Building a SOC on a Nigerian budget

You do not need a seven-figure SIEM licence to get real detection coverage. Start here.

Most security programmes in mid-sized Nigerian firms fail for the same reason: they buy tooling before they define detections.

Start with an asset inventory and the ten attack techniques most likely to touch your environment. Map each to a log source you already have. In practice this is Windows event logs, firewall logs, and your identity provider.

Only then choose a platform. Open-source Elastic will carry you a long way at this stage, and the discipline of writing your own detection rules is the training your team actually needs.

The best SOCs we've studied ran for their first months on a small analyst team, a rules repository in Git, and a weekly purple-team hour.

Let's size that team realistically, because 'SOC' makes people imagine a room of analysts in Lagos at midnight. Start with two or three trained people covering business hours, an on-call rotation for escalations, and honest automation for the rest. One person can run a functioning detection programme for a mid-sized firm if the tooling is disciplined — what you cannot do is sustain 24/7 coverage with one hire. Managed detection providers fill the overnight gap affordably; the hybrid model (in-house detection engineering, outsourced out-of-hours triage) is where most Nigerian budgets land.

On tooling costs, build a realistic ladder. Tier zero is free: Sysmon on endpoints with a sane configuration, Windows Event Forwarding into a single collector, Wazuh as your open-source SIEM, and MISP for threat intelligence feeds — total spend near zero beyond hardware. Tier one adds Elastic's free basic tier properly tuned, plus commercial email security which pays for itself immediately given how much Nigerian incident response starts with phishing. Tier two, reached only when volume demands it, is the paid SIEM conversation. Teams fail by starting at tier two; successful ones earn their way up while building the muscle each tier requires.

Detection content is where your team actually compounds value. Begin with mappings that matter here: BEC patterns (impossible-travel logins to mailboxes followed by forwarding-rule creation), invoice-fraud indicators (new payee changes followed by payment), insider risk on finance systems, and lateral movement basics (Pass-the-Hash detections from event IDs 4624/4625 anomalies). Write each rule with its rationale in your repository, test it against atomic red-team techniques before deploying, and review quarterly against MITRE ATT&CK coverage gaps. Ten well-tested rules beat two hundred noisy ones — alert fatigue kills more SOC programmes than attackers do.

Measure the programme honestly from week one. Mean time to detect and respond, false-positive rate per rule, coverage percentage against your chosen technique list, and hours of analyst time per investigation. These numbers do two jobs: they justify budget to management in language finance understands, and they show junior analysts their work matters — retention of trained security staff is its own crisis in this market, and people stay where progress is visible.

Finally, grow your own analysts rather than importing them. The Nigerian market has far more motivated juniors than mid-level practitioners, and the gap between them closes fastest inside a working SOC: pair juniors with seniors on real investigations, fund certifications selectively after probation, and rotate people through detection engineering so knowledge never lives in one head. The firms we see running durable security programmes treated them as talent development engines first and cost centres never.