Rapid7

Qlik, a leading data integration and analytics platform, was facing the challenge of expanding their cloud footprint while ensuring a cohesive, enterprise-level cloud security strategy. The company, which has grown significantly since its inception in 1993, was already using cloud services across various departments, including Research and Development (R&D) and Security teams. However, they recognized the need for holistic guidance to ensure the adequate protection of their cloud resources and data. As Qlik continued to grow as a Software as a Service (SaaS) technology provider, the use of cloud providers like Azure and Google Cloud Platform also expanded. The challenge was to maintain consistent control of their cloud environments and expand their cloud security best practices into these new environments.

Experity, a dynamic Health Information Technology company, was formed from the merger of the two largest urgent care Electronic Medical Records (EMR) companies in the country. The merger led to a rapid expansion of personnel, office locations, software, and services, creating unique challenges for the security team. The team was tasked with protecting the company from loss events of any kind, requiring business continuity and standardization. The small security team was overwhelmed with the task of managing security operations and building resilience in their security program. The company's growth also meant that the security team needed a platform to vet alerts from the increasing number of employees and contractors. The existing Managed Detection and Response (MDR) platform was inadequate as it only monitored network and server activity and not endpoint activity.

CoStar Group, a leading provider of commercial real estate information, analytics, and online marketplaces, has been expanding its reach through mergers and acquisitions (M&A). As of October 1, 2019, CoStar has spent approximately $2 billion acquiring a total of 27 organizations, each with a unique cloud presence and varying levels of cloud competency. The challenge for CoStar is ensuring the security and compliance of its constantly growing and evolving cloud footprint, which spans across Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). When growing through M&A, CoStar must be able to understand the cyber risk of the acquisition target, integrate the newly acquired resources, and maintain the ability of these acquired entities to accelerate innovation through the use of cloud services without the loss of control.

Domino’s Pizza, the world's largest pizza company, relies heavily on technology for its online ordering and delivery services. The company's security operations center operates 24/7, and one of the biggest security challenges they face is phishing. Spear phishing, in particular, is a significant threat due to the craftiness of threat actors. The company also has a wide attack surface due to its domestic and international markets, making threat hunting a critical task. The company wanted to train its security operations center (SOC) analysts to think like attackers, as many analysts focus solely on detection and response and lack understanding of the tactics used by attackers.

Acme Brick, a company with a long history in brickmaking, faced a significant challenge in managing the security of its IT infrastructure. With only two team members responsible for the security of 1200 workstations, servers, and active users, the company was struggling to maintain efficiency and effectiveness in its operations. The lean team was overwhelmed with the volume of work and the need for a tool that could streamline their day-to-day operations was deemed critical. The challenge was to find a solution that could integrate all their security tools into one platform, making it easier to manage and monitor their security posture.

Alpina Group, a Netherlands-based insurance technology firm, was facing a significant challenge in improving the maturity of its in-house security program. The company was on a steep growth curve, expanding its workforce from 350 to 550 employees in just two years. This rapid growth also led to an increase in the number of IT assets to manage and secure. The insurance sector is a popular target for attackers due to the wealth of sensitive personal and financial information they hold. Alpina Group recognized the need to enhance its visibility into the threat landscape and its own IT infrastructure to proactively manage risk. The company's incumbent SIEM platform created a blind spot after a year-long implementation, as it was too complex for the small security team to operate effectively. Security Officer Joost Dubbelman was tasked with finding vulnerability management and incident detection solutions that could be managed by a small team, provide enhanced insight, and help reduce risk.

Amedisys, a leading provider of home healthcare, faced a unique challenge in securing their patients’ and employees' data without impacting the usability of their systems. The majority of their user base consists of clinicians who provide care to patients in their homes. It was crucial to provide these medical professionals with a seamless and secure experience, as any disruption could impact the care provided to patients. The challenge was to ensure the security of sensitive data while maintaining the efficiency of their operations.

