The context
The constraint on security operations in the Kingdom is not budget or awareness. It is people. Demand for 24/7 monitoring and incident response has outpaced the available pool of qualified analysts, and regulatory expectation now assumes a detection and response capability that most organisations cannot staff internally. The result is a widening gap between what organisations have bought and what they can actually operate.
A healthcare provider operating across several sites sat squarely in that gap. It had a SIEM and no detection capability. The distinction is common and worth stating plainly. Logs were arriving, storage costs were real, alerts fired constantly, and nobody was investigating them — because the two people responsible for security also ran the service desk.
Alert fatigue had reached the stage where the console was reviewed weekly. In practice the organisation was collecting evidence of incidents it would only read about afterwards. Clinical systems were in scope, patient data was in scope, and data protection obligations applied to both.
The approach
ITBuilders started by reducing what was collected. This is counterintuitive to most stakeholders and it is almost always correct. Log sources were assessed for detection value rather than completeness, and roughly a third were moved to archive-only retention. Ingestion volume dropped and so did noise.
Use-case development followed, built around the threats that applied to this specific environment: credential abuse against remote clinical access, lateral movement from administrative workstations, and data egress from records systems at unusual volume or hour. Each use case was written with a documented response path before it was enabled. A detection without a defined action is an alert, and alerts were the original problem.
Tuning ran over a defined baselining period against live traffic, with thresholds set from confirmed benign activity rather than vendor defaults. Night-shift clinical workflows generate behaviour that looks hostile in any generic ruleset. Learning that in week three is considerably cheaper than learning it mid-investigation.
Coverage was then extended to a 24/7 model, with tiered triage absorbing volume and escalation reserved for activity requiring the client's own decision. The internal team stayed in the loop for anything touching clinical operations, because the judgement about whether a system can be isolated during a working day belongs to the organisation, not its service provider.
Playbooks were documented and tested. Two tabletop exercises with the clinical operations lead exposed an unmapped dependency — an isolation procedure that would have taken down a diagnostic workflow. It was rewritten before it was ever needed.
ITBuilders holds the Fortinet Engage Partner Specialization in Security Operations. In a market where monitoring is increasingly bought as a service, the credential answers the question buyers cannot otherwise resolve from a proposal: whether the provider's competence in the platform has been assessed by anyone other than the provider.
What changed
What changed was the organisation's position relative to time. Incidents are now identified while in progress rather than reconstructed afterwards. Regulatory reporting can be met with documented evidence of detection and response. The two-person team returned to the work only they can do.
Continuity of operation
The capability is operated by ITBuilders on an ongoing basis — triage, tuning as the environment changes, playbook review, and the reporting the provider's compliance function relies on. Detection engineering is not a project with an end date. Use cases decay as applications change, and an unmaintained ruleset produces the same weekly-reviewed console the organisation started with. Continuity of operation is the deliverable.
