Global Retirement Fund Case Study

Customer Story

Global Retirement Fund

Securing a Hybrid Multicloud Enterprise

A leading global retirement fund, operating in a high-volume, hybrid-cloud environment, faced critical visibility and detection failures with its existing network detection and response (NDR) vendor. The incumbent created massive cloud blind spots and low-fidelity alerts, hindering the security operation center’s (SOC) ability to detect sophisticated threats like Active Directory (AD) attacks.

Read customer story

Loading…

hero retirement fund hero image - generic

Loading…

Overview

Delivering the Best Solution

The ExtraHop modern NDR platform displaced the incumbent and won a head-to-head competitive proof of concept (POC) by delivering:

Loading…

Unified Visibility

ExtraHop eliminated the critical hybrid-cloud blind spot (Azure/AWS), providing full visibility at 100 Gbps.

High-Fidelity Detection

The retirement fund was able to immediately detect advanced AD attacks, such as Golden Ticket, and lateral movement that the incumbent missed by switching to the ExtraHop modern NDR platform.

Loading…

Operational Efficiency

By shifting focus from low-value tuning to high-priority threat hunting, ExtraHop helped to reduce SOC alert fatigue.

Challenge

Imperative for Zero-Risk Tolerance

A leader in its industry, the global retirement fund manages more than $100 billion in assets, employs 1,000+, and operates with an absolute imperative for zero-risk tolerance given its high-value status. Its expansive technical environment spanned multiple data centers and a hybrid multicloud footprint (including Azure and AWS), hosting high-volume trading and administrative systems. This combination of a vast technical footprint and strict compliance demands introduced significant challenges to the fund's security operations and incumbent NDR solution.

01

Critical visibility and performance gaps

The organization struggled with a critical hybrid-cloud blind spot. The existing NDR product failed to provide coverage for a significant portion of their public cloud infrastructure and was incapable of analyzing high-speed internal encrypted east-west traffic at up to 100 Gbps, meaning threats hidden in encrypted flows were entirely missed.

02

Missed detections

The incumbent NDR vendor consistently failed to detect critical post-compromise activities: AD attacks, command and control (C2), and lateral movement, as these activities were hidden within encrypted communications and legitimate protocols that the tool could not properly decode.

03

Alert fatigue

The SOC was severely impacted by excessive, low-fidelity detections from the incumbent NDR tool, wasting valuable analyst time on false positives and excessive tuning.

04

Technical gaps and future imperative

The incumbent solution could not meet the operational demands of the fund's expansive technical environment, which risked a security failure as the environment scaled. The replacement had to provide deep protocol fluency, particularly for database communications, to decode internal traffic that the incumbent had failed to analyze. Furthermore, seamless integration with existing tools like CrowdStrike and Microsoft AD was mandatory to maintain a cohesive, functional security ecosystem.

Loading…

Solutions

Unified Detection with ExtraHop NDR

Following a rigorous head-to-head POC against two leading competitors, the global retirement fund selected ExtraHop as its preferred NDR vendor, finally securing their hybrid environment with the proven benefits of a modern NDR platform.

The key outcomes and advantages the ExtraHop platform delivered to the retirement fund include:

01

Unrestricted visibility and decryption

The fund secured the required forensic depth and network control by deploying ExtraHop, which analyzes 100 Gbps of east-west traffic and uses high-speed decryption to immediately find threats previously hidden within encrypted flows.

02

Reduced alert fatigue via high-fidelity detection

The cloud-scale machine learning built into the ExtraHop platform lifted the SOC's operational burden because it provided high-fidelity, low-noise detections. This shift allowed analysts to move focus from low-value false positives to highly reliable network activity, signaling true post-compromise threats and endpoint detection and response (EDR) evasion tactics.

03

Actionable context and identity

The security team achieved comprehensive insight by leveraging identity-based investigation, which links malicious network activity directly to user and service accounts, finally enabling the detection of all missed AD and lateral movement attacks.

04

Streamlined incident response via ecosystem integration

ExtraHop fundamentally simplified incident response workflows because it established itself as the definitive source of network truth, automatically feeding high-value contextual data to the customer’s existing SIEM and EDR platforms.

