How migrating to Elastic Security helped a digital safety software company cut incidents by 85% with UnderDefense

This blog tells the story of a SaaS company whose platform delivers enterprise digital safety, serving organizations that depend on the service being available and trustworthy around the clock. Its infrastructure reflects that mission: The environment is weighted toward servers, virtual appliances, and cloud workloads with a comparatively small employee fleet. Its product protects other companies, so its own security operations carry direct commercial weight, which is also why the company appears here anonymously.

With the support of UnderDefense — an Elastic partner — the company migrated from a noisy legacy QRadar deployment to Elastic Security on Elastic Cloud.

Security at the company is run by a team of two. That team is responsible for monitoring the full environment, responding to incidents, and producing the evidence that auditors and enterprise customers request. The company had operated for years without a major breach; yet, by 2026, the tooling underneath that record was working against the people who relied on it.

The legacy QRadar deployment ingested data indiscriminately. Every log source and every system event flowed in, and the detection logic was configured broadly enough that alerts fired constantly. With two people on the security team, the only viable response was triage by severity: High and critical alerts were reviewed while everything below that threshold accumulated unactioned.

Beneath the alert volume sat a structural problem. There was no data lifecycle management, no clear picture of which log sources added detection value and which added cost and noise, and no retention policy that satisfied audit requirements. When auditors asked for evidence, the team compiled it manually, a process that exposed both the compliance gap and the limits of the team’s operational bandwidth.

Detection quality

• 85% reduction in security incident volume compared with the legacy QRadar baseline, following migration and detection tuning

• More than 100 custom detection rules, each mapped to the environment and the MITRE ATT&CK framework

Response speed

• 61% reduction in mean time to respond (MTTR)

• Analyst capacity shifted from reactive alert triage to threat investigation and proactive threat hunting

Visibility and operations

• 25 purpose-built Kibana dashboards providing unified visibility across all infrastructure layers with no window-jumping or ad hoc querying needed for daily work

• Automated stakeholder reporting delivered directly from the platform, replacing manual compilation

Compliance and audit readiness

• Audit-ready log retention via Elastic frozen-tier snapshots with the full evidence trail available on demand

• Lower storage cost for audit-grade retention with frozen-tier snapshots replacing the always-warm storage model of the legacy environment while delivering the same evidence value

Team leverage

• A two-person security team now operates with coverage depth that previously required significantly greater headcount

• UnderDefense analysts work alongside the internal team, carrying detection engineering, platform maintenance, and around-the-clock monitoring

Analysts now run proactive threat hunting sessions. One session traced an unremarkable VPN connection back to a proof-of-concept project from years earlier; the channel had stayed silently active ever since, and the team investigated and closed it before anyone could use it.

Documented, reproducible audit evidence strengthens the company’s own sales motion since its enterprise customers ask for exactly this kind of proof during procurement. And the move to Elastic Cloud removed the maintenance and storage management burden of the on-premises legacy deployment.

UnderDefense and Elastic continue to expand AI-assisted detection and investigation in the environment, pairing Elastic’s AI capabilities with UnderDefense’s agentic AI SOC platform. Queries that took an analyst 5 to 10 minutes to structure and run now return enriched results in about a minute.

The deployment shows that a mid-market organization with a lean security team can reach enterprise-grade coverage by pairing Elastic’s open, cloud-native security platform with the detection engineering and operational depth of an experienced security operations partner. For organizations ready to have that conversation, contact UnderDefense.

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.