channels even respond.
As security and operations teams rush to respond to an incident, they are
also competing with the speed of information.
Traditional GSOCs weren’t built for that pace. They were designed for
fixed assets and predictable threats, not for a world where misinformation
spreads faster than verification and where risk can emerge anywhere, at
any time.
Recent studies confirm the strain: 46% of security teams say they spend
more time maintaining tools than defending their organization, and 78%
report their systems are disconnected and dispersed.1
This guide offers a practical approach to building a virtual GSOC: a lean,
decentralized, technology-driven model built on automation, verified
information, and real-time collaboration.
Drawing on lessons from enterprises such as Nutrien and DoorDash,
we outline how virtual GSOCs are being built using systems most
organizations already own: samdesk for real-time risk detection
and situational awareness, Esri ArcGIS for visualization, and familiar
communication tools like Microsoft Teams or Slack.