CASE STUDY – MANUFACTURING
85% faster response: How a global conglomerate transformed SecOps with Google Cloud
DOWNLOAD THE PDFAbout the client
As a large, multinational conglomerate, our client operates across multiple countries through a broad portfolio of business divisions. Its global footprint and highly diversified structure create a complex operational environment encompassing manufacturing plants, Research & Development centers, and offices across multiple regions and business units, with more than two-dozen companies under a single conglomerate.
The organization employs a large global workforce, reflecting the scale and reach of its international operations.
The client’s challenge
The client’s Security Operations Center (SOC) operations were built on an on-premises architecture that created constraints around scalability, integration flexibility, and the ability to support the advanced detection and response workflows expected of an enterprise-grade SOC.
The decision was made to lean on external support to migrate to Google SecOps SIEM, a cloud-native platform better suited to the organization’s scale and ambitious roadmap.
The client’s objectives were threefold:
- To execute a clean migration from the legacy on-prem SIEM environment to Google SecOps without disruption to ongoing SOC operations.
- To establish an enterprise-grade SIEM and Security Orchestration and Response (SOAR) capability on the new platform.
- To build the internal maturity and operational expertise needed to run and continuously improve SOC operations over time.
Benefits
- Comprehensive MITRE ATT&CK coverage: Deployment of ~200 custom detection use cases has resulted in 70% MITRE ATT&CK framework coverage.
- Dramatically faster threat detection: More than 90% reduction in alert volume reduced Mean Time to Detect (MTTD) by 40%.
- Accelerated incident response: 18 SOAR integrations automating response workflows drove an 85% improvement in Mean Time to Respond (MTTR).
- Enterprise-scale security visibility: ~3TB of data ingestion per day across 4,000 log sources delivers consolidated security posture visibility.
Our solution
Following a competitive RFP process, CyberProof was awarded the Google SecOps implementation and ongoing SOC operations for the client, delivering a fully managed end-to-end security transformation. CyberProof executed a seamless migration from the client’s legacy on-premises SIEM environment to Google SecOps, meeting all intended objectives and outcomes.
The implementation was built to operate at enterprise scale, integrating approximately 4,000 log sources across 30 distinct log source types, with an ingestion capacity of close to 3TB of security data per day, and an anticipated 4TB of data ingested daily by the end of the year. To ensure the platform could accurately process the client’s unique environment, CyberProof developed six custom parsers and approximately 200 custom detection use cases, tailored to the client’s specific threat landscape and operational requirements. The result was a detection capability with 70% MITRE ATT&CK framework coverage, giving the client structured, measurable visibility across a broad range of threat scenarios for the first time.
The solution was further extended through 18 SOAR integrations (including firewalls, endpoint tools, ticketing systems and more), enabling automated response workflows across the client’s broad and complex environment.
Alongside the platform implementation, CyberProof deployed a full suite of managed cybersecurity services, including Managed Extended Detection and Response (MXDR), Detection Engineering, Advanced Threat Hunting, Agentic AI Investigation and ongoing SIEM platform management.
Results
Automation has driven an 85% improvement in MTTR and a 40% reduction in MTTD, dramatically narrowing the window between a threat emerging and being contained. On its legacy SIEM deployment, the client was drowning in more than 30k alerts every week. Post-migration, this was reduced to 2.5k alerts, relevant and prioritized in business context. This meant the client has been able to reduce the number of L1 and L2 analysts working full time, freeing up expertise for higher value tasks.
CyberProof now delivers a comprehensive view of the client’s security posture across more than half of its group companies, with continuous onboarding of additional entities underway.
Speak with an expert
Considering a cloud migration that accelerates incident response and provides deeper threat coverage capabilities?