What are the fundamental weaknesses of an SOC (Security Operations Center)? I am currently a student taking a diploma in Cybersecurity and recently learnt about the Security Operation Center, and Incident Response Plans, it all looks flawless and secure to me if every member in the SOC carries out their duties.

Hence i am puzzled at how data breaches and exploits still happen with functioning Security Operation Centers? My lecturer dropped a hint that the ticketing functions of an SOC takes some time, which allows attackers to cause more damage before the vulnerability is resolved. However i do not know the explanation and justification behind that answer.  


I also thought of a weakness that SOCs are usually more reactive than proactive, but don't Tier 3 SOC Analysts actively hunt for threats?