BullhostCybersecurity Services Provider (MSSP) · Leioa, BizkaiaSOCMSSPConsultancy

Process and automation to scale a European SOC

Strategic SOC consultancy since late 2023: from services not yet formalised into a catalogue to a proceduralised MSSP, with workflow automation, a catalogue structured into Blue, Purple and Red teams and a European data-sovereignty focus.

Talk to the team
Bullhost

The starting point

Bullhost had an operational SOC with strong technical capability, but without a formalised professional structure: no documented procedures, services not yet catalogued and no capacity to compete for demanding or larger clients. The technical knowledge was there, but the operation was not packaged as a sellable managed service.

About Bullhost

Bullhost
years of IT track record
20+
cybersecurity specialisation since
2016
client companies
125+
professionals
40+

Certifications & registrations

  • ISO 20000
  • ISO 27001
  • ENS (RD 311/2022)
  • RNS
  • RIPE NCC
  • INCIBE
  • Cyberzaintza
  • DCA
  • Cybasque
  • Trusted
  • CCI

Figures published by Bullhost

The transformation

The same SOC, two registers: the not-yet-catalogued services we started from and the proceduralised MSSP it became.

Before
  • Operational SOC, with knowledge concentrated in key individuals
  • No documented procedures or runbooks
  • Services not yet catalogued or packaged
  • No capacity to compete for demanding contracts
Hodeitek's role
  • Process and runbook redesign
  • Catalogue, SLAs and commercial model
  • European sovereignty orientation
  • Commercial positioning support

Strategic consultancy and accompaniment — we did not run day-to-day operations.

Strategic SOC consultancy that started in late 2023, with ongoing accompaniment (now in its third year). Redesign of operational processes and procedures and drafting of runbooks. Definition and structuring of the service catalogue into three teams —Blue, Purple and Red— with SLAs and commercial models. Orientation towards European data sovereignty and active support in commercial positioning to reach higher-complexity contracts. This was consultancy and strategic accompaniment: we did not run Bullhost's day-to-day SOC operations.

After
  • Documented SOC processes, runbooks and policies
  • Structured Blue/Purple/Red catalogue (9 services) with SLAs
  • Defined commercial model for higher-complexity contracts
  • Explicit European data-sovereignty positioning
Runbooks · SLAs · Catalogue

How we did it

A phased engagement, from diagnosing the SOC to European positioning.

  1. Phase 1 — Operational diagnosis

    Assessment of the existing SOC, identification of procedural gaps and definition of the roadmap.

    Late 2023

  2. Phase 2 — Process redesign

    Documentation of operational procedures, runbooks and internal SOC policies.

    2024

  3. Phase 3 — Blue/Purple/Red catalogue

    Definition and structuring of the catalogue of 9 managed services with SLAs and commercial models.

    2024–2025

  4. Phase 4 — European positioning

    EU data sovereignty orientation and commercial support for higher-complexity contracts.

    Ongoing

A structured, managed catalogue

Nine managed services across three teams, with procedures and SLAs.

Blue Team

4 services
  • SOCaaS / Security Monitoring
  • VMaaS
  • DSPMaaS
  • DLPaaS

Continuous monitoring, detection and incident response.

Purple Team

2 services
  • ASM (Attack Surface Management)
  • CTI / Early Warning

Coordinates Blue and Red: exposed attack surface and threat intelligence.

Red Team

3 services
  • Awareness
  • Pentesting
  • App Security aaS

Attack simulation and awareness training to stress-test the defences.

European data sovereignty

The most demanding contracts ask for something concrete: knowing where the data lives and under which jurisdiction it operates. Bullhost's catalogue was reordered around that question from the design stage, not bolted on as an afterthought.

Operations inside the European Union, documented processes, and auditable certifications — ENS, RNS — back that position for clients who no longer accept a promise without a regulatory framework behind it.

Real base in Bizkaia, Basque Country (Spain) — within the European Union.

Certifications behind it
  • ISO 27001
  • ENS (RD 311/2022)
  • RNS
  • INCIBE
  • Cyberzaintza

How we measured these results

Methodology

We haven't commissioned an external audit of these figures. Instead, for every metric published above: the starting point (baseline) and how the final figure was obtained.

catalogueBlue · Purple · Red
Baseline: 0 formalised services with an SLA in late 2023 (services not yet formalised into a catalogue). Measurement: direct count of the 9 services defined, documented and delivered in the project's final catalogue.
operating modelProceduralised
Baseline: 0 documented runbooks or policies at the initial diagnosis (late 2023). Measurement: verification that runbooks, internal policies and the service catalogue were documented and delivered at the close of each phase.
engagementSince late 2023
Baseline: consultancy start date (late 2023). Measurement: time elapsed from contract kick-off to today, with the engagement running without interruption.
positioningEuropean sovereignty
Baseline: no data-sovereignty message in Bullhost's commercial positioning before the project. Measurement: qualitative, based on the positioning shift incorporated into Bullhost's commercial proposals as a result of this consultancy.

In their words

“At Bullhost we greatly value having chosen Hodeitek as our development partner, as they bring great value to our SOC. Thanks to their automations we have optimised our detection and response processes, significantly reducing manual tasks through workflow orchestration and thereby improving the operational efficiency of our cyber-intelligence team.”

Iñaki Aldama, CEO · Bullhost
Iñaki AldamaCEO · Bullhost
Bullhost

The next act

The next act

From a proceduralised MSSP to an AI-driven SOC

Bull-Eye: the proprietary AI and SOAR platform Bullhost built as the continuation of this transformation.

Read the continuation

Services and solutions used

Let's talk about your case

Does your SOC work, but isn't packaged as a service?

We help MSSPs and security teams proceduralise their operation, structure a catalogue with SLAs and position for demanding contracts, with European data sovereignty. Let's talk about your specific case.

Talk to the team

Related resources

Prerequisite reading
Whitepaper
IntroductorySOC / Red Team
IA & Seguridad

Guide: reducing alert fatigue in a security team

A five-step method to give a security team its hours back: a baseline before changing anything, an owner for every rule, noise reduction at the source, correlation and context-based prioritisation. It explains where AI helps and where it does not, and closes with an improvement loop and a checklist. It includes no savings figures: every improvement is measured in your own environment.

4
SOCAlertsAI
Read more
Go deeper
Case study
GeneralSOC / Red Team
Cybersecurity Services Provider (MSSP)

Bull-Eye: custom-built platform for Bullhost. Combines AI and SOAR on sovereign European infrastructure, reduces MTTD from 45 minutes to under 10 seconds, and is owned and operated by Bullhost.

Bull-Eye: custom-built platform for Bullhost. Combines AI and SOAR on sovereign European infrastructure, reduces MTTD from 45 minutes to under 10 seconds, and is owned and operated by Bullhost.

Cybersecurity Services Provider (MSSP)Growing SME
AISOARSOC
Read more
Prerequisite reading
Whitepaper
IntroductorySOC / Red Team
SOC & Detección

SOC readiness and coverage checklist

A list to audit detection and response capability with evidence: governance and scope, telemetry sources, time windows, detection, triage and response, notification and compliance, and improvement and reporting. Each item is marked Yes, Partial, No or Not applicable, with its evidence; a Yes without evidence counts as Partial. It works for in-house, external or mixed SOCs.

4
SOCMDRDetection
Read more