A financial-services client wanted to replace a costly, fragmented estate of legacy on-premise security products with one modern platform they were already licensed for. Multiple consoles, overlapping tools and coverage gaps were slowing the team down and inflating spend.
We delivered the migration to a consolidated Microsoft Defender stack across more than 3,000 endpoints, replacing separate EDR, antivirus and application control products and saving the client over £200k a year. We treated it as a chance to start clean: auditing and rationalising legacy policy so only the relevant configuration moved across, and hardening the new estate with Attack Surface Reduction and antivirus controls. We also built custom detection rules in KQL, so the SOC was alerted to suspicious activity the old tooling would have missed. Delivered in structured sprints, the cutover landed with no disruption to the business.
Key Achievements
- Planned and led a dedicated delivery squad using agile methodology, running structured sprints and stand-ups to ensure on-time delivery
- Reviewed and rationalised legacy policies before recreation, ensuring only relevant configurations were migrated to the new Microsoft tooling
- Designed and implemented supporting controls across Attack Surface Reduction (ASR), antivirus, and application control
- Developed custom KQL detections to cover suspicious activity the legacy tooling would have missed
- Oversaw both strategic delivery and hands-on engineering activities, completing the transition with no disruption to business operations
Tell us what you're working on.
Whether it's a noisy SOC, detections you don't trust, an untested response plan or a security project that needs delivering, a short call is the quickest way to work out what to do next.
Free 30-minute call · No obligation · Speak directly with the person who'd do the work