05

Unified security platform

The organization gained efficiency and reduced complexity by consolidating NDR, NPM, and IDS capabilities into one unified, integrated solution for comprehensive network security and observability.

06

Deep protocol coverage for core assets

The fund mitigated major risk by gaining deep fluency (parsing over 90 protocols) that allowed for accurate decoding of all traffic, including sensitive database communications, without introducing performance risk. This was critical for detecting hidden AD attacks and lateral movement.

Loading…

PLATFORM

RevealX NDR

Use the power of network visibility and AI for real-time detection, rapid investigation, and intelligent response for any threat.

Platform Modules portrayed through diagram with modules: Network Detection & Response, Network Performance Monitoring, Intrusion Detection System and Packet Forensics. Network Analysis & Visibility Platform is showcased through icons, and High Performance Sensors showcased through with modules: Physical, Virtual Machine, Container and HyperScaler.

Loading…

Explore the platform

Loading…

Results

Security Excellence

The global retirement fund achieved immediate, transformative security improvements following the deployment of their new NDR platform.

Decisive Platform Selection

The retirement fund successfully displaced the incumbent NDR vendor, validating their selection of the modern platform with immediate, tangible results. The fund proved it could achieve superior technology and visibility by instantly eliminating the public-cloud blind spot and enabling the detection of high-fidelity AD attacks.

Unified Hybrid-Cloud Control

For the first time, the organization gained holistic visibility across the entire hybrid enterprise after the new NDR platform entirely eliminated the critical public-cloud blind spot (Azure/AWS).

High-Value Threat Mastery

The SOC immediately achieved the capability to detect high-fidelity, advanced AD attacks, such as the AD Delegation Enumeration Activity and domain enumeration, even over encrypted communication.

Maximized SOC Focus

The organization achieved a substantial reduction in alert noise, empowering analysts to shift their focus from tuning and noise reduction to high-priority incident investigation, threat hunting, and prioritization.

Accelerated Incident Response

The fund fundamentally streamlined the SOC’s incident response workflow, greatly reducing the time and effort required for investigations by leveraging centralized, contextualized data from the NDR platform.

Loading…

Experience security at every data point.

Try ExtraHop

Loading…

NEW

ExtraHop named a leader in the Gartner® Magic Quadrant™ for Network Detection and Response

Professional Services

Education Services

Partners

Partner Login

Partner Finder

View All Use Cases

View All Industries

View All Integrations

Global Retirement Fund

Securing a Hybrid Multicloud Enterprise

Read customer story

Delivering the Best Solution

Unified Visibility

High-Fidelity Detection

Operational Efficiency

Imperative for Zero-Risk Tolerance

01

Critical visibility and performance gaps

02

Missed detections

03

Alert fatigue

04

Technical gaps and future imperative

Unified Detection with ExtraHop NDR

01

Unrestricted visibility and decryption

02

Reduced alert fatigue via high-fidelity detection

03

Actionable context and identity

04

Streamlined incident response via ecosystem integration

05

Unified security platform

06

Deep protocol coverage for core assets

RevealX NDR

Use the power of network visibility and AI for real-time detection, rapid investigation, and intelligent response for any threat.

Security Excellence

Decisive Platform Selection

Unified Hybrid-Cloud Control

High-Value Threat Mastery

Maximized SOC Focus

Accelerated Incident Response

Experience security at every data point.

Global Retirement Fund

Securing a Hybrid Multicloud Enterprise

Read customer story

Delivering the Best Solution

High-Fidelity Detection

Imperative for Zero-Risk Tolerance

01

Critical visibility and performance gaps

02

Missed detections

03

Alert fatigue

04

Technical gaps and future imperative

Unified Detection with ExtraHop NDR

01

Unrestricted visibility and decryption

02

Reduced alert fatigue via high-fidelity detection

03

Actionable context and identity

04

Streamlined incident response via ecosystem integration

05

Unified security platform

06

Deep protocol coverage for core assets

Security Excellence

Decisive Platform Selection

Unified Hybrid-Cloud Control

High-Value Threat Mastery

Maximized SOC Focus