Sign In
Customer Story
Leading U.S. Healthcare Insurance Provider
Health Insurer Ends Upgrade Instability and Reduces SOC Costs
A leading health insurer faced operational risks when its legacy NDR tool lost custom tuning during quarterly updates. This instability caused alert fatigue, forensic data loss, and wasted SOC resources. ExtraHop replaced the incumbent, providing stable, high-fidelity detection and streamlining incident response.
Overview
Delivering the Best Solution
The company selected the ExtraHop RevealX platform after a competitive review, replacing its legacy incumbent to achieve:
Stable forensic continuity
The organization eliminated the quarterly loss of tuning rules, ensuring that detection logic remained intact across system updates.
Reduced alert fatigue
The SOC moved from high-noise environments to high-fidelity data, focusing on useful insights rather than repetitive false positives.
Enhanced threat hunting
Analysts gained the deep level of forensic data required to initiate proactive hunting and investigate exfiltration attempts.
Seamless ecosystem integration
The platform established proven integrations with NetSkope, CrowdStrike, and the customer’s SIEM. These integrations provide a unified defensive posture.
Challenge
Ending Tool Instability and Restoring
As a major health insurance provider, this organization manages vast amounts of sensitive patient data across on-premises and cloud environments. The highly regulated and data-intensive nature of its business presented several critical challenges:
01
Unstable Tool Infrastructure
Every quarterly update to the incumbent legacy tool caused the system to lose all previously established tuning rules, forcing the security team to rebuild hundreds of their detection logic rules repeatedly.
02
Operational Burnout from Alert Fatigue
The lack of persistent tuning resulted in a constant stream of low-value alerts, overwhelming the SOC and obscuring real threats.
03
Forensic Visibility Gap
The incumbent system, which functioned as a NetFlow aggregator, provided insufficient data. This gap prevented sophisticated threat hunting or detailed investigations into potential data exfiltration.
04
Inflexible Data Ingestion
The team required a solution that could simultaneously accommodate NetFlow and full packet analysis without sacrificing performance or depth.
Solutions
Unified Detection with ExtraHop NDR
ExtraHop provides the agentless network security solution required for the healthcare insurance provider. This platform delivers unified security coverage that meets the healthcare insurance provider’s security requirements. The modern NDR platform permits the SOC to achieve transformative efficiency. ExtraHop passively monitors network traffic without requiring software deployment on sensitive patient data infrastructure.
The key outcomes and advantages delivered to the organization include:
01
Unrestricted visibility and decryption
The organization secured the required forensic depth and network control when it deployed ExtraHop. The platform analyzes 100 Gbps of east-west traffic and uses high-speed decryption to immediately find threats previously hidden within encrypted flows.
02
Reduced alert fatigue via high-fidelity detection
The cloud-scale machine learning built into the ExtraHop platform reduces the SOC's operational burden with high-fidelity, low-noise detections. This shift permits analysts to move focus from low-value false positives to highly reliable network activity.
03
Actionable context and identity
The security team gains comprehensive insight by using identity-based investigation. This feature links malicious network activity directly to user and service accounts.
04
Streamlined incident response via ecosystem integration
ExtraHop simplifies incident response workflows. The platform establishes itself as the definitive source of network truth, automatically feeding high-value contextual data to NetSkope, CrowdStrike, and the customer’s SIEM.
05
Unified security platform
The organization improves efficiency and reduces complexity by consolidating NDR, NPM, and IDS capabilities into one unified, integrated solution.
06
Deep protocol coverage for core assets
The healthcare insurance provider mitigates risk by gaining deep fluency. The sensor parses over 90 protocols to allow for accurate decoding of all traffic, including sensitive database communications.
PLATFORM
RevealX NDR
Use the power of network visibility and AI for real-time detection, rapid investigation, and intelligent response for any threat.
Results
ROI and Operational Stability
The healthcare insurance provider realized security improvements following the transition to the ExtraHop NDR platform:
Deep Forensic Fidelity
The organization retains a significantly deeper level of forensic data compared to its previous solution. This data enables high-confidence investigations into exfiltration and lateral movement.
Detection Stability
The SOC removes the quarterly "reset" of tuning rules. This stability permits the team to mature their detection logic over time rather than constantly troubleshooting system updates.
Hybrid Data Flexibility
The platform integrates both packet-level data and NetFlow. This integration provides comprehensive visibility across the entire hybrid infrastructure.
Proven Integration Ecosystem
Integrations with NetSkope and CrowdStrike deliver the cross-platform telemetry necessary to stop threats at the edge and the endpoint.
Reclaimed SOC Engineering Time
The elimination of the need to rebuild lost configurations every quarter reduces the labor costs associated with tool maintenance.
Reduced Investigation Costs
Analysts expend less time manually piecing together evidence and more time executing high-value threat hunts.