_2013-11-24_16-00.png?width=1024&height=293&name=1024px-Tibco_logo-_Palo_Alto%2c_CA_company-_(PNG)_2013-11-24_16-00.png){kind=logo}
Every acquisition leaves the security team with two of everything. This one left them with two SIEMs, two sets of detections, and two bills, on a Splunk contract that had already run out.
The work didn't pause for the integration. Employees did exactly what security training told them to do and reported suspicious email through KnowBe4, and every one of those reports landed on an analyst as a ticket to build by hand. At the same time, developers moving fast with AI coding assistants were pushing code into public GitHub repositories where no one was looking.
None of this was a shortage of tools. The team had plenty. What they didn't have was confidence. Their previous MSSP sent generic alerts out of a black box, they were sifting through hundreds of millions of notable events, and nobody could say with certainty which detections actually worked. The SOC had become efficient at handling the known and blind to everything else.
Netenrich started where the risk was least visible. See it: we put continuous attack surface monitoring on public code, so exposures are flagged as they appear. Prove it: we translated every Splunk use case into Netenrich ASO and tested each one before cutover, so the team could retire Splunk knowing nothing had slipped. They were live in four weeks. Run it: we built a phishing pipeline from KnowBe4 through Netenrich ASO to ServiceNow that handles the volume without a human building tickets.
Throughout, the team kept full visibility. No black box: they co-engineer the workflows while Netenrich carries the operational load.
Today they run one platform and one streamlined SOC. Level 1 and Level 2 triage is off their plate, and their analysts spend their time on threat hunting and strengthening posture. That's what modernizing security operations looks like: not more speed, but proof that the work is making them safer.