Is it worth it to host a soc lab internally?

Is it worth it to have a soc environment internally where analysts can visit unsafe sites and access potential malware for analysis?


Having a lab environment with ESXI but putting SOC VMs on this (hypervisor escape) is a serious concern. Network segmentation fine able to have a different circuit and VLANs but if its not physically isolated I am uncomfortable with this setup.


Anyone bother with internal physical stuff? Or just put it in the cloud not my problem then. …

access analysis analysts can cybersecurity environment escape esxi host hypervisor lab malware network network segmentation segmentation serious soc vms