What is a GSOC (global security operations centre)?
A strike shuts the main road to a plant. A storm closes an airport where two executives are due to connect. A protest forms three streets from a branch office. Each of these is, on its own, a minor item in a news feed. The question that decides whether they become incidents is mundane: does anyone in the company notice in time, connect it to their people and sites, and tell the right person what to do? That noticing-and-deciding is the job of a GSOC.
A GSOC—a global, or physical, security operations centre—is the function that keeps an organisation’s picture of physical risk current and turns it into action: who and what is exposed, what is changing around them, and what to do about it. Where a cyber SOC watches the network, a GSOC watches the world the organisation actually operates in—its people, its facilities, and its journeys.
What does a GSOC actually do?
Strip away the screens and it comes down to four jobs woven together.
It holds a live picture of the things that can be harmed—staff, sites, travelling personnel, key assets—and where they are right now. Without that, every event is abstract.
It monitors events and indicators against that picture, so a distant incident is read in terms of your exposure rather than as generic news. The strike matters because your shipment routes through that road; the storm matters because your people are in that terminal. Same event, different meaning, depending on whose map it lands on.
It coordinates the response when something happens—reaching the affected people, triggering the right procedure, and managing the incident to a close rather than letting it sprawl.
And it does the analysis that decides what matters in the first place, separating the signal that needs a decision from the noise that does not. This is the part that cannot be automated away, and the part that is most often missing.
How is a GSOC different from a cyber SOC?
The two share a spine: establish a baseline, monitor, detect change, respond. What differs is the domain and the sensors. A cyber SOC reasons about traffic, logs, and intrusions inside a network. A GSOC reasons about places, movements, unrest, weather, and threat actors in the physical world. An analyst can move between the two more easily than the tools can, because the discipline transfers even though the inputs do not.
| Cyber SOC | GSOC | |
|---|---|---|
| Domain | The network you operate | The world you operate in |
| Watches | Traffic, logs, intrusions | Places, movements, unrest, weather, threat actors |
| Sensors | Telemetry from systems you own | Open sources, reporting, imagery, your own sites and journeys |
| The question | Has something got into the network? | Is something changing around our people and sites? |
| Shared spine | Baseline → monitor → detect change → respond | The same, unchanged |
The spine is why the confusion exists at all, and why it matters that you don’t buy one expecting the other.
What separates a good GSOC from an alert factory?
Here is where most of them fail. The weak version forwards everything and calls it diligence—a wall of red banners and push notifications that, within a month, everyone has learned to swipe away. Volume is mistaken for vigilance, and the one alert that mattered drowns with the ninety-nine that did not.
The strong version scores and explains. It starts from a measured baseline of what normal looks like for a given place, so it can say not just “something happened” but “this is above normal, and here is by how much.” It grades severity, attaches the reasoning, and tells you what to consider. You are handed a judgement—what changed, why it matters, what to do—rather than a feed you still have to triage yourself. The test of a GSOC is not how much it sends you. It is how rarely it makes you do the analysis it exists to do.
Do you need a physical room to have a GSOC?
The staffed desk and the video wall are the visible part, and they are easy to mistake for the thing itself. But most of the value is the discipline—the maintained picture, the baseline, the graded read—not the real estate. A small organisation will rarely justify a centre of its own, and it does not have to in order to get the capability. The picture and the judgement can be delivered as intelligence long before anyone builds a room to house them.
That is what Aegilo Assessment and Aegilo Monitoring are between them: the GSOC’s measured baseline and honest pulse, delivered as a sourced assessment rather than a wall of screens—so you are told what changed and why it matters, not buried in alerts. A staffed GSOC capability of our own is in build.