AMN Healthcare, a leading provider of total talent solutions for healthcare organizations, faced a significant challenge in integrating the cybersecurity systems of 28 recently acquired organizations. These organizations varied in size, from startups with 30-50 employees to established organizations with 2,500 employees, each with their own offices, policies, and frameworks. AMN needed a unified, future-proof security platform to integrate these organizations into their corporate structure, ensuring that every organization was following a singular security standard for detection and response. The challenge was further complicated by the shift to remote work due to COVID-19, which transformed each employee's home into a regional office, creating a lack of visibility and control over home networks.

Auden Group, a socially responsible financial services company, was looking to expand its product portfolio while ensuring robust cybersecurity. The company's leadership recognized the importance of cybersecurity for the success of its mission and growth. They brought on a six-person security team, led by Philip Wright, Head of InfoSec, to manage all aspects of cybersecurity from prevention to threat response. Wright was particularly concerned about phishing and human error, and wanted to build a program around the NIST cybersecurity framework: identify, protect, detect, respond, and recover. With only a month until the company’s first product launch, Wright’s priority was obtaining the ability to detect suspicious activity. He turned to InsightIDR - Rapid7’s easy to deploy SIEM (Security Information and Event Management) solution that features built-in threat detection.

Bioventus, a global leader in active healing and surgical orthobiologics, faced significant security challenges due to its large distributed workforce, multiple clouds, diverse devices, and the critical nature of patient data. The company's security team had to deal with user compromise and phishing emails on a daily basis. As an international healthcare company based in the US, Bioventus had the additional challenge of safeguarding patient records. A breach of any sort could be damaging, but a breach of patient records could be particularly expensive. The company also faced common security challenges for enterprises of its size, such as attacks on its cloud-based networks.

Blue Valley Unified School District in Kansas, with over 23,000 students and 3,100 staff spread across 35 schools, was committed to providing a safe digital learning environment for its students. However, the district faced significant security challenges. In August 2019, the district was targeted by a successful ransomware attack, prompting a comprehensive security assessment of its vast application and network infrastructure. The district's cybersecurity team identified ransomware attacks, visibility, and staffing as the key challenges. Ransomware attacks were a constant threat, especially given the perception that public school districts have limited budgets and manpower. Visibility was another issue, with the small team struggling to maintain a comprehensive view of the district's security landscape. Staffing was also a concern, with many school districts unable to invest in the necessary staffing and software to deal with the demands of today's cybersecurity environment.

Brooks, a rapidly growing sports equipment company, faced increasing security vulnerabilities due to its expansion. The company's growth from $500 million to $1 billion in sales, along with an increase in employees to 1,800, led to more hits on their website, more partners, and consequently, more security events, phishing emails, and potential risks. Despite having a security team of three analysts, the company struggled to stay ahead of the alerts. The traditionally manual, time-intensive incident response and vulnerability management processes were not scalable to meet the growing security challenges.

Domestic & General (D&G), a leading provider of subscription-based home appliance care, faced a significant challenge in managing its cybersecurity. With a 110-year old business, the company had an accumulation of systems and dozens of IT processes that had evolved over the years. As D&G expanded globally and digitized, its attack surface grew, and the mixed heterogeneous environment created additional challenges in terms of increased cyber risk. The company lacked a modern platform to identify risk and threats in a hybrid environment, at scale and with context. D&G’s Chief Information Officer, Phil, realized the need to enhance the company’s cyber protections and empower the business to own their cyber risk. However, the company was missing a platform that a modern organization needs to ensure it’s protected adequately.

Electro Optic Systems (EOS), an Australian technology company operating in the defense, space, and communications markets, was facing a significant challenge as it expanded its international footprint. The primary issue was maintaining their cybersecurity defensive perimeter, a crucial aspect given the sensitive nature of their business, which often intersects with national security interests. As EOS grew from a small organization to a large enterprise, the need to uplift their security posture and maturity became increasingly critical. The company required a solution that would provide continuous protection, monitoring, detection, and incident management tailored to their specific business needs.

