A Broad Base of Integrations Can Streamline the Work of MSSPs
The more customers an MSSP has, the more complicated it becomes to connect to those customers’ tool stacks. Trifork found that a big benefit of SOAR was that it could streamline the integration process.“We have multiple customers, and we need to be able to handle these customers on the same platform, so we only have to do integration to a third-party vendor only one time and we can utilize that across our customers,” said Karsten Thygesen, Chief Technology Officer at Trifork.
“In the past we needed to do a lot of custom development to set up these integrations, make a lot of coding ourselves, all these things. Today… we get most of this out-of-the-box. So, we don't need to develop and maintain all these integrations for hundreds of systems. That's a really, really big benefit for us.”
SOC Tasks Are Faster with SOAR
One of SOAR’s main selling points is that it automates tedious, time-consuming tasks and frees up analysts’ time, so it’s no surprise that this was one of the benefits the Trifork team told us about.“We can work way faster,” said Karsten Thygesen. “A lot of the work has been done in advance due to the integrations and automations, so the tier one and tier two people we have in our security operations center only spend their time on doing the key important decisions on how we should handle different security events. Many of could even be fully automated, so we do not use human time on handing them.”
“...it was not possible to do incident handling in the way we do it today. It is very easy to get an overview of all the incidents that come in. All the detections, and all the alerts, they're collected into a single platform. I don't think we could handle incidents at the volume we do without a tool like .”
Codeless SOAR Makes it Easy to Onboard Customers
Busy MSSPs spend a lot of time onboarding new customers, which slows their ability to grow. The more customers they bring on, the more people they need to dedicate to onboarding. Henrik Skovfoged, Business Unit Lead at Trifork, and Philip Lyngø both highlighted in their interviews how SOAR had helped them solve this problem.“ has made it a lot easier to onboard new customers, because it's so flexible and it's possible to get new log sources quite easily integrated,” Henrik told us.Philip talked about how the multitenant solution gave Trifork a reusable template for onboarding, which could then be customized to the customer’s specific needs:“When implementing new customers, or implementing new playbooks, or use cases things like that, it's easy, it's fast, it's very intuitive, but also we can reuse it across the different customers.”
SOAR Helps MSSPs Ensure a High Quality of Service
A theme that came up regularly is that SOAR has enabled Trifork to provide better services, ensure they provided those services consistently, and give their customers visibility into the services they’re getting.Henrik Skovfoged told us that SOAR is important for Trifork to “ensure the right quality and ensure that we are working after the same playbooks and procedures all the way along. It's a tool that we use for providing the right quality to our customers.”By giving their customers access to the SOAR platform, Trifork can demonstrate value and enable transparency. As Henrik also told us:“Being able to prove to the customer that we have the same quality, that we're doing it in a structured way, the way we are handling all the incidents, and doing it transparently as well, that is really a big quality for us.”