Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. Exploitation attempts are reported, and code…

Building a 24/7 SOC takes roughly a dozen analysts before vacation math works which is why SOC-as-a-Service became the mid-market’s default answer and the enterprise’s pressure valve. The 2026 field divides by philosophy: concierge models that assign you named humans, platform models that sell detection engineering at scale, and bring-your-own-stack operators who run the tools you already own. Arctic Wolf takes 1 ; Expel and eSentire complete the podium. Key Takeaways • 1 overall: Arctic Wolf the concierge model at category-defining scale. • Podium: Arctic Wolf (concierge scale), Expel (transparency and automation ethos), eSentire (response authority). • Philosophy split: concierge (Arctic Wolf, eSentire), platform-transparent (Expel, Rapid7), BYO-stack (ReliaQuest, deepwatch, Proficio, Novacoast) decide whether they bring the stack or run yours. • 2026 theme: response authority the providers willing to contain, not just notify, separate from the alert-forwarders. How We Scored (Methodology) Research-based evaluation; no lab testing, no paid placement; editorial scores excluded from structured data. Criteria: detection/response outcomes, response authority (containment actions, not just alerts), stack flexibility, transparency (console/case visibility) , named-team continuity, and commercial accessibility. Weights: outcomes 25% , response authority 20%, transparency 20%, stack flexibility 20%, continuity 15%. The 2026 SOCaaS Power Rankings S.NO Provider Award Score* 1 Arctic Wolf Best concierge security operations 8.9 2 Expel Best transparent, automation-led SOC 8.7 3 eSentire Best response authority 8.6 4 ReliaQuest Best bring-your-own-stack operations 8.4 5 Rapid7 Best platform-bundled SOC service 8.2 6 deepwatch Best Splunk-centric managed SOC 8.0 7 Fortra (Alert Logic) Best value-tier coverage breadth 7.8 8 Cybereason Best MalOp-centric managed defense 7.7 9 Proficio Best co-managed flexibility 7.5 10 Novacoast Best services-depth boutique 7.4 *Editorial research-based scores, not lab results. 1. Arctic Wolf — Best Concierge Security Operations Arctic Wolf — Best Concierge Security Operations Snapshot: Per-user/asset subscription | Concierge Security Team model | Aurora platform telemetry Why it earns 1: Arctic Wolf productized the thing small teams actually lack: a named squad that knows your environment. The Concierge Security Team owns your account’s triage, tuning, and quarterly posture work atop the Aurora platform’s telemetry breadth security operations as a relationship, not a ticket queue, delivered at a scale no other concierge model matches. Pros: Named-team continuity; posture work included; telemetry breadth. Cons: Platform lock to Aurora; enterprise-custom depth versus BYO operators. Bottom line: The strongest “we’ve got you” in the category. 2. Expel — Best Transparent, Automation-Led SOC Expel — Best Transparent, Automation-Led SOC Snapshot: Tech-stack-based pricing | Workbench transparency | Automation-heavy triage Why it ranks here: Expel runs the glass-walled SOC: every investigation visible in Workbench as it happens, findings written in plain English, and automation (their bots) doing the repetitive triage so analysts spend minutes on judgment. It runs atop your existing stack EDR, cloud, SIEM scoring it for signal quality and telling you honestly what to fix. Pros: Investigation transparency; automation efficiency; BYO-stack respect. Cons: Wants a decent existing stack to shine. Bottom line: The SOC that shows its work. 3. eSentire — Best Response Authority eSentire — Best Response Authority Snapshot: Service tiers | Atlas platform | 24/7 threat response unit Why it ranks here: eSentire’s pitch is verbs: isolate, kill, contain authority written into the service, with its own threat response unit executing within minutes rather than emailing you at 3 a.m. Atlas-platform telemetry plus original threat research back the muscle. For buyers whose nightmare is the un-actioned alert, this is the design center. Pros: Containment authority; response speed culture; original research. Cons: Full value needs you granting real response permissions. Bottom line: Hire it to act, not to notify. 