Coinhako is an Asia-based provider of an easy-to-use cryptocurrency buying platform. Founded in 2014 by Singapore entrepreneurs with a simple value proposition, to create a simple and hassle-free way to access Bitcoin, the company has since expanded to offer access to a wide variety of digital assets. Its stated vision is to enable access to the crypto-economy across Asia and beyond, and it continues to grow the number of customers it serves and the transactions it handles.

Coinhako needed more direct visibility and control over its security to keep pace with a dynamic threat landscape. It had relied on a managed detection and response (MDR) service for threat detection, investigation and response (TDIR). As the business grew to serve more customers and process more transactions, leadership decided to bring TDIR in-house, with a dedicated security operations team and tooling focused on business-impacting threats. The cornerstone of that operation would be a modern SIEM.

The requirements went beyond running in the cloud. Coinhako wanted a cloud-native SIEM for scalability and speed, but it also refused to toggle between disparate user interfaces, so the solution had to provide a unified experience across the whole TDIR workflow. Because the security team was newly formed and still learning the environment and building processes, the platform had to supplement the team through streamlined workflows and automation rather than add cumbersome manual work.

Coinhako also needed a vendor that would act as a partner, shepherding the transition from MDR to in-house operations while meeting strict deadlines. The team evaluated six highly regarded SIEM vendors before making its choice.

Securonix rose to the top of Coinhako's evaluation for four reasons. First, it collects data from on-premises and cloud-based sources and correlates it into a single data set, giving Coinhako extensive visibility into the cloud assets in its environment. Second, it delivers out-of-the-box behavioral analytics, threat detection models and content, and lets Coinhako build custom detection rules that incorporate its own applications and data sources. New threat content from the Securonix Threat Labs team can be applied in a few clicks, so the solution stays current without overburdening analysts or system administrators.

Third, Securonix automates the association of seemingly unrelated events into combined alerts, so the security operations team can see the relationships between minor-looking alerts that together signal a significant issue. Fourth, it provides a streamlined workflow that carries an analyst from detecting an incident, through gathering details on the entities involved, to a precise and targeted remediation plan.

Beyond the technology, Securonix worked with Coinhako from the outset to propose a solution matched to its needs and to support implementation. Chief Information and Security Officer Pasi Koistinen credits the vendor with taking the time to understand Coinhako's requirements and working closely to configure the system for its unique security challenges. The partnership streamlined the move from a service-based SIEM capability to detecting, investigating and responding to threats within Coinhako's own security operations environment, on the required timelines.

• Transition from MDR to an in-house security operations team completed on strict timelines
• On-premises and cloud data consolidated into a single data set for extensive cloud visibility
• Automated event association and risk-based alert ranking let analysts prioritize the highest-impact threats
• Custom detection rules and Threat Labs content keep coverage current with a few clicks
• Security team and leadership feel better positioned to protect Coinhako's data and reputation