Major UK central government organisation

Enterprise security operations.
Strategic control retained.

How a major UK central government organisation turned its technology investment into a 24/7 security operations capability with NormCyber.

For a major UK central government organisation, cyber security underpins the continuity of essential operations and the confidence of the public it serves. Its security capability must work under pressure, around the clock, within demanding governance requirements.

The organisation had selected Fortinet’s FortiSIEM and FortiSOAR software platforms to underpin its future Security Operations capability. That investment provided the technology to monitor security events and automate workflows. The next challenge was turning those platforms into an operation the organisation could depend on, every hour of every day.

The challenge

The challenge: technology was only the starting point

A security platform needs continuous attention to deliver lasting value. Detections must be refined, emerging threats investigated and automated workflows adapted. Someone must distinguish the activity that matters from the noise – and understand what it means for the organisation.

Building that capability entirely in-house would require significant investment in specialist recruitment, 24/7 staffing and ongoing operational management.

The organisation needed a partner with the expertise and capacity to operate its chosen technology, working alongside its existing cyber security team. Crucially, it wanted to retain ownership of its platform and data, preserve its internal capability and remain in control of how its security operation was governed.

The delivery requirements were:

• UK-based 24/7 operations
• Appropriately vetted analysts
• Deep Fortinet expertise
• Experience of complex public sector environments

The partner also needed to mobilise against demanding implementation timescales and integrate with established processes, while respecting data sovereignty and long-term operational control.

The brief called for a complete operating capability that could become part of the organisation’s own security function.

The approach: specialist operations, built around the customer

NormCyber implemented its Hybrid SOC to bring together the organisation’s technology and internal expertise with Norm’s operational capability.

The responsibilities are complementary. The organisation contributes its understanding of business priorities, operational risk and governance. Norm provides the analysts, processes and specialist expertise to run and continuously improve the platform.

Working as an extension of the internal team, Norm monitors and investigates security events 24/7. Analysts assess potential threats, validate incidents and escalate prioritised findings into the organisation’s cyber security team.

That work gives internal specialists a focused basis for action. They can apply their knowledge of the organisation to investigating genuine incidents, making informed decisions and strengthening resilience.

Making the investment work harder, every day

Continuous monitoring is only part of the service. Norm also develops the capability behind it, continuously ensuring the platform remains effective as threats and organisational requirements change.

Its analysts:

• Refine detections to improve accuracy and reduce false positives.
• Develop new detection use cases as threats emerge.
• Improve automated workflows and response playbooks to support faster, more consistent handling.
• Conduct proactive threat hunting, drawing on intelligence and operational insight from across its customer base.

This ongoing work is what turns a deployed platform into a mature security operation. The technology is continually tuned, tested through operational use and improved by the specialists running it.

For the customer, that means access to expertise and wider threat insight that would take considerable time and resources to develop independently.

Control that lasts beyond the partnership

“We operate your platform. We don’t own it.”
Paul Cragg, Chief Technology Officer, NormCyber

Ownership was central to the operating model from the outset.

The organisation retains its platform and security data, together with strategic control over governance. Customer-specific detections, playbooks and configurations remain documented and accessible, while Norm retains its underlying methodologies and intellectual property.

This preserves the organisation’s ability to make future decisions about its security operation which provides both immediate operational capability and longer-term flexibility.

The outcome: an operational capability the organisation owns

The organisation now has an enterprise security operations capability that combines its own context and governance with Norm’s specialist expertise and continuous operational support.

Hybrid SOC delivers:

• 24/7 monitoring and investigation, without the need to build and staff a large internal shift function.
• Validated, prioritised incidents, helping internal specialists focus their attention where it matters.
• Continuous improvement, with detection and automation evolving alongside threats and organisational needs.
• Strategic ownership, with technology, data and governance remaining under the organisation’s control.

Its technology investment now supports a functioning, continuously improving security operation with the expertise to sustain it and the ownership to shape its future.