A co-managed SOC lets a dealer group’s internal IT team keep running IT while an outside security operations center watches alerts around the clock, isolates compromised machines, and hands the internal team the evidence and the next step.
Last updated: October 20, 2026
Before anyone at a dealer group decides who should watch for cyberattacks, I’d ask them to count the hours. A week has 168 of them. One full-time employee covers about 40. Staffing a single security seat every hour of the year takes 8,760 hours, and a full-time schedule is roughly 2,080, so you need about 4.2 people for one chair before anyone takes a vacation, gets sick, or goes to a class.
That’s the whole problem, really.
I’ve spent more than 25 years leading managed services teams, and a big part of that work is building coverage schedules. They always look fine on paper until somebody counts the nights. Nights are the hard part. The Bureau of Labor Statistics puts the median pay for an information security analyst at $129,180 (May 2025). Multiply that by 4.2 and one round-the-clock seat costs more than $540,000 a year in salary alone. No benefits. No tools. No senior person to call when the first analyst isn’t sure what they’re looking at. Our side-by-side of in-house, managed, and co-managed IT for dealerships runs the rest of that math.
So when an internal IT team tells me they can’t watch security overnight, I don’t hear a skill gap. I hear a calendar. Those people are already carrying the help desk queue, the DMS, the network, the phones, and every new hire’s laptop. A co-managed SOC is how a group keeps that team in charge and still has someone awake at 3 a.m. It’s one of the ways we run co-managed IT for dealerships, and this post is about the security half of it.
Nobody fails that math on talent. They fail it on the calendar.
What a Co-Managed SOC Actually Is
A co-managed SOC, short for security operations center, is an arrangement where an outside team of security analysts monitors a company’s computers, servers, and accounts around the clock, while the company’s own IT staff keep ownership of their systems, their users, and the decisions that affect the business.
You’ll also see it called co-managed SIEM or co-managed security services. The labels blur. Vendors use them loosely. A SIEM is the system that collects and sorts the security alerts; the SOC is the people who read them. I think the people are the part worth paying for, since an alert log nobody opens until Monday is really just a record of what already happened to you.
Side by side, it’s 3 setups. I’ll be honest: I’m partial to the middle one.
| Question | In-house security only | Co-managed SOC | Fully managed |
|---|---|---|---|
| Who watches alerts overnight and on Sundays | Your staff, on call | The SOC’s analysts | The provider’s analysts |
| Who cuts a compromised PC off the network | Whoever answers the phone | The SOC, under rules your team wrote | The provider |
| Who decides about the DMS server or a whole store | Your IT lead | Your IT lead, on a call the SOC starts | The provider, with your sign-off |
| Who knows your stores, users, and vendors | Your team | Your team | The provider, over time |
| Seats to staff around the clock | About 4.2 per chair | None added | None added |
That’s the one this post describes. Your people keep the keys, all of them, and someone else sits up with the alerts overnight and writes down what happened so it’s waiting when your team gets in.
Security Operations Is a Different Job From IT Operations
My training is in ITIL, the service management framework, and it treats event management and incident management as separate practices. I’ve always thought that was one of its better calls. Somebody watching a feed of security events at 1 a.m. needs patience and a narrow focus. Somebody running IT for 6 stores gets interrupted all day long, by the sales desk, by service, by the controller. I don’t know many people who can be both at once, and I’ve stopped expecting it.
Here’s a fairly normal Tuesday for an internal IT manager at a group. Password resets start when the sales staff logs in. A label printer dies in the service lane. The OEM portal changed its login again, so 4 people call about it. There’s a DMS contract meeting at 2. In the middle of all that, a security tool flags a strange login at a store 90 miles away, and the alert waits in an inbox until lunch, because lunch is the first quiet minute of the day.
I’d push back on anyone who calls that a competence issue, because the person in that chair is usually very good and simply out of hours. What problem are we actually trying to solve? Mostly, how to get someone’s full attention on security at the times your team is asleep or buried, without burning out the people doing the work.
At least one big public dealer group has said the same thing in writing. Rush Enterprises, which runs a nationwide network of commercial truck dealerships, says in its annual report for 2025, filed with the SEC, that it uses “a combination of internal resources and external managed security service providers” to monitor and protect its systems. That’s a company with its own CIO and its own security program, choosing to share the watch anyway. CompTIA’s State of Cybersecurity 2025 survey of 1,026 US business and technology professionals found 46% of respondents considering more use of third-party security providers, and 56% considering new hiring. Plenty of organizations are doing both at once. If you’re still deciding between one provider and two, our comparison of MSP vs MSSP for dealerships covers that choice.
The internal team stays. The night shift moves.
Who Does What When an Alert Fires at 2 a.m.
Here’s the walk-through I’d want every IT manager to see before signing anything, because this is the moment a co-managed arrangement proves itself or doesn’t. The NIST Cybersecurity Framework 2.0, released in February 2024, names 6 core functions, and 3 of them, Detect, Respond, and Recover, describe this work. In a co-managed SOC, those 3 words get owners.
- Say a workstation in a used car manager’s office starts reaching out to an address it’s never contacted, at 2:07 a.m. The endpoint tool raises an alert.
