What “local-only” should mean in a SOC

12 November 2026 · 1 min read · Nigehban security team

Many platforms say they can run on-premises, yet still depend on a cloud service for enrichment, updates or AI. Local-only should mean something precise: ingestion, correlation, search, reporting and AI summaries all keep working with external connections switched off.

Ask for three things. A list of every outbound connection, domain and port. An independent switch for each external feed, so disabling one does not silently disable detection. And a demonstration with the network cable pulled.

Threat intelligence still has value in an isolated network, but it arrives by controlled import and offline updates, with its age shown to analysts so nobody trusts stale data.