4. ReliaQuest — Best Bring-Your-Own-Stack Operations ReliaQuest — Best Bring-Your-Own-Stack Operations Snapshot: GreyMatter platform subscription | Stack-agnostic unification | Detection-as-code ethos Why it ranks here: ReliaQuest’s GreyMatter sits above whatever you already bought SIEM, EDR, cloud, identity unifying detection and response across it without rip-and-replace . The model respects sunk investment and kills the single-vendor telemetry tax; its ceiling is that unification quality tracks the quality of what you feed it. Pros: True stack agnosticism; unified detection layer; enterprise fit. Cons: Garbage-in constraint; enterprise-weight platform. Bottom line: The SOC layer for estates that refuse lock-in. 5. Rapid7 — Best Platform-Bundled SOC Service Rapid7 — Best Platform-Bundled SOC Service Snapshot: Per-asset MDR tiers | Insight platform native | D&R + VM fusion Why it ranks here: Rapid7’s managed SOC rides its own platform: InsightIDR detection, managed by Rapid7 analysts, with vulnerability context from InsightVM in the same pane. The bundle economics are the argument detection, response, and exposure management in one per-asset bill a mid-market CFO can parse. Pros: Bundle value; VM-context fusion; accessible packaging. Cons: Single-platform telemetry view. Bottom line: The tidy all-Rapid7 answer at mid-market price. 6. deepwatch — Best Splunk-Centric Managed SOC deepwatch — Best Splunk-Centric Managed SOC Snapshot: Managed service tiers | Splunk-native operations | Squad-based delivery Why it ranks here: deepwatch built its service as Splunk operations perfected: your Splunk (or theirs), run by named squads with detection engineering, hygiene scoring, and maturity benchmarking layered on. For the large Splunk-committed estate that wants the platform’s ceiling without staffing it, the specialization is the value. Pros: Splunk mastery; squad continuity; maturity benchmarking. Cons: Splunk-centric by design. Bottom line: Splunk estates’ outsourcing shortcut. 7. Huntress — Best Affordable Managed SOC for SMBs Huntress — Best Affordable Managed SOC for SMBs Snapshot: Predictable endpoint-based pricing | 24/7 SOC monitoring | Managed EDR with active threat remediation Why it ranks here: Huntress stands out for making managed security operations accessible to small and mid-sized businesses. Its 24/7 Security Operations Center combines managed endpoint detection, threat hunting, and automated response to identify and stop attacks before they spread. The platform focuses on ransomware, persistent threats, and suspicious endpoint activity, helping organizations strengthen security without building an expensive in-house SOC. Pros: Affordable and predictable pricing; 24/7 human-led SOC; strong ransomware protection; automated threat containment. Cons: More endpoint-focused than full-scale enterprise SOC platforms; advanced SIEM and custom detection capabilities are limited compared with larger providers. Bottom line: The practical, cost-effective managed SOC choice for SMBs that need reliable threat detection and response without enterprise-level complexity. 8. Sophos MDR — Best AI-Powered Managed Detection and Response Sophos MDR — Best AI-Powered Managed Detection and Response Snapshot: MDR Essentials and Complete tiers | 24/7 expert-led SOC | AI-assisted threat detection and response Why it ranks here: Sophos MDR combines AI-powered detection with round-the-clock human expertise to identify, investigate, and contain threats across endpoints, networks, cloud environments, and identity systems. Its flexible service tiers, broad third-party integrations, and incident response capabilities make it a strong choice for organizations seeking enterprise-grade security operations without building an in-house SOC. Pros: 24/7 threat monitoring; AI-assisted investigations; broad security integrations; active threat containment. Cons: Advanced response capabilities depend on service tier; full value may require deeper Sophos ecosystem integration. Bottom line: The AI-powered managed SOC choice for organizations seeking continuous protection and expert-led response. 9. Proficio — Best Co-Managed Flexibility Proficio — Best Co-Managed Flexibility Snapshot: Co-managed/full-managed tiers | ProSOC model | SIEM-flexible delivery Why it ranks here: Proficio built its niche on meeting you where you are: co-managed SIEM (yours or theirs), graduated response authority via ActiveDefense , and healthcare/mid-enterprise vertical depth. It’s the flexible mid-tier operator for teams that want partnership gradients, not binary outsourcing. Pros: Co-managed gradient; vertical focus; SIEM flexibility. Cons: Scale and research depth versus majors. Bottom line: Outsource exactly as much as you want. 10. Novacoast — Best Services-Depth Boutique Novacoast — Best Services-Depth Boutique Snapshot: Custom service engagements | Identity+security services lineage | novaSOC operations Why it ranks here: Novacoast pairs its SOC service with unusual bench depth in identity and security engineering the boutique that can also fix what monitoring finds. For buyers wanting a services partner with a SOC rather