Elara Caring, one of the largest providers of home health care in the U.S., faced significant challenges following the merger of three home healthcare companies. The consolidation created new opportunities but also posed difficulties for the company’s IT infrastructure and data security. The Chief Information Security Officer (CISO), Eric Bowerman, was primarily concerned with protecting end-users from phishing and ransomware attacks, which are common in the healthcare industry. The shift to a work-from-home environment due to the COVID-19 pandemic further complicated matters. The company had limited management software on the laptops of remote workers, which meant they did not have the same control as when the employees were in the office. This presented compliance issues related to protected health information (PHI).

Experity, a dynamic Health Information Technology company, was formed from the merger of the two largest urgent care Electronic Medical Records (EMR) companies in the country. This merger led to a rapid expansion of personnel, office locations, software, and services, creating unique challenges for the security team. The team was tasked with a substantial mission to protect the company from loss events of any kind, necessitating business continuity and standardization. The team was small and the expansion meant they would need to triple or quadruple their size to get the coverage they needed. The company had been using a Managed Detection and Response (MDR) platform, but it was not sufficient for the new scale of operations. It only monitored network and server activity and not endpoint activity, which was crucial as most security issues arise from user activities on desktops and laptops. The security team needed a platform to vet alerts from the increased number of employees and contractors.

Exponent, a renowned engineering and scientific consulting firm, faced a significant challenge in securing its data across its diverse and constantly evolving environment. With 1,500 employees spread across more than 30 locations and serving clients in the U.S, European Union, and Asia, the firm needed a robust security solution that could provide visibility across its diverse environment. The responsibility of securing the data fell on Daniel Shuler and his information security team. The team's primary focus was to protect their clients' data using the best technology available and demonstrate that they had the right security tools in place. The challenge was further complicated by the firm's constantly evolving roster of clients and projects, new field offices, and diverse technologies.

Hypertherm, a leading industrial cutting and shaping company, faced a significant challenge in maintaining the security and smooth operation of its diverse range of assets. These included operational technology, IoT devices, and Hypertherm's proprietary software. James Thompson, Information Security Manager at Hypertherm, was seeking a comprehensive solution that would provide visibility into the complex manufacturing sector, often referred to as the 'wild west' due to its lack of regulation. The company's environment was highly mobile, with many employees using laptops and a significant percentage of engineers using high-powered CAD workstations. Additionally, the company had to deal with old legacy machines running on outdated and difficult-to-secure systems. The challenge was further compounded by the constant movement of manufacturing cells around the organization, which often led to printers being moved to new IP ranges without Thompson's knowledge, causing potential disruptions to production.

Maximus, a leading strategic partner to governments worldwide, faced a significant challenge in enforcing standards and ensuring consistency across all public cloud environments. With over 200 AWS accounts under management and a growing Azure presence, visibility into numerous projects spanning AWS and Azure was critical. The company needed a solution that would enforce standards across all public cloud accounts and regions, provide visibility into non-compliant resources, create an exception process for certain resources, and deliver an automated way to take remediation action. Enforcing standards across the entire enterprise with hundreds of AWS accounts and Azure subscriptions and different support models was a daunting task.

Modine Manufacturing Company, a global leader in thermal management technology and solutions, faced a significant challenge in protecting its digital assets and those of its customers. As the business grew, so did the risks. The company's small security team found themselves monitoring thousands of event sources, up from a few hundred. They needed a partner that could help them improve various parts of their security program, addressing both proactive and reactive security needs. This required a strategic partner with multiple centers of product and service excellence.

Pearl Data Direct LLC (PDD), a FinTech company and subsidiary of LuLu Financial Holdings, faced two major security challenges. Firstly, as a company managing millions of dollars through their application, they were an attractive target for cyber attackers. Secondly, their business operates in the heavily regulated financial sector, requiring strict compliance with central bank regulations. The company needed to ensure the security of thousands of transactions flowing through their system every second, while also complying with stringent cybersecurity regulations. They also had to protect the personal identifiable information (PII) of their customers, which they were required to collect for compliance purposes. Furthermore, their core banking system was connected to a variety of banks, adding to the complexity of their security challenges.

