How Southern Housing strengthened round-the-clock cyber defence – and made resilience visible to its board
With 167,000 residents relying on its services, Southern Housing needed security operations that could protect the organisation around the clock, relieve pressure on its internal team and provide clear evidence of cyber resilience. Norm delivered a new, collaborative model that now saves the team four to five hours every day.
Southern Housing is one of the UK’s largest housing providers, managing 80,000 homes across London, the South East, the Isle of Wight and the Midlands. For 125 years, it has helped people in housing need access safe, high-quality and affordable homes.
The availability and security of its systems are therefore more than an IT concern. They are fundamental to maintaining essential services for their residents.
In brief
Speak to a team member- Round-the-clock protection: Norm’s CREST-accredited UK SOC provides continuous monitoring, proactive threat hunting and expert response across Southern Housing’s Microsoft-based environment.
- Less noise, more capacity: By filtering out false positives and escalating fewer than one percent of incidents, Norm saves Southern Housing’s internal team four to five hours every day.
- Resilience the board can see: Smartbloc and Norm’s CAF-aligned Cyber Resilience Score give technical teams and senior leaders a clear, continuously updated view of cyber risk, priorities and progress.
- A genuine extension of the team: A dedicated Focal Analyst connects Southern Housing with expertise from across Norm, helping turn security insight into prioritised action and continuous improvement.
The challenge
The Challenge
Southern Housing regularly monitors its risk environment, recognising that failure of systems would have a significant impact on service delivery to residents. It must also demonstrate its ability to protect operations against an increasingly complex threat landscape – including rising cyber incidents across the social housing sector and rapid advances in AI-enabled attack vectors – to earn top marks against the Regulator’s consumer standards.
The company maintains a cyber security and business resilience framework supported by board-level oversight, continuous monitoring through a 24/7 Security Operations Centre (SOC), regular penetration testing and Cyber Essentials Plus accreditation, mandatory staff training, and supplier due diligence arrangements.
In alignment with the Procurement Act 2003, Southern Housing reviews its external SOC contract every three years to secure the best market value and ensure its cyber defences actively adapt to modern threats, rather than just meeting minimum compliance. As part of this competitive process, Southern Housing selected Norm to replace its existing vendor.
“We evaluated multiple MSSPs within the tender process, and Norm emerged as the clear choice across all core criteria,” said Selina Rahman, the Head of Cyber Security at Southern Housing. “It brought the right level of expertise to manage our Microsoft-based environment and showed specialist knowledge that we felt would support our ambitions in the long term. We were also impressed by the level of understanding and care demonstrated by Norm’s Security Operations and Focal Analyst teams during a site visit. It was open, productive dialogue with Norm from day one, with services tailored to our needs and existing investments.”
The Solution
Within six months of the first engagement, Norm’s Managed Detection and Response (MDR) service was seamlessly integrated into Southern Housing’s IT estate, alongside its internal SOC function, providing 24/7 monitoring and proactive threat hunting over its cyber landscape.
Mapped to the NCSC Cyber Assessment Framework, the service combines automation, analyst expertise and integrated telemetry to detect, contain and neutralise threats with decisive speed. Norm’s CREST-accredited, UK-based SOC team isolates and remediates threats, typically only escalating less than one percent of incidents. The team also brings expertise in digital forensics, root cause analysis and targeted security hardening, supporting continued risk reduction and resilience.
“Cyber incidents don’t just happen nine-to-five, Monday to Friday. When our internal security experts are not at their desks, Norm is our eyes and ears. This is why it’s so important to have a reliable partner in place. We trust Norm to be that single point of defence for us when we’re most vulnerable,” Rahman continued.
Next to Norm’s CREST-accredited SOC team, Southern Housing also benefits from a dedicated Focal Analyst who understands its business, goals and priorities and serves as a point of liaison. Norm’s Focal Analysts are accountable for driving tangible cyber resilience improvements within structured monthly review cycles and regular engagement.
“Our Focal Analyst consistently goes above and beyond. We rely on her guidance not only in our day-to-day operations, but also when shaping our wider cyber security strategy and evaluating new services.
Because she works so closely with Norm’s SOC and wider team of specialists, she can quickly bring in the right expertise, whatever the issue. I haven’t encountered this model elsewhere in the industry, and it has proved highly effective in helping us stay focused on our goals.
Most importantly, we feel like a genuine priority. Our relationship with Norm is so collaborative that the team feels like a natural extension of our own.”
The Results
Through Norm’s Managed Detection & Response service, Southern Housing benefits from round-the-clock threat hunting and monitoring, while Norm’s Focal Analyst analyses its environment to identify what is driving cyber exposure and help prioritise actions that will reduce risk the fastest.
Results are tracked in real-time via the Smartbloc Portal, which provides full visibility into Southern Housing’s cyber security status, including a visual summary of its security posture and recommended next steps. Norm’s government-grade Cyber Resilience Score complements this by providing an empirical measure of cyber resilience. Built on the UK NCSC’s CAF, it provides both a baseline and a structured improvement path tied directly to business continuity. Expressed as single number – which updates automatically as the environment changes – it gives leadership, customers and insurers a defensible view of cyber risk, with progress they can verify.
“Norm provides a great level of visibility into our cyber security efforts. The Smartbloc Portal gives me a holistic view over alert status and advice in one place, which helps with decision-making and reporting to senior leadership and the board.
At the same time, Southern Housing’s technical team can access the detail it needs without being overwhelmed by alert fatigue. By filtering out false positives, Norm saves the team between four and five hours every day – time that can be redirected towards higher-value priorities.
Norm has helped Southern Housing move to a more measurable and accountable security operations model, aligned with the NCSC’s Cyber Assessment Framework. Beyond the technical and operational impact, however, the greatest benefit is the reassurance of having Norm’s expertise readily available.
“The responsiveness and reassurance we get from Norm’s experts is outstanding. Norm is our first port of call if we have any cyber security concerns or just need a second opinion, and the advice we get is always timely and considered. It’s a true partnership and we look forward to our continued work together,” Rahman concluded.
