Most security operations centers collapse under their own complexity. They promise to support every vendor, every SIEM, every workflow. They chase features instead of focusing on what actually matters: operational efficiency.

Federico Meiners learned this the hard way. After a failed attempt to build a SOC in the United States, he joined Nynox (now ACEN) in Belgium and spent five years discovering what it really takes to build and scale managed detection and response services in Europe’s fragmented market.

In this episode of Scaling Cyber, Federico (also known as "Fede") shares the operational playbook behind ASIN’s growth from 5 to more than 50 monitored customers, and why most MDR providers get it completely wrong.

From Network Security to Security Operations

Federico’s path into security operations wasn’t linear. He started in network security, spending more time troubleshooting VPNs and latency issues than actually doing cybersecurity. His first SOC attempt—setting up operations in the US market—failed despite significant investment in vendors, infrastructure, and marketing.

“Setting up a SOC is expensive. You need a lot of foundations to start delivering the service. We invested a lot... and it was really hard to get traction.”

That failure became the foundation for everything that came next.

The Operational Efficiency Mandate

When Federico joined ACEN, he discovered the biggest pitfall of security operations: trying to support everything.

The trap most MDR providers fall into:

* “Bring your own SIEM”

* “We support every vendor”

* “Unlimited integrations”

* “Custom workflows for every customer”

It sounds good in sales calls. It’s impossible to maintain in production.

ACEN’s contrarian approach:

* Standardize on a specific stack

* Choose the 20% that delivers 80% impact

* Commit to specific technologies

* Pick your market and optimize relentlessly

“You really need to pick your market. I mainly work with construction, healthcare, government. They don’t have a SOC, they don’t have a SIEM. So they’re not going to tell me they want their Sentinel integrated. And if they do, I show them the operational efficiency increase on their side when they come to us.”

This focus on standardization became ACEN’s scaling engine.

Thanks for reading Scaling Cyber! Subscribe for free to receive new posts and support my work.

Automation: From Skepticism to Scale

One of the most revealing parts of the conversation is Federico’s automation journey.

In 2021-2022, customers started asking: “Federico, why doesn’t your SOC do machine learning? Where’s the automation?”

ACEN built their first fully autonomous playbook for Microsoft 365 alerts. The system worked. Less than 1% error rate. Clear visibility into failures.

Customer reaction? “I want humans in the process.”

“Our generation—people 35 and onwards—we still want to see humans. And to this day, we automate a lot of alerts, and sometimes customers say: I want the human checking this alert.”

But the reality is stark: ACEN scaled from 5 to nearly 50 customers because of automation.

Federico’s golden metrics for SOC efficiency:

* Customer-facing: How many alerts can you handle without contacting the customer?

* Internal: How many of those alerts were solved without your analyst?

The ratio between these two numbers determines whether a SOC can scale or not.

The European Cybersecurity Paradox

Federico offers one of the most candid assessments of Europe’s cybersecurity market:

“We really like laws. It’s all about compliance and regulations. Sometimes I think Europe wants that to be the competitive advantage against the world. But speak with any MDR vendor in Europe, and 80% of their stack is probably from the United States.”

The structural challenges:

* Market fragmentation (language, culture, local requirements)

* Smaller addressable market per country

* Slower sales cycles (3-6 month POCs, 12-month buying processes)

* Strong local markets (Germany, France) but limited cross-border scaling

* Work-life balance culture vs. startup intensity required for breakthroughs

What actually drives SOC adoption in Europe:

* Breaches (the strongest driver, despite being fear-based)

* Outsourcing (companies separating IT from security vendors)

* Curiosity (30% of leads are now genuine interest—a new trend)

Compliance matters, but it’s not the primary driver Federico sees in the field.

Key Takeaways for Cyber Founders & Leaders

On operational efficiency:

* Standardization beats flexibility when scaling security operations

* Commit to a specific stack and optimize deeply rather than supporting everything superficially

* Operational efficiency is your competitive moat, not feature lists

On automation:

* Automation is the only path to scaling SOC operations

* Balance automation with human oversight to maintain customer trust

* The golden metric: alerts handled without analyst intervention

On detection engineering:

* Out-of-the-box rules are making a comeback (detection engineering is expensive)

* Focus on the 20% of technologies that cover 80% of your customer base

* Patterns emerge when you standardize—use them to your advantage

On European scaling:

* Market fragmentation is real, but specialization can overcome it

* Language and culture matter more in mid-market than enterprise

* European founders need to balance work-life culture with the intensity required for breakthroughs

On the future:

* Abstraction layers will eventually handle most alert workflows

* The analyst’s role will shift to ensuring the machine runs properly

* Vendors will increasingly embed AI into platforms—choice will disappear

About Federico Meiners

Federico Meiners is a Security Operations Leader at ACEN (formerly Nynox), where he has spent five years building and scaling managed detection and response services across Belgium and Europe. Originally from Argentina, Federico brings a global perspective to European cybersecurity challenges.

About Scaling Cyber

Scaling Cyber is a founder-led cybersecurity podcast spotlighting companies and leaders building outside the US and Israel. Hosted by Ignacio Sbampato, the show focuses on real GTM lessons, operational challenges, and global scaling strategies.

Subscribe: Substack | Spotify | Apple Podcasts | YouTube

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit scalingcyber.substack.com