CASE STUDY · MANAGED SOC (MSS)
From lack of visibility to response in hours
How Tempest centralized data, expanded detection and automated response for a large capital markets company, with Google Security Operations as the engine of its SOC operation.
ABOUT THE CLIENT
A capital markets company with high data volumes
The client is a large financial services company operating nationwide in the capital markets. Its operation handles high data volumes and must meet strict governance, compliance and regulatory standards.
- Financial services · capital markets
- Large enterprise
- Nationwide operation
THE CHALLENGE
Lots of data, little visibility
Before the project, the client operated with decentralized information and no consolidated view of its environment. In practice, this meant low visibility into cyber threats and very little capacity for immediate response, in a sector that demands strict governance, compliance and regulatory standards.
- Decentralized information
- Low visibility into threats
- Very little capacity for immediate response
- Governance, compliance and regulatory demands
WHY TEMPEST
Delivery capability on the right platform
Choosing Tempest came down to delivery capability: combining Google SecOps as the technology engine with differentiators that elevate day-to-day security operations.
- Native UBAUser and Entity Behavior Analytics for behavior-based detection.
- Curated rulesExpanded detection with the platform's curated rules.
- Advanced automationPlaybooks that speed up containment and escalation.
- Continuous improvementMethodologies to evolve security operations over time.
THE SOLUTION
Google SecOps as the engine, Tempest intelligence in the operation
Tempest implemented Google Security Operations as the main monitoring platform and added its own intelligence across several layers: governance, detection, automated response and metrics. The result is a centralized operation in which Google SecOps is the engine and the Tempest team runs the SOC day to day.
Three differentiators that make a difference in operations
How Tempest intelligence works on top of the platform
RESULTS
More detection, faster response and a centralized operation
- Response in hours, not daysMean time to respond (MTTR) dropped from 15 days to 8 hours.
- Fewer false positivesIntegrated behavioral analytics makes detection more contextual and proactive.
- Centralized operationAll data sources, previously scattered, are now analyzed on a single platform.
- More detection with less manual effortCurated rules, automatic rules and SOAR playbooks in operation reduce the team's repetitive tasks.
2026 Google Cloud Security Partner of the Year: Managed Security Service Provider, Latin AmericaTempest is a Google Security Operations MSSPWant more visibility and faster response in your environment?
Subscribe to our Newsletter