Thomas Müller was awakened early one morning last year with an urgent message. The security consultant working with German air compressor company, Bauer Kompressoren, had been vacationing along Italy’s Lake Garda when the message arrived. There was something strange happening on the Bauer network and it was coming from an unusual location: Iran.
Within minutes Müller was in contact with Bauer CIO Ronald Michl and members of their managed security operations center. They investigated the situation, identified the problem, and shut down the threat.
The cause of the incident was a company laptop inadvertently being carried across the Iranian border, intercepted and infected by border control. The managed SOC had been conducting a threat hunting operation and noticed the issue. The asset was disabled and an investigation into the extent of the threat was conducted. Thankfully, there was no further damage.
The SOC team that found and resolved the potential breach: Rapid7.
The always-on nature of the Rapid7 SOC was critical in identifying and remediating the incident.
"That's what was most important, having this SOC and the corresponding services behind it,” Michl said. “So that somebody is constantly monitoring our system and the behavior of our system… Also the active response is very important for us because we know that somebody's intervening even if we are not available.”
Bauer Kompressoren develops and builds air compressor systems for various industrial, defense, healthcare, and aerospace industries; and even personal uses like SCUBA diving. They are a relatively small company, just about 100 people, but they have a wide footprint across many highly technical markets. And a mandate to provide technologies lives rely on.
Like many companies their size, staffing a 24/7 SOC in-house was out of the question. They turned to Rapid7’s managed services solutions to fill in the “80% problem” they were facing with their own small team of security professionals.
“We did some comparison,” Michl said, “but it was clear that we have no chance to run our own SOC team. We couldn't find the people we needed and it's far too expensive. So the only solution to get this important component in our security architecture is to do it with a service provider.”
They had options. As one member of a 23-company Bauer global enterprise — many of which used other service providers — determining the right one for Bauer Kompressoren took some deep evaluating — not to mention created some heady competition. They were searching for a partnership that crossed the best quality with the best price. The partner that best provided that balance would win the day.
“If I'm honest, definitely the costs,” Michl said of their biggest factors in choosing a managed services partner. “Of course, we need the quality and we have to be sure that the partner we choose is a very strong partner. But at the end of the day, especially for companies like Bauer and this size, it's always a matter of costs.”
When they first began their partnership with Rapid7, Bauer Kompressoren were in need of a SIEM able to handle the large volume of data that their team produces but wouldn’t overwhelm them with ingestion and storage prices. With long tail planning timelines and the potential for significant ramp ups of data in the event of an incident, finding a partner that would be able to handle the data they were collecting without nickel-and-diming them was paramount. Rapid7’s tiered subscription pricing offered the flexibility Bauer was looking for.
“That was a main factor because that was one of our main recommendations,” said Müller. “As we evaluated different SIEM vendors back then, we saw that we have cost models for events per second, for example, which you cannot calculate long-term.”
While Bauer Kompressoren trusts Rapid7’s SOC to be a valued partner capable of protecting their assets 24x7, they also saw the benefit of having access to Rapid7’s platform themselves — something that comes standard with Rapid7’s managed detection and response service subscriptions.
Müller recounted a use case where having access to the Rapid7 platform leveled up the cooperation between the internal security team and Rapid7’s SOC. The two could work together, with the internal team providing much needed context on the personnel and priorities of the company, improving Rapid7’s ability to prioritize risk protection efforts.
Bauer Kompressoren’s customers rely on them to provide mission critical components that can be trusted to work at the most important moments. They, quite literally, provide the air their customers breathe. But when it comes to providing security solutions that work time and time again, this company, who so many others trust, trusts Rapid7. Rapid7 is here for that.