Rackspace Technology, a leading end-to-end multi-cloud technology services company, faced a significant challenge in ensuring the security of their customers' data. As a company that designs, builds, and operates cloud environments across all major technology platforms, it was crucial for Rackspace to instill trust and confidence in their customers. The challenge was to ensure that when customers put their data on the Rackspace platform or chose to interact with Rackspace, their data would be secure and protected as if it was Rackspace's own. The company needed a robust and reliable solution to manage vulnerabilities and threats, and to ensure the highest level of data security.

The case study revolves around the challenges faced by Tony Hamil, a senior cybersecurity engineer for a commercial real estate development company based in Dallas, Texas. The company operates in an industry that is not heavily regulated by the government, but still faces significant cybersecurity challenges. Hamil's role includes a wide range of responsibilities, from application setup to maintenance, integrations, and alert monitoring. The company's IT environment is unique due to the lack of government regulations, but it adheres to the CIS and NIST standards voluntarily. The company has a large number of remote sites and users, making it crucial to maintain security whether the employees are working onsite or remotely. The company's biggest security challenges include patch management and user and asset management. The team often struggles with installing patches properly, leaving the system vulnerable. Additionally, the process of onboarding and offboarding employees from an IT and security perspective was a significant challenge.

Security Finance, a financial services company with over 1,000 locations across the United States and Mexico, was facing a significant challenge in maintaining its cybersecurity. As a financial institution, it was a constant target for cyber attacks, necessitating a proactive rather than reactive approach to security. The company's situation was further complicated by its extensive infrastructure, which included in-house software and various systems across multiple data centers. This vast surface area increased the potential for attacks. Additionally, the company's security program was not very mature, and they lacked a comprehensive understanding of their assets and the associated vulnerabilities. Prior to implementing a solution, the company was primarily focused on patch management, without a full understanding of the remaining vulnerabilities in their systems.

The Royal Orthopaedic Hospital in Birmingham, England, one of the largest specialist orthopedic centers in Europe, faced significant cybersecurity challenges. The hospital's IT department, led by Ray Mian and Ajmal Khan, was tasked with protecting patient and healthcare records and the IT infrastructure from ransomware attacks. The stakes were high, as any system downtime could have drastic consequences in the hospital environment. A significant challenge was the lack of visibility in the environment. The team was unable to identify their assets and lacked the necessary tools for visibility, discovery, and analysis to assess their security posture within the organization. This lack of visibility was identified as a key weakness in their cybersecurity strategy.

US Signal, the largest privately held data center services provider in the Midwest, faced significant security challenges in protecting its customers' networks. The company serves seven of the top ten healthcare systems in Michigan, the largest mental health provider in western Michigan, numerous managed service providers (MSPs), and various financial institutions, which necessitates robust security measures. The company had to deal with a range of threats, including phishing and the increasing pace of vulnerability discovery. The company also had to ensure compliance with various security frameworks and regulations, including SOC 2, PCI, and HIPAA. The vulnerability management software US Signal was using previously was not cloud-friendly and required a lot of on-premises infrastructure, making it challenging to manage their vulnerability assessment program.

Visier, a SaaS-based workforce intelligence solutions provider, faced a significant challenge in ensuring the protection of sensitive customer data. As a company entrusted with a vast amount of sensitive data, understanding their exposure in terms of vulnerabilities, potential threats, and threat actors was of paramount importance. The company needed a solution that would not only help them understand their exposure but also provide a robust system for event correlation, detection, alerting, and investigation of potential incidents. The challenge was to find a comprehensive solution that could offer deep insights into vulnerabilities, help inform remediation plans, and provide a robust communication strategy for vulnerability management.

Zoopla, a London-based real estate portal, faced a significant challenge in maintaining the security of its applications. With over 60 million visits a month to its flagship property website and application, the company had to ensure the utmost security for its users. The company's security team, led by Application Security Engineer Alikhan Uzakov, was responsible for guiding hundreds of Zoopla developers through the application security testing process. This included conducting training and helping developers embed security tooling into their processes to ensure the security testing of new features and products before their release. However, with only three staff members, the security team found it challenging to support the vast number of developers.