than a SOC with upsells, the shape fits; brand reach is the honest constraint. Pros: Engineering bench; identity depth; partnership posture. Cons: Boutique scale; regional gravity. Bottom line: The engineer’s SOCaaS pick. Full Comparison Table Provider Model Stack approach Response authority Named-team continuity Pricing model Arctic Wolf Concierge Own platform Yes CST (core) Per-user/asset Expel Transparent BYO stack Yes Partial Stack-based eSentire Concierge+response Own platform Yes (core) Yes Tiers ReliaQuest Platform layer BYO (core) Yes Partial Platform Rapid7 Platform-bundled Own platform Yes No Per-asset deepwatch Squad Splunk-native Yes Squads Tiers Alert Logic Tiered coverage Own platform Partial No Value tiers Cybereason MalOp-managed Own EDR Yes No Per-endpoint Proficio Co-managed Flexible Graduated Partial Tiers Novacoast Boutique Flexible Yes Yes Custom Yes/No Capability Table Provider Active containment authority? Runs your existing SIEM/EDR? Live case/console transparency? Posture/maturity work included? Mid-market-accessible entry price? Arctic Wolf Yes Partial Yes Yes (CST) Yes Expel Yes Yes (core) Yes (Workbench) Yes Partial eSentire Yes (core) Partial Yes Yes Partial ReliaQuest Yes Yes (core) Yes Yes No Rapid7 Yes No Yes Partial Yes deepwatch Yes Yes (Splunk) Yes Yes No Alert Logic Partial Partial Yes No Yes Cybereason Yes No Yes No Yes Proficio Graduated Yes Yes Partial Yes Novacoast Yes Yes Partial Yes Partial Buying Advice: Grant the Verbs or Keep the Pager The SOCaaS value cliff sits at response authority: a provider allowed only to email you is a very expensive smoke detector. Decide before procurement which actions you’ll delegate host isolation, account disable, token revocation under what guardrails, and shortlist only providers contractually comfortable executing them; then test with an unannounced drill in the pilot and measure minutes-to-containment, not minutes-to-email. Choose the philosophy honestly: strong existing stack → BYO operators (Expel, ReliaQuest, deepwatch); thin stack and thin team → concierge platforms (Arctic Wolf, eSentire); somewhere between → co-managed gradients (Proficio). Interrogate continuity who exactly works your account, their tenure, and what happens when they leave and write telemetry sovereignty into the contract: your logs, exportable, with exit assistance. The provider’s own metrics deserve audit too: ask for their median containment times across clients, and how they’re measured. FAQs Who are the best SOC-as-a-Service providers in 2026? Arctic Wolf leads the concierge model, Expel for transparency, eSentire for response authority, ReliaQuest and deepwatch for BYO-stack operations, with Rapid7, Alert Logic, Cybereason, Proficio, and Novacoast by fit. SOCaaS versus MDR versus MSSP? Heavily overlapping labels: MDR is the detect-respond core, SOCaaS wraps it in full SOC function (triage, tuning, posture), MSSP is the widest umbrella including device management contract scope matters more than the acronym. Should the provider run our stack or theirs? Good existing telemetry favors BYO operators; greenfield or thin stacks favor platform-native providers switching stacks mid-contract is the expensive mistake. What response authority should we grant? Host isolation and account disable under written guardrails is the common baseline; start with after-hours authority if full delegation feels early. How big must we be before building our own SOC? The usual arithmetic says roughly a dozen security FTEs before 24/7 in-house coverage beats renting most organizations below a few thousand employees rent. Verdict Ten providers, three philosophies, one cliff: authority. Arctic Wolf’s concierge squads, Expel’s glass walls, eSentire’s containment verbs, ReliaQuest and deepwatch running your stack, Rapid7’s tidy bundle, Alert Logic’s value tiers, Cybereason’s operation lens, Proficio’s gradient, Novacoast’s bench pick who may act at 3 a.m., write it down, and drill it before the adversary does. Author: [AUTHOR NAME], [credential]. Reviewed by: [REVIEWER NAME]. Last updated: October 2026. Cybersecurity News editorial: independent, research-based rankings; no paid placement; scores are editorial and excluded from structured data. Read next on Cybersecurity News: •  Top 10 Best MSSP Providers • Top 10 Best Managed SIEM Services • Top 10 Best DFIR Companies • Top 10 Best Incident Response Retainer Services • Top 10 Best Threat Hunting Services •  Top 10 Best EDR Solutions •  Top 10 Best SIEM Tools •  Top 10 Best SOAR Tools •  Top 10 Best UEBA Tools • Top 10 Best GenAI SOC Copilots The post Top 10 Best SOC-as-a-Service Providers in 2026 [Ranked & Scored] appeared first on Cyber Security News .