- An analyst in the SOC reads it, pulls the machine’s recent activity, and decides whether it’s real. Most alerts aren’t. Plenty are noise. This one is.
- The analyst isolates that one PC from the network, because the rules your IT team signed off on say a single workstation can be cut off without a phone call. It can still talk to the SOC. It can’t talk to the DMS. Good.
- Your on-call contact gets a phone call, not an email. It covers what was seen, what was done, and what’s needed next.
- In the morning, the fix happens. Who does it depends on your matrix: re-imaging the PC might be your team’s line, while closing the hole that let it in might be ours.
- A short written review lands with the IT manager, so the next decision is made on facts.
Step 3 is the one people argue about, and they should. Isolating a sales desk PC is easy to agree on. Nobody argues there. Isolating the server that runs the DMS on the Friday night before a sales event is a business decision, and in a co-managed SOC that call belongs to someone at the dealer group. We write those lines down in advance: which machines the SOC can cut off on its own, which ones need a named person on the phone first, and who that person is at 2 in the morning on a holiday weekend.
If you want the details of how the monitoring itself works, our page on managed detection and response for dealerships covers it. In a co-managed group, most of what’s different happens in steps 3 through 5, where the two teams hand work back and forth.
Write the rules down while everybody’s rested.
How Your Internal Team Keeps Visibility
Ask an internal IT manager what bothers them about an outside SOC and you’ll hear about cost first, then, a few minutes later and a little quieter, the real one, which is finding out last. Nobody wants a store manager to be the one who tells IT that a PC was wiped overnight.
I think that’s a fair concern, and the answer is mostly plumbing and habit. Whatever provider you look at, here’s what I’d expect.
Start with the ticket. Any alert that turns into an incident should land in a queue your team can open, with the timeline and what the analyst did, and there should be a short note about the night waiting for you in the morning. Three lines is fine. Then the escalation list, which is yours: who gets called, in what order, for which stores, and you should be able to change it on a Wednesday afternoon without anybody drafting a contract amendment.
- Once a month, someone sits down with you and looks at the pattern instead of the count. If it’s the same 2 stores every month, or the same phishing lure every week, then are we fixing the cause, or are we working around the symptom?
- And the other direction, which people forget. When your team adds a firewall rule or gives a new vendor remote access, the SOC hears about it, so an analyst doesn’t spend an hour chasing your own change as if it were an attack.
I may be missing something that matters to your group in particular. That’s why this list ought to be written with your IT manager, not handed to them.
Visibility you have to ask for isn’t visibility.
Writing the Security Split Down
What I’ve learned over time is that most co-managed problems aren’t technical. They’re two teams each assuming the other one owned a task. The fix is boring. It works, though: a written responsibility matrix with one owner per line. We published our full co-managed IT responsibility matrix, covering everything from the help desk to the network. These are the security rows that matter most for a co-managed SOC, as a starting point:
| Security task | Usually owned by | Kept informed |
|---|---|---|
| Watching alerts, nights, weekends, holidays | SOC | Internal IT, by ticket |
| Deciding whether an alert is real | SOC | Internal IT |
| Isolating a single workstation | SOC, under written rules | Internal IT, right away |
| Isolating a server, the DMS connection, or a store | Internal IT lead decides; SOC acts | Dealer principal or CFO |
| Resetting a compromised user’s passwords and sessions | Agreed per group | The user’s manager |
| Rebuilding or replacing the affected machine | Agreed per group | SOC |
| Calling the insurer, attorneys, or the OEM | Dealer group leadership | Internal IT and SOC |
| Keeping the escalation contact list current | Internal IT | SOC |
Two rows say “agreed per group” on purpose. Some internal teams want to rebuild their own machines because they know exactly how each store’s PCs are set up. Others would rather hand that off and spend the morning on the store that’s still open for business. Neither answer is wrong. Both work. Leaving it blank is.
The contrast I keep coming back to is individual effort versus shared ownership. One person heroically covering security on their phone at night is individual effort, and it works right up until the night it doesn’t. A matrix makes it shared.
One owner per line, every line.
What IT Managers Ask Before They Share the Watch
Does a co-managed SOC mean my job is next?
Who gets the call at 3 a.m., me or my boss?
Co-managed SIEM vs co-managed SOC: does the difference matter?
We already bought security tools. Do we start over?
Realistically, how long until someone is watching overnight?
Where to Start
Count the hours first. If the honest answer is that nobody at your group is watching security from midnight to 6 a.m., or that the person who is watching is also your only IT manager, you already know which problem you’re solving.
At Helion Technologies, security monitoring runs around the clock in a live-staffed, US-based security operations center, and our help desk is live from 6 a.m. to midnight Eastern, Monday to Saturday, with an 82-second average time to reach a live person. We support more than 35,000 dealership employees across 2,000-plus dealerships, and in a co-managed group the internal team stays in charge of its own stores. Our job is to add the hours they can’t.
The next step belongs to your IT lead and whoever signs off on risk at the group. Sit down together with a complimentary IT and cybersecurity assessment, and we’ll map who watches what today, where the gaps fall, and which lines of the matrix your team wants to keep. Your team keeps the stores. We take the night shift.