CSaaS typically includes threat monitoring, incident response, vulnerability management, security assessments, and often access to a security operations center (SOC).