45-Endpoint SIEM + EDR Deployment:
Zero Ransomware in 18 Months
A San Antonio professional services firm had experienced two ransomware incidents in three years. IDENETY MSP deployed managed SIEM + EDR/XDR across 45 endpoints. Zero ransomware incidents in the 18 months following deployment.
The Challenge
A San Antonio professional services firm with 45 endpoints across 3 locations had experienced two ransomware incidents in three years — paying ransoms of $15,000 and $22,000 respectively. Their previous IT provider had deployed legacy antivirus but no EDR, no SIEM, and no centralized logging. The firm had no visibility into what was happening on their network and no way to detect threats before they executed. After the second incident, they engaged IDENETY MSP to deploy enterprise-grade security controls.
Deployment Phases
Discovery & Baseline
Conducted a full endpoint inventory and security baseline assessment. Identified 45 endpoints across 3 locations. Documented existing security gaps: no EDR, no centralized logging, no SIEM, outdated AV on 12 endpoints.
EDR/XDR Deployment
Deployed enterprise EDR/XDR agent on all 45 endpoints over a 3-day window. Configured threat detection policies, automated quarantine rules, and response playbooks. Removed legacy AV from all endpoints.
SIEM Integration
Deployed managed SIEM with log collection from all endpoints, the firewall, M365, and Active Directory. Configured correlation rules for ransomware indicators, lateral movement, and credential abuse.
SOC Onboarding
Onboarded the client to IDENETY MSP's 24/7 SOC. Configured alert thresholds, escalation procedures, and emergency contact protocols. Conducted tabletop exercise with client IT contact.
18-Month Monitoring
Continuous 24/7 SOC monitoring. 847 alerts processed. 23 threats contained before execution. 0 ransomware incidents. Quarterly security reviews with client leadership.
The Result
In the 18 months following SIEM + EDR/XDR deployment, the firm experienced zero ransomware incidents. IDENETY MSP's 24/7 SOC processed 847 alerts and contained 23 threats before they could execute. The firm's cyber insurance premium decreased by 18% at renewal, citing the addition of EDR and 24/7 SOC monitoring as key risk reduction factors.
Stop the Next Ransomware Attack
Book a free security assessment. Our engineers will review your current security posture and identify gaps before attackers do.