Small and medium-sized enterprises (SMEs) face increasing exposure to cyberattacks while operating under significant constraints related to limited budgets, scarce in-house cybersecurity expertise, and low security maturity. This study examines two interrelated questions: what drivers and barriers determine when SMEs invest in IT security, and how Security Operations Center (SOC) functions can be prioritized under resource constraints. The study applies a qualitative approach based on nine semi-structured interviews with five SME decision-makers and four cybersecurity professionals, analyzed through abductive thematic analysis. The findings show that SME investments in IT security are primarily reactive and event-driven, triggered by direct incidents or enforceable external pressures such as regulatory, customer, and insurance requirements. These drivers operate against mutually reinforcing internal barriers, including the perception of security as a pure cost, lack of internal competence, and structural dependence on external providers. For SOC prioritization, the study identifies a previously overlooked "Before SOC" phase emphasizing consequence analysis, activation of paid-for license features, and environment inventory. Endpoint Detection and Response with automated response and phishing detection emerge as the highest-priority core functions. The findings are synthesized into a three-phase prioritization model.