At Telefónica Tech we’ve built the SOC of the future with AI, talent and NextDefense XDR

Today, cybersecurity is no longer just about how we react, it's about how quickly we understand, decide and act in the face of a threat. Attackers have incorporated AI into their operations and can now launch campaigns in minutes, evade automated defenses, and exploit vulnerabilities before human teams can respond.

Yet many Security Operations Centers (SOCs) remain stuck in outdated architectures: siloed tools, alert overload, manual dependencies, and limited visibility across the environment.

This gap between the attacker’s speed and defensive response capabilities is not technological, it's structural. The traditional SOC model was designed for a more static world, where perimeters were well defined and data resided in a few locations. That perimeter no longer exists.

The traditional SOC was built for a static world, with defined perimeters and centralized data, that no longer exists. Today, effective protection requires agility, visibility, and anticipation.

This paradigm shift is what drives our vision at Telefónica Tech: we believe it's time to redefine what it means to operate a SOC. It’s not just about adopting new tools, but about transforming how we connect intelligence, automation and human expertise to make defense a living, adaptive, and predictive process.

That’s why we’ve built the SOC of the future: an environment where decisions aren’t solely based on the analyst’s experience, but on an ecosystem that learns, anticipates and responds with real-time precision. A model where AI doesn't replace humans, it amplifies their ability to stop threats before they impact the business.

The evolution of the SOC toward an intelligent and automated model redefines how we anticipate, detect, and respond to cyber threats.

Smart architecture for a next-generation SOC

How the SOC of the future works

The SOC of the future represents a major leap forward from traditional security operations centers. We’ve moved from a reactive, manual, and fragmented model to an intelligent, automated, and predictive one, where AI and orchestrated automation are at the core of operations.

In this new paradigm, the technical architecture is structured in three interconnected layers:

1. Real-time data ingestion

Systems capture and normalize telemetry from endpoints, networks, identities, applications and cloud environments.

—This eliminates information silos and enables complete and unified visibility across the security landscape.

2. Intelligent correlation and detection

The combination of next-generation SIEM and XDR allows real-time event correlation, alert prioritization using machine learning algorithms, and advanced detection based on indicators of attack (IoA), capable of identifying unusual behaviors and anticipating intrusions before they happen.

—This approach reduces operational noise and accelerates detection, often cutting it from minutes to seconds.

3. Automated response and continuous learning

Through SOAR platforms and large language models (LLMs), next-gen SOCs can automatically execute actions such as endpoint containment, account isolation, IP blocking or service restoration.

—This level of automation enables 20% to 40% of repetitive analyst tasks to be executed without human intervention, freeing up resources for investigation and proactive threat hunting.

Additionally, the integration of Generative AI and predictive analytics turns the SOC into a system that not only reacts but also anticipates attacks: it analyzes global threat patterns, correlates new vulnerabilities, and recommends preventive actions.

This model lays the foundation for the Agentic SOC, an AI-powered environment where decisions and responses are autonomously executed under human supervision, ensuring speed, consistency, and operational control.

The result is a connected and self-sufficient security ecosystem, able to adapt to adversary behavior and reduce response times, false positives and analyst workload.

AI anticipates threats and automates security to protect businesses before the attack happens.

NextDefense XDR: our joint response with CrowdStrike

Our vision for the SOC of the future comes to life with NextDefense XDR, the managed cybersecurity service we’ve developed at Telefónica Tech in collaboration with CrowdStrike.

NextDefense XDR brings the architecture outlined above into real-world operations by combining AI-native technology with human expertise:

CrowdStrike’s Falcon Next-Gen SIEM platform

CrowdStrike’s platform unifies visibility across endpoints, cloud, and data, to accelerate threat detection, investigation, and response. This AI-native platform correlates data from thousands of sources in real time to detect unusual patterns before they escalate into incidents.

With CrowdStrike technology, we accelerate threat detection and response through AI and advanced automation.

Advanced orchestration and automation

At Telefónica Tech, we incorporate this technology into our global network of SOCs, operating 24/7 and located in multiple regions. From there, our analyst teams deploy automated playbooks to ensure rapid, consistent response across multicloud, hybrid or on-premise environments, combining global coverage with local insight and proximity support.

Contextual analysis and regional governance

From Telefónica Tech’s SOCs we also conduct deep customer diagnostics (critical assets, risk exposure, potential attack vectors…) and tailor responses to each business reality. All while supporting regional data governance preferences by hosting data in the EU and leveraging European-based service teams.

Continuous integration and global intelligence

While CrowdStrike provides its AI-native technology, we at Telefónica Tech ensure ongoing operations and integration with existing security ecosystems.

This synergy enables companies to maintain an active defense, capable of reducing false positives, shortening containment times, and simplifying security management without sacrificing visibility or regulatory compliance; delivering measurable results in detection speed, operational efficiency and cost optimization.

NextDefense XDR keeps companies one step ahead of cyber threats.

Conclusion

At Telefónica Tech, we believe the evolution towards an intelligent SOC is not just about technological innovation, it's a fundamental shift in how we protect business value and continuity.

Combining our technological capabilities with those of CrowdStrike allows us to make this vision a reality: bringing together the power of AI with the expertise of our professionals to deliver faster, more accurate and more resilient defense.

■ With NextDefense XDR, we demonstrate that the cybersecurity of the future is built on anticipation, automation and collaboration. That’s why we combine technology and knowledge, so that every company can match the adversary’s pace while staying one step ahead.