Very true I was not referring to SOC not reacting it's more things getting misinterpreted when things get escalated to higher ups if org is huge and structure i

Very true I was not referring to SOC not reacting it's more things getting misinterpreted when things get escalated to higher ups if org is huge and structure is complex sometimes things get complicated. E.g. a company undergoing an external pen test and some real incident in the same time window using tools that a pen tester would use (e.g metasploit)