To properly launch this new service, though, Silverfern needed to make some adjustments to how it monitored client environments.

“Traditionally, the types of services that we ran for our clients were pretty much very standard security monitoring—like endpoint detection or firewall managing,” clarifies Eng. “We had all these great tools, but they each had their own interface—their own portal. So we needed a central control panel where our engineers could look at all of the client’s environment and look at everything all at once.”

A long-standing IBM Business Partner, Silverfern quickly chose to deploy IBM Security® QRadar® technology to run its new SOC service. “In the marketplace, every security vendor claims their product is the best,” notes Eng. “Which is fair enough, but we looked at the Gartner Magic Quadrant, and there was IBM. Not only was QRadar the number one product, it had consistently been a leader for the past several years. That and our deep relationship with IBM over the last 20-plus years made the decision a no-brainer.”

Named the QRadar Managed Detection and Response service, the new SOC offering provides a unified, end-to-end service for a company’s cyberthreat needs. “We can typically get a client started within three to four weeks—we only have to bring in their log sources,” says Eng.

He continues: “And after that we watch their environment 24x7 for any indicator of a potential attack. From a single pane of glass, we can see log sources from across their business—from firewalls to endpoints to applications and databases. If it’s in the network, we can see it.”

The new SOC service relies on IBM Security® QRadar SIEM technology to oversee event management, using real-time analytics to sift through contextual threat data and shift to a more proactive monitoring posture. The SIEM solution’s IBM Security QRadar Advisor with Watson® functionality, in turn, harnesses the capabilities of AI to map offenses against a security incident database and better contextualize individual security incidents quickly and accurately.

And if a threat is detected, Silverfern uses IBM Security QRadar SOAR to manage the entire security incident lifecycle from detection through remediation. Much of this happens automatically as the business aligns its response efforts with predefined use cases—such as threat hunting or security-alert triaging.

Both of these QRadar offerings are delivered under an IBM Cloud Pak® for Security license. And in the not-too-distant future, Silverfern intends to further explore the capabilities delivered by the IBM Cloud Pak.

“The IBM Security team engaged with us at the very beginning of the project,” recalls Eng. “They gave us the knowledge to move forward that we initially didn’t have internally. They were very patient and passionate about it—training my team and making sure we were well-educated. They really helped us with getting certified on the new technology.”

Alongside this knowledge transfer, the IBM products selected to flesh out the Silverfern SOC service helped the firm build a more competitive, responsive service for its client base.

“One of the great things about QRadar,” adds Eng, “is that it already has hundreds of use cases built-in that we can utilize. So when we bring a new SOC customer on board, we can immediately demonstrate to our client a return on their investment because we can show them everything that we are now managing. They don’t have to wait for us to build it.”

He continues: “With the IBM software, we have a great portal for our security teams to see what’s going on. It reduces the amount of training that we have to give our internal engineers, and that directly impacts our ability to manage more clients under this new platform. We also have more information that we can share with our clients. So we can give them a better understanding of what is actually happening in their network.”

To streamline the delivery of its QRadar Managed Detection and Response service, Silverfern took advantage of its position as an IBM Business Partner and signed an IBM Embedded Solution Agreement (ESA). “The ESA was truly a godsend for us,” notes Eng. “It lets us bundle the IBM technology directly with our service, so we can go to the market with a clear pricing model that we control. We can make the overall investment in our SOC quite attractive—all without extending timelines to resolve licensing issues.”

Silverfern is already realizing value from its work with IBM, as Eng notes: “When we compare our managed IT services from before with the managed SOC service using IBM, we’ve increased the revenue from that part of the business by 50%. And I expect in the next 12 months, we’ll probably increase it to double our pre-SOC revenue. There’s so much potential, and I’m very excited about the future.”

Much of this growth comes from the ability of the more comprehensive, centralized SOC service to attract new customers—particularly smaller-sized businesses that may not have the internal resources to dedicate to around-the-clock monitoring.

“Cyberthreats aren’t going away, and every company—big or small—is going to require some type of detection and response,” adds Eng. “They’re going to need insight into their operating environment and a clear understanding of what’s going on. They’re going to need to demonstrate compliance with industry and government standards. And that’s some of the value we can deliver. We can help reduce their risks. We can help them report to their boards and auditors. We can help keep their information safe.”

He continues: “That’s the most important thing to our customers, that we give them peace of mind about the safety of their network when they go home at the end of the day.”

Request a customized demo of QRadar SIEM →

Boasting a rich, 30-year history, IBM Business Partner Silverfern (link resides outside of ibm.com) provides cybersecurity and consulting services and solutions. The business is headquartered in Perth, Western Australia, and specializes in disaster recovery, managed security services and security awareness training.