24/7 security operations centre for an insurance group

An insurance and financial services group with 22,000 employees and agents holds sensitive data on millions of customers, from health information to payment accounts. As ransomware attacks on the region's financial sector increased, the board asked for continuous, measurable monitoring and response. Zentrova was selected to build and run a security operations centre (SOC) as a managed service.

The challenge

The in-house security team had just six people working office hours, juggling alerts from more than ten disconnected tools. Thousands of alerts arrived every day, most of them false positives, so genuinely dangerous signals were easy to miss. The average time from detection to resolution of an incident was around six hours. Regulators and reinsurance partners were also asking for clearer evidence that risks were being monitored and managed around the clock, not just during business hours.

Our solution

• Centralised SIEM platform collecting logs from 18,000 endpoints, core insurance systems, agent applications and cloud infrastructure.
• EDR on every workstation and server, able to isolate an infected device within seconds.
• SOAR-driven response automation with more than 60 playbooks, from locking compromised accounts to blocking phishing domains.
• Threat intelligence continuously updated with indicators of attacks targeting financial institutions in Southeast Asia.
• Three-tier analyst team on duty 24/7 in Hanoi and Da Nang, with response times committed by severity level.
• Regular attack simulations and quarterly ISO 27001 compliance reporting to the executive committee.

Results

The SOC went live after eight months and has operated without interruption since 2023.

• Mean incident response time cut from six hours to 38 minutes.
• Mean time to detect now under 10 minutes.
• Alerts requiring human review down 85% through tuning and automation.
• Zero customer data breaches since go-live.
• Staff click rate on simulated phishing emails down from 14% to 3%.

The client's own security team has shifted from firefighting to governance, architecture reviews and risk planning, while Zentrova handles day-to-day monitoring and response. Every month both teams review the incidents handled, the playbooks triggered and the detection rules added, so the service keeps improving as the threat landscape changes. Detection coverage is mapped against well-known attack techniques and reported to the board every quarter.

We know someone is watching our systems at three in the morning, and we know exactly what they will do if something happens. — Chief Information Security Officer, client group