CASE STUDY – PHARMACEUTICAL
Accelerating MTTR by 70–80% by centralizing MXDR for a global pharmaceutical leader
DOWNLOAD THE PDFAbout the client
The client is a global, research-driven pharmaceutical company focused on innovative therapies across multiple therapeutic areas. It operates a worldwide network spanning R&D, manufacturing, and commercial functions, supported by a multi-thousand-person workforce with operations across multiple regions globally.
The client’s challenge
To improve its overall security posture and cyber defense capabilities, the client was looking for a partner to provide effective cyber threat detection and response. This transformation would include:
- Transitioning from QRadar to Microsoft Sentinel: QRadar had inadequate detection, governance, and collaboration capabilities.
- A threat-led continuous detection approach: The client wanted to benefit from proactive threat hunting capabilities aligned with their business context.
- Streamlined security operations: The client aimed to onboard a continuous improvement approach to be prepared for a global incident if necessary.
Benefits
- Increased automation: 40% of alerts are now auto-closed due to intelligent automation, reducing alert fatigue.
- Improved Mean Time to Respond (MTTR): Triage investigation is completed 70-80% faster, by automating many tasks previously requiring human analysts.
- In-depth detection engineering: 300-400 new detections in place, with 100 new detections implemented each quarter.
- Single pane of glass view: One view of security operations globally, with a single, standardized framework for continuous improvement.
Our solution
The client chose CyberProof due to its strong ties and proven track record with Microsoft, including expertise in Sentinel and the wider Microsoft technology stack.
CyberProof worked alongside the client to write up the processes for how to build out a new security operations solution from the ground up, creating a global framework for continuous improvement and MDR. This included on-site workshops to drive collaboration and form a strong relationship for future growth and partnership. Key elements of the solution included:
A centralized Managed Extended Detection and Response (MXDR) model
This utilized Microsoft Sentinel and Google SOAR (SecOps) to align alert monitoring, investigation and response under a common framework, allowing for consistent handling of security events across all regions. The native cloud deployment and specific tailored integrations allows for faster and more accurate interactions between globally distributed teams, and streamlines incident handling.
Detection Engineering
The CyberProof team implemented between 300-400 initial detections, with a further 100 added each quarter. These have been organized across defined security domains including endpoints, network, identity, cloud, email, and more. Detections are mapped to the MITRE ATT&CK framework and prioritized based on a wide range of threat intelligence sources and the client’s business context.
Threat intelligence and threat hunting
CyberProof has supported the client through the investigation and containment of multiple security incidents, including:
- Voice-based and Microsoft Teams social engineering: Containing vishing and Microsoft Teams impersonation attacks.
- Malvertising-driven malware campaigns: Disrupting malvertising campaigns delivering malicious installers disguised as admin tools.
- Credential theft and RMM abuse via financial phishing: Uncovering phishing campaigns impersonating financial services, enabling rapid containment.
Results
As a result of the CyberProof engagement, the client has a security program that continuously improves over time. They have achieved global consistency in detection and response, leveraging Google SOAR and Microsoft Sentinel capabilities, and have a strong integration between MXDR, Detection Engineering and Incident Response. They also benefit from structured, measurable detection coverage, alongside intelligent prioritization and proactive threat handling in context.
Speak with an expert
Explore how CyberProof can help you reduce mean time to respond in hybrid and cloud-native environments.