eSentire says its threat-response team traced Citrix NetScaler exploitation to September 8, before disclosure, and found activity across customer…

At a Glance Malware family PHP web shells, a Perl web shell installer, Platypus agents, and a Python reverse shell Threat actor Four unnamed clusters; one uses a tool tied to China-nexus actors (suspected, not confirmed) Targets Citrix NetScaler appliances; eight eSentire customers across the post-disclosure clusters Delivery vector Exploitation of CVE-2026-88771, both before and after disclosure Key capabilities

On August 31, 2026, attackers broke into a school's print server and ended up owning its entire Windows domain. eSentire's Threat Response Unit (TRU) traced the intrusion to a PaperCut zero-day chain. According to eSentire's detailed write-up, the attackers hid an AdaptixC2 implant inside a tampered copy of Microsoft Copilot. At a Glance Malware family

eSentire TRU detected exploitation of PaperCut MF zero-days (CVE-2026-82078 and CVE-2026-81578) against an education customer, leading to a web shell, a trojanized Microsoft Copilot binary, and deployment of an AdaptixC2 implant. The intrusion progressed to domain controller compromise, credential dumping, NTDS.dit extraction, and pass-the-hash movement across the Active Directory environment. #PaperCutMF #CVE-2026-82078 #CVE-2026-81578 #AdaptixC2 #MicrosoftCopilot

eSentire uncovers the GhostCode phishing kit abusing Microsoft OAuth to steal tokens, register attacker devices and access Microsoft 365 accounts.

At a glance Actor or group: Unidentified cybercrime group (financially motivated threat actors) Activity type: Device code phishing, OAuth token theft, and business email compromise Targets or victims: Enterprise sales teams and service providers across North America Scale: Over 30 lookalike domains targeting wholesale distributors and manufacturers Jurisdiction or law-enforcement status: Active threat under ongoing private intelligence monitoring Source: eSentire Threat Response Unit (TRU)

eSentire uncovers the GhostCode phishing kit abusing Microsoft OAuth to steal tokens, register attacker devices and access Microsoft 365 accounts.

Analisten van eSentire hebben eind augustus 2026 een nieuwe phishingkit, genaamd GhostCode, geïdentificeerd. Deze kit omzeilt de beveiliging van Microsoft 365 door accountovername te bewerkstelligen zonder de wachtwoorden van gebruikers te stelen. De aanvalsmethode maakt gebruik van een tactiek die lijkt op 'business-email-compromise' om de verzoeken routineus te laten lijken. De campagne startte met berichten via zakelijke contactformulieren, waarbij aanvallers zich voordeden als inkopers. Vervolgens werden ontvangers verleid tot het ondertekenen van een geheimhoudingsverklaring (NDA) via een WeTransfer-link met een wachtwoordbeveiligde HTML-bijlage. Deze bijlage bevatte een lokmiddel voor...

eSentireの脅威対応チーム(TRU)は、Microsoftの OAuth 2.0 デバイス認可グラントフローを悪用し、M365アカウントを乗っ取る未確認のデバイスコードフィッシングキット「GhostCode」を発見しました。このキットはプライマリリフレッシュトークン(PRT)を発行し、被害者がMFAを完了してか

eSentire TRU uncovered GhostCode, an active device code phishing campaign delivered through web contact forms and disguised business outreach, which abused Microsoft device code authorization to steal tokens, register devices, and obtain a Primary Refresh Token in under 78 seconds. The campaign used layered HTML obfuscation, WeTransfer-hosted lures, compromised or lookalike infrastructure, residential proxy rotation, and Microsoft/Cloudflare trust signals to bypass detection and complete post-compromise access. #GhostCode #GHOSTnet #EvilTokens #Storm2372 #MicrosoftAuthBroker #CloudflareTurnstile #WeTransfer #Salesforce #BJsWholesaleClub

CMS Distribution’s partner ecosystem now has access to eSentire’s cyber security and managed detection and response services

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

At a glance Malware family Cruciferra malware loader (delivers Remus stealer) Threat actor Cruciferra and LenAI (ErrTraffic) sellers; operators unknown Target or victims Windows users visiting compromised WordPress sites Delivery vector ClickFix lures via ErrTraffic JavaScript injects Key capabilities DLL sideloading, process hollowing, BYOVD EDR killing Source eSentire Threat Response Unit; Infosecurity Magazine; Sekoia TL;DR The Cruciferra malware loader is turning up in fresh ClickFix campaigns tracked by eSentire in late July 2026.

eSentire uncovered a malware campaign combining ClickFix lures with ErrTraffic and Cruciferra

In late July 2026, eSentire TRU reported ErrTraffic-generated ClickFix campaigns that delivered the Cruciferra loader, which abused the signed vulnerable driver DCRCVDrv.sys to kill AV/EDR processes from the kernel. The campaigns used compromised WordPress sites, blockchain-based dead-drop C2 infrastructure, and fake CAPTCHA/BSOD lures to trick victims into running malicious PowerShell while deploying Remus through side-loading and process hollowing. #Cruciferra #ErrTraffic #DCRCVDrvsys #Remus #MocoMsys #ServiceModelRegexe