Helped a South African financial institution modernize its security with Microsoft

No harmony, no visibility: A fragmented security stack under audit pressure

Our client’s security stack was built with solutions from different vendors: Defender and Sentinel from Microsoft, a Fortinet firewall, and endpoint & email security from Check Point. Despite investing significantly in security, they didn’t get the harmonized visibility they wanted.

Each solution ran in its own silo, generating alerts without correlation or shared context, leaving their team with fragmented visibility across endpoints, network, and email. They had little insight into the full path of an attack.

The fragmented stack didn’t just cloud their security picture but also slowed down how quickly information reached the right people. It was also challenging to demonstrate the timely oversight regulators expect. What made it worse was the high volume of alerts (close to 500 alerts a month), with the team unable to distinguish between noise and genuine threats.

All this made building a resilient, modernized SOC and complying with POPIA obligations a goal that was too distant to achieve, especially without in-house vendor, domain, or compliance expertise.

• No harmony between Microsoft and Third-party tools
• Fragmented visibility and delayed insights that affected response times

• High alert volume that was affecting focus on what is important
• Limited expertise for a compliant and modernized Microsoft-powered SOC

Unified, managed, and modernized security stack – built for speed & compliance

We unified our client’s security stack by integrating their Microsoft Defender and Sentinel, Fortinet firewall, and Check Point endpoint and email security on our vendor-agnostic, open-architecture STRIEGO platform. This not only unified telemetry across their security stack but also gave them a shared context and a clear view of their security posture across every layer. Next, our team offered the dedicated domain and vendor expertise to tune their detection, correlate their alerts, and optimize the rules.

This brought their overall alert volume down from 500 to 150, improved their MTTD by 96.7% and MTTR by 95%. All this, without replacing or upgrading any existing tools. Since our client handled sensitive housing finance, customer, and financial data, our threat experts also conducted continuous, proactive threat hunting to surface potential attack paths, exploitable risks, and exposed environments. This was reinforced by continuous threat intelligence and security advisories on relevant threats, helping them timely mitigate risks and maintain oversight that regulators expect. By offering dedicated POPIA compliance experts, we provide clients with a single partner for technical buildout and regulatory alignment rather than treating compliance as a checklist.

• Unified Microsoft and third-party tools into one integrated, operationalized, and managed security stack.
• Reduced alert volume from ~500 to ~150/month through rules without replacing or upgrading the stack.
• Proactive threat hunting to catch attack paths and risks before they surface as alerts.
• Continuous threat intelligence and security advisories to stay ahead of evolving threats.
• Dedicated end-to-end compliance expertise, along with Microsoft experts to align the security posture with POPIA compliance.